The race to build more powerful artificial intelligence has inadvertently sparked a parallel arms race in cybersecurity. As AI technology falls into the hands of cyber attackers, the threat landscape is changing in a terrifying way—not necessarily by inventing completely new ways to hack, but by executing traditional attacks at a speed humans simply cannot match.

According to cybersecurity experts at Microsoft and CrowdStrike, the era where human defenders can manually fight off network breaches is officially over.

The Shrinking “Breakout Time”

In cybersecurity, “breakout time” refers to the window between when an adversary first penetrates a network and when they accomplish their primary goal—be it stealing data, installing ransomware, or compromising a system.

Historically, this window was measured in months. Then, it shrank to days. Today, it is measured in seconds.

“The fastest we saw last year was 27 seconds,” explains Bartley Richardson, Chief AI and Autonomous Systems Officer at CrowdStrike. “I would love to find a human that can respond in 27 seconds… we cannot respond at human speed anymore.”

The Attacker’s Advantage

Right now, the scales are heavily tipped in favor of the attackers, largely due to two factors: the sheer volume of vulnerabilities and the asymmetry of the battlefield.

• The Vulnerability Avalanche: According to Microsoft’s latest digital defense report, nearly 40,000 vulnerabilities were disclosed in the first half of the year alone. Worse, a newly discovered vulnerability can be weaponized by hackers in less than a day, while it often takes defenders 30 to 60 days to deploy critical security patches.
• The Asymmetry of Success: “If I’m an adversary, I have to be right once,” Richardson notes. “If I’m a defender, I have to be right 100% of the time.”

Furthermore, AI is lowering the barrier to entry. Research from Anthropic suggests that AI is moving deeper into the attack chain, allowing less skilled hackers to execute sophisticated breaches that once required elite expertise. CrowdStrike has already found evidence of hackers using Chinese-developed AI tools alongside Large Language Models (LLMs) to accelerate their breaches.

Why AI Isn’t Inventing “Novel” Attacks (Yet)

Despite the hype around AI, hackers aren’t necessarily using it to invent wildly unprecedented “novel” attacks. The reason is simple pragmatism.

AI models are trained on the sum total of human knowledge, making them incredibly proficient at executing general-purpose cybersecurity tactics. At the end of the day, an adversary’s goal remains the same: extract money, steal data, or cause havoc. There are fast, easy paths to do this using AI to automate traditional e-crime. As Richardson points out: “Why do something extremely hard when something easy and fast will do?”

The Solution: Moving Humans “On” the Loop

If humans can’t respond in 27 seconds, how do we defend our systems? The answer lies in using AI to fight AI.

For years, the cybersecurity industry has faced a severe human staffing shortage. To cope with the escalating speed of AI attacks, the industry must stop relying on humans as the primary responders to network alerts.

Instead of keeping humans “in the loop”—where they act as a chokepoint that slows down response times—defenders need to move humans “on the loop.”

In this model, human workers act as managers overseeing tens of thousands of “agentic” AI workers. These local AI models live at the network endpoints, actively reasoning through threats and blocking them in near real-time. The human is no longer the blocker; they are the coordinator.

Setting Guardrails for the Golden Retrievers

While AI agents are necessary for fast defense, humans must still hold the keys to critical decisions. Richardson likens AI agents to the “best golden retriever you’re ever going to have.” They are heavily reward-driven and focused purely on accomplishing the task you set for them—they have no intrinsic malice.

However, just as you wouldn’t let an intern hold the kill-switch for a power grid, AI should not have unchecked authority over high-stakes infrastructure. Any automated action that could disrupt a financial institution’s billing, shut down a power grid, or compromise healthcare privacy still requires human verification and fail-safes.

As we navigate this new era, Richardson offers two pieces of foundational advice for organizations:

1. Don’t wait: You cannot be afraid to adopt AI defensive tools. The speed of attacks makes it a necessity.
2. Architect for safety: Practice basic computer science hygiene. For instance, an AI agent’s “system prompt” (its core reason for existing) should be architecturally separated from its memory, ensuring the agent can never accidentally—or maliciously—rewrite its core directives.

The 27-second cyberattack is a wake-up call. To survive the AI era, our defenses must move at the speed of machines, guided by the wisdom of humans.