Topic starter
01/08/2026 10:49 pm
TL;DR: The fastest AI-powered intrusions now reach data exfiltration in 72 minutes, down from nearly five hours a year earlier, as attackers compress reconnaissance, initial access, and lateral movement into one machine-speed workflow, according to Novee. Periodic testing and manual triage no longer match the tempo of compromise; continuous exposure management is becoming the practical baseline.
Editorial analysis by NHI Mgmt Group, based on content published by Novee: “How AI-Powered Attacks Are Outpacing Traditional Security Defenses”.
Key questions
Q: What breaks when attacker dwell time drops below an hour?
A: Periodic testing, manual triage, and batch remediation all break down because they assume the defender has time to inspect, prioritise, and act before impact.
Q: Why do service accounts and access tokens create more breach risk than human accounts?
A: Service accounts often lack MFA, are reused across systems, and remain active long after the person who created them has moved on.
Q: What are the signs that AI-enabled threat activity is outpacing a security team?
A: Common signs include rising alert fatigue, slower triage, more time spent on manual investigation, and a growing backlog of low and medium severity events.
Practitioner guidance
- Shorten the exposure-to-remediation loop Measure how long newly exposed vulnerabilities, tokens, and permissions remain reachable in production, then remove delay between discovery and containment.
- Inventory and constrain non-human identities Map service principals, API tokens, agent credentials, and other machine identities to owners, privileges, and usage patterns.
- Prioritize identity-first monitoring Shift detection logic toward authentication anomalies, delegated access abuse, unusual token use, and fast privilege chaining.
Bottom line: AI-accelerated attacks collapse the defender’s response window, so security programmes must assume that exposure can become impact in minutes rather than hours.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:58 pm
Speed has become the decisive security variable. When attacks can move from entry to exfiltration in about an hour, the old assumption that defenders can investigate first and remediate later no longer holds. The operational question is no longer whether a control exists in theory, but whether it interrupts a machine-speed attack chain before damage is done. Practitioners should treat response latency itself as a governance risk.
A question worth separating out:
Q: When should organisations prioritise continuous exposure management over periodic testing?
A: They should prioritise it when asset churn, AI-assisted exploitation, or heavy use of service accounts means a flaw can be discovered and abused before the next scheduled review. In that environment, the old testing cadence is too slow to change attacker outcomes.
👉 Read our full editorial: AI-powered attacks are collapsing the breach timeline for defenders