Notifications
Clear all
Topic starter
01/08/2026 10:49 pm
TL;DR: AI-powered attacks now reach data exfiltration in 72 minutes, down from nearly five hours the year before, according to Palo Alto Networks’ 2026 Unit 42 Global Incident Response Report. That speed leaves periodic testing, manual triage, and CVSS-led prioritisation behind; continuous exposure management is now the defensive baseline.
NHIMG editorial — based on content published by Novee: How AI-Powered Attacks Are Outpacing Traditional Security Defenses
By the numbers:
- AI-powered attacks now reach data exfiltration in under 72 minutes.
- 90% of breaches still trace back to preventable, table weaknesses like misconfigured access controls, excessive permissions, and unpatched public-facing applications.
- IBM X-Force found that 56% of disclosed vulnerabilities required no authentication to exploit.
Questions worth separating out
Q: What breaks when organisations rely on periodic access reviews for AI systems?
A: Periodic access reviews break when the identity scope changes between review cycles.
Q: Why do non-human identities become a bigger risk in AI-speed attacks?
A: Because NHIs often provide the shortest route from discovery to real access.
Q: What do security teams get wrong about AI-assisted attack speed?
A: They treat speed as a detection problem alone, when it is also a governance problem.
Practitioner guidance
- Compress identity review cycles Move service-account, token, and integration review from periodic audit cadence to continuous monitoring with ownership, scope, and last-use checks.
- Eliminate standing privilege where automation touches sensitive assets Replace always-on access with task-scoped entitlement for AI assistants, CI/CD automation, and backend services that can modify data or invoke administrative functions.
- Instrument the identity layer for machine-speed abuse Correlate service ticket use, token issuance, delegated access, and anomalous API calls in near real time so you can spot quiet escalation paths before exfiltration completes.
What's in the full article
Novee's full article covers the operational detail this post intentionally leaves for the source:
- The full attack timeline with stage-by-stage examples of how AI compresses reconnaissance, access, and exfiltration.
- The practical differences between periodic testing, continuous exposure management, and offensive validation at machine speed.
- The source's examples of AI-related supply chain compromise, identity abuse, and application attack paths.
- The vendor's remediation framing for teams trying to adapt to faster attack cycles.
👉 Read Novee's analysis of how AI-powered attacks are compressing the breach timeline →
AI-driven attack timelines are shrinking fast: are controls keeping up?
Explore further
01/08/2026 10:58 pm
AI speed turns control lag into the primary breach condition. The article’s core finding is not simply that attackers are faster, but that the defender’s validation and escalation cycles are slower than the attack path itself. That creates a control gap between detection and containment that periodic testing cannot close. For identity programmes, that means the decisive question is not whether a control exists, but whether it can still act before a machine-speed attacker completes the kill chain.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to Astrix Security & CSA.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%, according to Astrix Security & CSA.
A question worth separating out:
Q: How should organisations respond when attackers can exfiltrate data in under 72 minutes?
A: They should rehearse containment against machine-speed timelines, not business-hours timelines. That means rapid privilege revocation, live evidence capture, isolation of exposed integrations, and clear decision authority for identity and response teams. If those steps are manual and sequential, the attacker usually finishes first.
👉 Read our full editorial: AI-powered attacks are collapsing the breach timeline for defenders
