Cybersecurity’s Shrinking Clock

Traditional cybersecurity assumes people have time to react. A security researcher finds a flaw.

The vendor confirms it.

An engineering team develops a patch. The patch is tested.

A vulnerability advisory is published. Organizations decide how urgently to deploy it.

Attackers reverse engineer the patch and search the internet for unpatched systems. That model has always been imperfect.

It is becoming dangerous.

Google’s Mandiant says its 2026 vulnerability-management work reflects a world in which exploitation can precede patch availability. The Five Eyes cybersecurity agencies warn that AI is accelerating vulnerability discovery and shortening the period between discovery and exploitation.

AI does not eliminate the need for expert exploit developers. It changes the economics around them.

A model can help search source code for suspicious patterns. It can compare a patch with the older vulnerable code.

It can generate hypotheses about how a failure might occur. It can automate repetitive testing.

It can help an operator understand an unfamiliar programming language or protocol. It can rank thousands of possible weaknesses so a human concentrates on the most promising few.

Each capability saves minutes or hours. Across an entire campaign, those savings compound.

The cyber advantage therefore shifts toward whoever closes the loop fastest. That can be the attacker.

It can also be the defender.

What Attackers Are Actually Doing Now

The easiest mistake in writing about AI cyber threats is to confuse technical possibility with observed use. The public evidence currently shows something more incremental—and perhaps more important.

Microsoft Threat Intelligence says malicious actors are operationalizing AI across the attack lifecycle while human operators still commonly retain control. It observes AI used to reduce friction in reconnaissance, phishing, coding, analysis and post-compromise activity. It has also seen early experimentation with agentic approaches for adaptive workflows, infrastructure management and persistence, but says large-scale agentic cyber operations have not yet become normal.

Anthropic’s analysis of hundreds of accounts banned for malicious cyber activity reaches a similar conclusion from another provider’s telemetry. Threat actors use AI across established MITRE ATT&CK techniques rather than inventing an entirely new category of cyber objective.

The goals are familiar:

steal credentials;

gain access;

persist;

move laterally;

collect data;

conduct espionage;

monetize access;

disrupt systems.

AI changes the cost and speed of doing those things. This is strategically important because cybersecurity has always contained a labor asymmetry.

A defender must monitor thousands of identities, endpoints, services and configurations. An attacker needs one weak path. If AI lets attackers search more paths at lower cost, the asymmetry worsens unless defenders automate too.

AI and the Zero-Day Problem

The most consequential evidence of change may be vulnerability discovery. Google Threat Intelligence reported in May that it had identified a threat actor using a zero-day exploit that it believes was developed with AI.

The wording deserves care.

Google did not declare that AI independently discovered and weaponized a vulnerability without human involvement. It assessed that AI contributed to development of the exploit.

That distinction should remain intact. But even that narrower finding matters.

For years, analysts debated whether generative models would merely help novice attackers write scripts or eventually contribute to advanced vulnerability research. The public record is now moving into the second category.

At the same time, defensive research is progressing rapidly. Microsoft says its MDASH multi-model agentic scanning system coordinated more than one hundred specialized AI agents and discovered sixteen previously unknown vulnerabilities across Windows networking and authentication components, including four critical remote-code-execution flaws.

Those are Microsoft-reported results from its own system, not an independent benchmark of universal capability. But the direction is unmistakable.

The same underlying capability—reasoning over code, generating hypotheses, testing behavior and iterating—can help both sides. AI does not create vulnerability.

It accelerates the search for it.

DARPA’s Autonomous Defender

DARPA’s AI Cyber Challenge provided one of the clearest demonstrations that AI-enabled vulnerability management can move beyond chat interfaces. The two-year competition asked teams to build cyber reasoning systems capable of examining open-source software important to critical infrastructure, finding vulnerabilities and generating patches.

When the finals concluded in 2025, DARPA described the result as a pivotal moment for cyber defense. The winning systems were not merely assistants waiting for researchers to ask the next question.

They were designed to perform extended vulnerability-analysis workflows autonomously. DARPA’s logic was straightforward.

Critical open-source software contains enormous codebases. Human security researchers are scarce.

Manual vulnerability discovery and patching are too slow to inspect everything. AI can multiply the available defensive labor.

This is potentially transformative because modern society depends on software that no single organization fully controls. Hospitals, banks, utilities, cloud services and government agencies all rely on common libraries, operating systems and infrastructure components.

