Accelerated breakout time via AI has made it nearly impossible for humans to keep pace  

COMMENTARY: Looking back on 2025 to see what we have learned and how fast that knowledge has been tested, one single statistic stood out to me more than anything: The fastest observed breakout time was 27 seconds!

In this case breakout time represents the time it takes an attacker to move laterally from the initial compromise to yet another system within the same environment.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

That number needs context. It does not mean an exploit was developed, tested, and deployed in that time frame. It does not mean an threat actor made complex decisions at unusual speed. It represents runtime and the increasing AI-based automation of offensive frameworks: the lateral movement logic, the credential harvesting routines, the infrastructure orchestration, all of that existed before the first packet reached the victim.

Those 27 seconds are the execution window between initial access and meaningful lateral expansion. Meaning the complex puzzle was prebuilt, all it needed was the last piece to plug in. It may have been a chain waiting on a solid initial vector, it may have been a complete attack chain and the newer vectors perform more reliably or achieve a better level of initial access.

From an incident response perspective, that changes how we interpret a compromise. Long gone are the days of “Well if they are inside our firewall we have bigger issues” because, clearly we do and not likely for the reasons we’ve made that statement as a defense.

Just five years ago, even sophisticated ransomware operations showed clear signs of manual interaction in the compromise stages. Early Ryuk and Conti intrusions leveraged hands-on keyboard movement. There were pauses between privilege escalation attempts. Domain reconnaissance often occurred in bursts separated by operator activity. Dwell time before wide scale impact could stretch from hours to days. That time often let well-constructed detection and defenses receive new intel or SIEM and IDS systems to pattern attack IOCs. Crucial time to detect and respond before that second collision.

Around 2020 and 2021, the pacing shifted. The pandemic and the mass exodus from the office set the stage for industrialized exploitation, the new remote/hybrid world as a result carries that burden.

ProxyLogon and ProxyShell exploitation demonstrated how quickly disclosure translated into mass scanning and compromise. Log4Shell marked an even more visible acceleration. Within minutes of public proof of concept release, internet-wide scanning activity was measurable. Exploitation modules were integrated into existing frameworks with little delay, and we saw attacks of unprecedented scale, speed, and efficiency

Recent campaigns targeting managed file transfer systems and edge devices have followed a similar pattern. Scanning, exploitation, credential harvesting, and command channel establishment occur as tightly-coupled routines, just like defender playbooks. The separation between foothold and domain wide control continues to narrow, as the time to detect and intervene plummets.

A 27-second breakout reflects architectural advancement. Aggression has not necessarily been what drove better tooling. Advances in AI technology created better tooling, that in turn fueled more aggression. It’s not a shooting gallery anymore where people take shots and measure success in downrange hits: it’s a game of chess in which moves are planned 10 moves in advance, and they are planned for close range engagement. Outcomes are far more certain, because they are not betting on the organization’s indifference anymore, they are betting on the sheer efficiency in which they can outpace the team’s best efforts. In this way, strategic planning on the attackers’ side has trended ever more advanced before the attack even begins.

In practical terms, it suggests prebuilt playbooks encoded directly into tooling. Initial access triggers automated credential extraction. Harvested credentials feed immediately into directory queries. Privilege escalation attempts run in parallel threads. Remote service creation, scheduled task deployment, or token impersonation all execute programmatically.

Reporting to command infrastructure gets integrated into the same deterministic flow. It’s not attacking because it knows the victim, it’s running a play book on the state the victim is most likely in. Once the foothold gets validated, the sequence requires no further operator interaction, so it happens at machine speed.

In contrast, most enterprise security functions still operate on human speed and periodic evaluation. Vulnerability scans run at best weekly or more often monthly. Patches are grouped into maintenance cycles. Access reviews occur at best monthly, more often quarterly.

Security alerts enter triage queues, delaying containment decisions by waiting on approval. These processes are not negligent, they were designed for an era when the adversary tempo allowed for such deliberation times. Where the largest threat was stability, not 24x7x365 constant attack. The tempo has changed, and human speed no longer works.

Attack platforms now operate in continuous assessment mode. They validate reachability, attempt exploitation, learn from their failures, like clicking on a link but not following through. They test credential reuse, enumerate trust relationships, and attempt lateral movement autonomously. If one path fails, alternatives are attempted automatically from initial access to full scale compromise. The process resembles software testing pipelines more than traditional intrusion activity. Lateral targets are profiled and attacks are chosen with intent, not random fire and pray.

This compression of time has direct implications for vulnerability management. So “the way it’s always been done” never accounted for this new playing field.

In a large percentage of incident investigations I have participated in, the initial vector was not novel. It was an unpatched edge device, a known vulnerability in a public facing service, or software that had been awaiting routine maintenance. The exploit itself was well-understood in security circles. The gap was not awareness of risk, it was time between disclosure and remediation. It was human delay.

When exploitation frameworks are prepared to integrate new modules within minutes, patch cycles measured in weeks become part of the attack surface.

Automated detection and remediation of vulnerabilities becomes less about operational efficiency and more about controlling territory on a battlefield. When systems are continuously assessed for exposure and patched or mitigated as updates become available, entire classes of opportunistic intrusion attempts never materialize. The attacker scanning the internet for a recently disclosed flaw finds fewer viable targets. The prebuilt breakout routine has no entry point to trigger, it stalls, and in that’s now subject to longer detection windows. Aggressor plans fail.

This does not eliminate targeted intrusion, but it does remove volume.

In practical terms, automated patch management and real-time vulnerability validation shift the engagement boundary. Instead of security teams spending cycles triaging known, widely-exploited weaknesses, those weaknesses are addressed as part of routine system hygiene. That lets analysts focus attention on anomalous behavior, privilege misuse, identity abuse, and the smaller set of high impact vulnerabilities that require contextual judgment.

The progression from WannaCry in 2017, to SolarWinds in 2020, to Log4Shell in 2021, and to present-day edge exploitation campaigns shows compression in operational timelines and increasing investment in automation. Offensive teams rehearse. They benchmark their tooling. They encode fallback logic and evasion techniques. They behave just like mature software development lifecycles, because in reality, they are.

Defensive programs that incorporate automation at the vulnerability layer introduce similar characteristics on the other side. Continuous asset inventory, automated exposure assessment, policy driven patch deployment, and verification of remediation outcomes operate at machine time rather than ticket time. With that foundation in place, the probability that a newly-disclosed, broadly weaponized vulnerability remains exposed for extended periods decreases substantially.

Twenty-seven seconds reflects preparation and execution speed. It signals that once access gets achieved, expansion can be immediate. The most effective way to reduce the impact of the initial access, and further more that capability: limit the frequency of initial access.

Automated vulnerability detection and patch management do not replace incident response or advanced threat hunting. They reduce the number of preventable incidents that reach those stages. In an environment in which offensive operations continue to refine automated attack platforms, matching that discipline with automated defensive controls changes the balance of effort. It removes much of the routine exposure from contention and lets human expertise concentrate where automation alone does not suffice. In doing so, security teams can focus on what’s really important.  

Gene Moody, Field CTO, Action1  

SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.