The world of enterprise cybersecurity is undergoing a rapid transformation, and the culprit is not your average hacker but the ever-evolving landscape of cyber threats. In the past, cybercriminals would spend weeks or even months inside a compromised network, meticulously laying the groundwork for their data theft or malware deployment. However, the times have changed, and the pace of cyber-attacks is now breathtaking.
According to the CrowdStrike Global Threat Report 2026, the average breakout time for an intrusion in 2025 was a mere 29 minutes. This is a staggering decline from the 48 minutes in 2024, the 62 minutes in 2023, and the 84 minutes in 2022. The trend is clear: cybercriminals are getting faster, and their methods are becoming more sophisticated. What's even more concerning is that this acceleration is set to continue, especially with the increasing use of AI by both defenders and attackers.
One of the most intriguing aspects of this evolving threat landscape is the shift from traditional hacking to logging in. Cybercriminals are now leveraging compromised credentials to gain access to networks, often using legitimate corporate usernames and passwords. This tactic is particularly effective for organizations heavily reliant on cloud services. Adam Meyers, head of counter adversary operations at CrowdStrike, highlights this trend, stating that criminals are increasingly using compromised identities to log in and move across SaaS and cloud applications.
The implications of this are far-reaching. Once inside, attackers can swiftly exploit the access granted by legitimate accounts to exfiltrate data. Meyers points out that these attacks are lightweight and fast to implement, reducing the time criminals need within the network to achieve their objectives. This shift in tactics has made it more challenging for defenders to detect malicious activity using traditional security tools.
Here's where the concept of context becomes crucial. Instead of solely relying on verifying user accounts, organizations must now focus on analyzing the behavior and actions of those accounts. Gabrielle Hempel, security operations strategist at Exabeam, emphasizes the importance of behavioral analytics and the use of context in defense. By understanding business context, user behavior history, and environmental knowledge, defenders can better identify and respond to suspicious activities, even within a reduced detection window.
The rise of AI has further complicated the cybersecurity landscape. Information security teams are leveraging agentic AI to bolster their defenses, but this also presents new challenges. The rapid pace of AI-driven vulnerability identification requires organizations to patch security bugs at an unprecedented speed. Malicious hackers are already exploiting this, making it a race against time for defenders.
The AI effect on attack speed is profound. Hempel explains that AI accelerates mundane tasks for both attackers and defenders. When a new zero-day vulnerability is released, the timeline for exploitation has shrunk dramatically. Defenders now have just days, rather than months, to patch and mitigate these vulnerabilities. This has created a twofold problem: the need for rapid patching strategies and the difficulty in identifying and preventing malicious behavior designed around these vulnerabilities.
In May 2026, Google Threat Intelligence Group (GTIG) warned that cybercriminals were successfully using AI to identify and exploit zero-day vulnerabilities. This further reduces the window for organizations to prevent attackers from gaining entry or detect intrusions once they've occurred. As the race for cybersecurity intensifies, speed becomes the critical factor.
Overcoming the speed of cyber-attacks requires a well-prepared response strategy. James Ellison OBE, director of national resilience at the UK National Cyber Security Centre (NCSC), emphasizes the importance of exercises in preparing for cyber incidents. Understanding your organization's response to suspected attacks is vital in minimizing potential damage. Cybersecurity fundamentals, such as asset management and threat intelligence, remain essential to building resilience against cyber threats.
In conclusion, the rapid evolution of cyber threats demands a proactive and adaptive approach to cybersecurity. As cybercriminals continue to innovate and accelerate their attacks, organizations must embrace new strategies and technologies. Behavioral analytics, the use of context, and the integration of AI into defensive efforts are all crucial components of a robust cybersecurity posture. In this ever-changing landscape, speed, agility, and a deep understanding of the threat environment are the keys to staying one step ahead of cybercriminals.