A vulnerability in one widely used package can therefore become a systemic risk. Autonomous cyber reasoning offers a different model:

The challenge is the final step.

A patch that stops an exploit but breaks production can be as operationally damaging as the vulnerability itself. This is why autonomous discovery is easier to trust than autonomous deployment.

The Agentic Security Operations Center

The traditional security operations center is built around alerts. Firewalls generate alerts.

Endpoint systems generate alerts.

Identity platforms generate alerts. Cloud systems generate alerts.

Email systems generate alerts.

Humans then investigate.

The result is often overload.

The next-generation SOC is being designed around agents rather than alerts. Microsoft describes an “agentic SOC” in which automated systems can investigate suspicious activity, assemble evidence, isolate compromised devices and lock affected accounts before the analyst begins the deeper investigation.

The architectural change is subtle but profound. In the old model:

machine detects → human decides → human acts. In the emerging model:

machine detects → machine investigates → machine performs bounded action → human governs consequences. The attraction is obvious.

Credential theft can become lateral movement in minutes. Ransomware can spread quickly.

Cloud identities can create infrastructure almost instantly. A defender who waits for a human to read every alert may already be too late. Autonomous defense attempts to move reaction time below human latency.

How Much Authority Should a Defensive Agent Have?

Cyber defense creates a peculiar autonomy problem. The more authority an AI agent receives, the more useful it can become during an attack.

And the more damage it can cause when it is wrong. Consider a sequence of defensive actions:

The key principle is not “human in the loop everywhere.” That would throw away the speed advantage. The better principle is authority proportional to consequence.

A security agent should be able to gather evidence at machine speed. It may be able to execute reversible containment automatically inside a defined environment. But actions with larger operational, legal or external consequences should cross stronger gates.

When the Defender Becomes an Attack Surface

Adding an AI defender does not simply reduce risk. It creates another system to attack.

NIST’s analysis of AI-agent security responses found broad agreement that agents introduce novel security problems even though many traditional cybersecurity principles still apply. Microsoft’s agent-security research describes several recurring threat classes:

agent hijacking;

intent breaking;

sensitive-data leakage;

supply-chain compromise;

inappropriate reliance;

overprivileged tools.

The core issue is that an agent acts through legitimate permissions. If an attacker can influence the agent’s reasoning, the resulting malicious action may look authorized because technically it is.

This is an inversion of traditional security thinking. Classic malware tries to gain privileges it does not possess. Agent hijacking may instead persuade a legitimate privileged agent to misuse privileges it already has.

Prompt Injection Becomes a Cyber Primitive

Prompt injection began as something that looked almost silly: instructions hidden inside content that persuaded a language model to ignore its intended task. Agentic systems make the vulnerability much more serious.

An agent may read email.

Open webpages.

Inspect repositories.

Query databases.

Run code.

Call APIs.

Use credentials.

If hostile content can influence how the agent interprets its task, the attacker may be able to redirect legitimate tools. NIST’s 2026 red-team analysis identifies agent hijacking through indirect prompt injection as a major security concern. Microsoft demonstrated the risk in research such as AutoJack, where untrusted web content interacting with an agent framework could contribute to a chain resulting in code execution on the host.

The security lesson is larger than any individual vulnerability. Natural language is becoming an executable influence channel.

Traditional cybersecurity learned not to trust arbitrary code from the internet. Agent security must learn not to trust arbitrary instructions embedded in the information an agent reads.

Identity Is the New Perimeter

As networks became cloud-based, security architecture gradually moved away from the idea that everything inside a corporate network should be trusted. Zero Trust replaced location with identity, device posture and policy.

AI agents push the same transition further. An agent needs an identity.

It needs permissions.

It may act on behalf of a human.

It may delegate to another agent.

It may use service credentials.

It may operate for hours while the user is absent. NIST’s current work on software-agent identity and authorization focuses on precisely this problem: how to identify software agents, constrain what they can access and ensure delegated authority remains understandable.

The cybersecurity implications are enormous. A compromised endpoint can be rebuilt.

A stolen administrator credential can compromise an entire enterprise. An overprivileged agent combines both problems:

it is software with identity.

This is why Article 003’s principle becomes essential here: authorize before the tool call. The probabilistic model deciding what it would like to do should not be the only mechanism deciding whether it is allowed to do it.

Critical Infrastructure and the Patch Gap

The AI cyber race is especially dangerous for systems that cannot change quickly. A cloud company may deploy a security patch globally within hours.

A water treatment plant cannot necessarily do that. A hospital cannot casually reboot clinical systems during an emergency.

An electrical utility may operate industrial equipment designed decades ago. Manufacturing lines can contain specialized controllers whose vendors no longer exist.

These systems often require maintenance windows, safety certification or physical access. Five Eyes agencies explicitly warn that legacy and operational systems become greater liabilities as AI shortens exploitation timelines.

This creates a dangerous mismatch:

The answer cannot simply be “patch faster.” Some systems cannot. They need compensating controls:

segmentation;

strong identity;

restricted remote access;

application allowlisting;

network monitoring;

asset inventory;

rapid isolation;

backup and recovery;

replacement planning for unsupported systems. AI therefore increases the value of old-fashioned cybersecurity fundamentals.

The Offense-Defense Race

Will AI favor attackers or defenders? There is no stable answer yet.

Attackers benefit from asymmetry.

They can probe many systems and need one opening. AI lowers the cost of reconnaissance and iteration.

It can help less-skilled actors perform tasks that once required specialists. It can scale social engineering across languages and targets.

Defenders possess different advantages. They control the environment.

They can deploy telemetry everywhere. They can train on enormous volumes of legitimate and malicious behavior.

They can patch common software globally. They can automate containment.

And unlike attackers, they can place AI inside the systems being defended. Microsoft’s Project Perception captures this emerging philosophy: security systems should continuously perceive, reason and act rather than wait for human teams to assemble the incident after the fact.

The decisive variable may be architecture rather than model intelligence. An average model connected to excellent telemetry, identity controls and safe automated actions may defend better than a more capable model operating with poor visibility.

Likewise, a powerful offensive model cannot exploit a service that is not exposed, an identity protected by strong authentication or a network designed to contain compromise. This is why Five Eyes agencies continue emphasizing basic security even while warning about frontier AI.

Continuous Cyber Defense

Traditional security programs are episodic. Scan quarterly.

Pen-test annually.

Patch monthly.

Review accounts periodically.

Investigate when an alert appears.

AI makes a continuous model possible. Continuously inspect code.

Continuously compare configurations. Continuously test identities.

Continuously look for vulnerable paths. Continuously monitor agents.

Continuously simulate likely attacker movement. Continuously update defenses.

NIST research on deployed AI systems reinforces the importance of post-deployment monitoring because AI behavior can vary in real-world environments. Separate NIST work argues that robust AI security cannot be treated as a one-time certification problem; continuous monitoring and updating are inherent requirements. This leads to a new operating model:

The goal is not autonomous cybersecurity for its own sake. The goal is to move human judgment to the places where it has the highest value.

The SURVXCOM Autonomous Cyber Defense Test

An organization considering AI-driven defensive automation should not begin by asking how intelligent the agent is. It should ask how safely authority is structured around it.

What to Watch Next

When Both Sides Get Faster

Cybersecurity has spent decades adding automation. Firewalls automatically block traffic.

Antivirus automatically quarantines files. Spam filters automatically reject messages.

Cloud systems automatically revoke suspicious sessions. AI is different because the automation is beginning to reason across context.

The system can ask what happened.

What else is related?

Which identity is compromised?

Which path is the attacker likely to take next? Which action would contain the incident?

And increasingly:

Should I take that action now?

Attackers gain the same iterative ability. They can adapt.

They can test.

They can search.

They can translate.

They can automate repetitive tradecraft. The result will not necessarily be Hollywood cyberwar in which two artificial intelligences duel across the internet.

It will be quieter.

Thousands of narrow agents operating inside security products, developer environments, cloud systems and attacker workflows. Some will discover vulnerabilities.

Some will patch them.

Some will hunt credentials.

Some will revoke them.

Some will generate alerts.

Others will decide the alert is important enough to isolate a machine before the analyst arrives. This is why cybersecurity may become one of the first professions to confront AI autonomy not as a philosophical possibility but as an operating requirement.

If humans insist on approving every low-level action, attackers may outrun them. If humans surrender too much authority, defensive systems may create new failure modes at enormous scale.

The answer is architecture.

Least privilege.

Strong identity.

Evidence provenance.

Reversible actions.

Rate limits.

Runtime policy.

Human escalation.

Continuous monitoring.

The objective is not to make the AI trustworthy enough to receive unlimited power. It is to design the system so unlimited power is never necessary.