Attack speed vs human response: are your controls keeping up?

TL;DR: AI-accelerated attackers are compressing dwell time and breakout time so quickly that human-led triage can no longer keep pace, according to Coalition, with the article citing average dwell time falling from 243 days in 2012 to 11 days in 2024 and breakout time dropping to 48 minutes. Security teams need deterministic automation that can observe, orient, decide, and act faster than adversaries without turning every alert into a manual decision.

Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “Defenders Need Superior Software and Algorithms to Win in 2026”.

Key questions

Q: How should security teams handle compromise when attackers move faster than human triage?

A: Teams should pre-approve deterministic containment actions for the identity and session events most likely to indicate compromise.

Q: Why do stolen session tokens create so much more risk than ordinary file theft?

A: Stolen session tokens are risky because they can bypass password checks and act like already authenticated access.

Q: What are the signs that an account has already been used for rapid compromise?

A: Look for impossible travel, unusual geolocation, logins from privacy VPNs, suspicious IP ranges, and multiple logins in a short window.

Practitioner guidance

• Pre-authorise account containment actions Define which identity and session events can trigger automatic lockout, session revocation, and isolation without waiting for analyst approval.
• Replace manual triage with deterministic playbooks Use rule-based automation for the response steps that must happen consistently, especially when stolen credentials or suspicious IP patterns appear.
• Measure response in seconds, not minutes Track time from suspicious login to containment and set targets for account locking, network isolation, and notification that reflect real attacker speed.

Bottom line: Attackers are compressing the response window so aggressively that detection alone no longer protects the business.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →