AI in cybersecurity shifts the balance as attacks happen in seconds while defenses lag behind

AI-Powered Cyber Attacks Accelerate to Machine Speed

The cybersecurity battlefield has transformed dramatically as AI in cybersecurity reshapes both offensive and defensive capabilities. Attackers now leverage large language models to execute cyber attacks at speeds that leave traditional defenses scrambling. According to Mandiant's 2025 enterprise security survey, the time for attackers to hand off compromised systems between groups has plummeted from over eight hours in 2022 to just 22 seconds in 2025, thanks to automation 1

1

. This machine-speed attack capability represents a fundamental shift in cyberwarfare, where humans remain at the center of each battle but increasingly serve as the weakest link.

The acceleration extends beyond initial compromise. A February 2026 AWS Threat Intelligence postmortem documented a FortiGate campaign where a single low-skill operator used AI to hit 2,516 devices across 106 countries in parallel, taking just minutes per target with no hands-on keyboard required 4

4

. In one documented scenario, an AI script achieved complete compromise in just 73 seconds: exploiting a CVE by second five, bypassing MFA by second twenty, dropping a web shell at thirty, and dumping credentials by forty-five 4

4

.

The Death of Traditional Vulnerability Disclosure Policy

The industry-standard 90-day vulnerability disclosure policy is effectively dead, according to security researcher Himanshu Anand 2

2

. AI-assisted bug hunting has enabled attackers to weaponize patches with alarming speed—Anand demonstrated creating an exploit for a published React framework vulnerability in just 30 minutes using LLM tools 2

2

. The median time from CVE publication to working exploit has collapsed from months a decade ago to roughly 10 hours today 4

4

.

Recent Linux kernel exploits Copy Fail and Dirty Frag illustrate this crisis. Both were made public just over a week after disclosure to kernel teams, far before the usual 90-day period, with the general assumption being that exploits were already in the wild 2

2

. Triage engineer @d0rsky noted that once a new vulnerability is found, he immediately sees "a wave of duplicate reports within days" as LLM-assisted hunters converge on the same bugs almost simultaneously 2

2

.

Major Vendors Deploy Frontier AI Models for Vulnerability Management

Major technology companies are racing to deploy frontier AI models to scan their codebases before attackers do. Anthropic's Mythos, released to twelve partners under gated preview in April 2026, wrote 181 working Firefox exploits in its first 14 days—compared to just two from the previous state-of-the-art model 4

4

. The model surfaced thousands of zero-days across every major operating system and browser, including a 27-year-old bug in OpenBSD 4

4

.

Palo Alto Networks, testing Mythos alongside Claude Opus 4.7 and OpenAI's GPT-5.5-Cyber, scanned over 130 products and found 75 security issues covered in 26 CVEs—up from their usual five vulnerabilities per month 3

3

. Microsoft used its new multi-model agentic scanning harness (MDASH) to find 17 vulnerabilities across its products on a record-setting Patch Tuesday that disclosed 30 critical CVEs 3

3

. Mozilla fixed 423 Firefox bugs in April, more than five times higher than the 76 fixes in March and almost 20 times higher than its 21.5 monthly average last year 3

3

.

Traditional Application Security Struggles with Growing Backlogs

While AI discovers software vulnerabilities at unprecedented rates, traditional application security practices struggle to keep pace. Network issues take an average of 54 days to fix, while web apps require almost 75 days, according to security platform provider Edgescan 5

5

. At large companies, 45% of vulnerabilities remain unfixed after a full year 5

5

.

The find-and-fix cycle that defines traditional application security is breaking under the weight of AI-generated discovery. Luta CEO Katie Moussouris warned that "finding bugs has always been the cheap end of the pipeline. Triage, disclosure, building patches that do not break production, and getting customers to deploy them is the expensive end, and nobody has funded it for this volume" 3

3

. The patching treadmill creates security backlogs that overwhelm development teams, who must constantly switch context from innovation to remediation 5

5

.

Ransomware Attacks Target Recovery Infrastructure

Ransomware attacks have evolved beyond simple encryption to actively destroy recovery capabilities. Attackers now delete backup objects from cloud storage and target virtualization storage layers directly, encrypting hypervisor datastores to render all associated virtual machines inoperable simultaneously 1

1

. This "deliberate recovery denial" strategy makes ransomware attacks significantly more devastating, as organizations lose both their data and their ability to restore it.

Mandiant identified more than 16 industry verticals being targeted, with the high-tech sector at 17% and financial sector at 14.6% leading the list 1

1

. Nearly one-third of detected intrusions come from exploits, while the second most common vector is "highly interactive, voice-based social engineering" targeting IT help desks to bypass multifactor authentication and gain initial access to software-as-a-service environments 1

1

.

The Case for Continuous Validation of Security Controls

Defenders face a critical timing gap that AI exploitation makes painfully obvious. When a SIEM alert fires at one minute after compromise, the attacker is already done. A Tier 1 analyst picks it up around minute five, a SOAR playbook triggers at minute fifteen, and a patch goes out 24 hours after a breach that took 73 seconds 4

4

. The time doesn't die inside any one tool—it dies between tools, in Slack messages, copy-pasted hashes, PDF reports, and approval tickets 4

4

.

Security experts now urge continuous validation of security controls rather than periodic testing. Palo Alto Networks expects "a narrow three-to-five-month window for organizations to outpace the adversary before AI-driven exploits start to become the new norm" 3

3

. Anand advises developers to treat "every critical security issue as P0 and fix it immediately," as they should assume any vulnerability is already under active exploitation 2

2

. Organizations are improving internal visibility, with 52% detecting malicious activity internally in 2025, up from 43% in 2024 1

1

, but the fundamental challenge remains: offense now runs at machine speed while defense still operates at human speed.