Agentic AI is compressing attacker intrusion timelines to minutes

Artificial intelligence (AI) has transitioned from a curiosity to a crucial component in the realm of cybersecurity intrusions. Agentic adversaries, who employ AI, have infiltrated various malicious activities, including extortion campaigns, espionage operations, and hacktivism. The rapid deployment of AI tools in these operations leaves defenders with minimal time to respond.

This shift is not merely theoretical, but observable in real-world incidents. According to Adam Meyers, senior vice president of intelligence at CrowdStrike Holdings Inc., there were 26 agentic adversaries tracked in the last 30 days, a significant increase from the previous year. CrowdStrike's threat hunting research indicates that exploitation windows are shrinking as AI becomes more integrated into adversary operations.

For instance, VAULT PANDA, an agent, conducted 1,100 commands in just 58 minutes, learning in real-time as it went. The average "breakout time" for an entire intrusion operation has been reduced to around 29 minutes, with the fastest being 27 seconds. In response to these rapid intrusions, defenders are taking collective action.

CrowdStrike partnered with law enforcement on the Sality botnet disruption, an effort that spanned a decade to dismantle a network that had been active for 23 years. Meyers emphasized the need to raise the cost of doing business for cybercriminals, doing so in a responsible manner.