Topic starter
27/10/2026 7:04 pm
TL;DR: AI-enabled attackers are now moving at machine speed, with breakout times reportedly 18x faster and a fastest observed breakout of 47 seconds, according to Coalition, making human-led MDR timelines too slow to stop containment-critical activity. Alerting without immediate action has become documentation, not defence.
Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “Why MDR is Failing: Is Your Detection Tool a High-Priced Alarm?”.
By the numbers:
- Threat actors are moving 18x faster than they were a few years ago, according to Coalition.
Key questions
Q: What breaks when MDR relies on human triage for machine-speed attacks?
A: The control breaks when the response loop is longer than the attacker’s breakout time.
Q: Why do fast breakout attacks create a privilege and identity problem as well as a detection problem?
A: Because once attackers use legitimate credentials, the issue is no longer only intrusion detection.
Q: How can security teams tell whether MDR is actually containing attacks?
A: Look for evidence that detections are being turned into immediate isolation or credential revocation, not just tickets.
Practitioner guidance
- Define a breakout-time containment target Set a measurable threshold for how quickly high-confidence detections must be contained, then test whether your current MDR workflow can meet it under live conditions.
- Automate containment for high-confidence alerts Route confirmed malicious activity to automated isolation, token revocation, or account disablement instead of waiting for manual approval in every case.
- Shorten the credential response path Pre-authorise actions for suspicious account activity so identity teams can revoke access, terminate sessions, and block reuse before lateral movement continues.
Bottom line: Traditional MDR can become a notification layer when attackers move faster than human triage and escalation workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/10/2026 9:29 pm
Human-led MDR has become a latency problem, not a visibility problem. The article’s central point is that notification without immediate containment no longer matches the pace of modern attacks. That changes the governance expectation for MDR from 'detect and escalate' to 'detect and stop' before lateral movement completes.
A question worth separating out:
Q: Should organisations prioritise automation or more analysts for AI-driven threats?
A: Automation should come first because the problem is speed and scale. More analysts may improve judgment, but they do not change the fact that attackers can generate more events than people can review. Organisations need software to absorb routine validation, triage, and containment so analysts can focus on high-confidence exceptions.
👉 Read our full editorial: Machine-speed attacks are exposing MDR’s response gap