The Changing Economics of Cyber Defence in the Age of AI

Whether operating online or in the real world, attackers of every variety have always looked for ways to make their attacks easier, faster, and more profitable. Now artificial intelligence (AI) is giving cybercriminals exactly what they need to do just that. 

Attacks that formerly took specialist knowledge and hours of work to complete manually can now be automated and executed in minutes, making them accessible to a far larger cohort of criminals with much lower skill levels. This means attackers need less effort to test more opportunities. 

On the other side of the equation, enterprise security teams don’t have the luxury of focusing on one vulnerability at a time. Their role is to defend entire environments, keep systems running, and make sure that genuine users can keep doing their tasks. As the saying goes, attackers only have to be lucky once, defenders have to get it right all of the time. This is an imbalance that AI cyber defence could help correct.

Reach Security argues that organisations can improve their position by using AI to get more protection from the security controls they already have, rather than continually adding new technologies. The challenge is making that protection easier to maintain without introducing more problems for the teams responsible for keeping everything secure.

How AI Is Changing the Pace of Cyberattacks

The real concern for enterprise defenders isn't simply that AI makes cyberattacks easier. It's what happens when attackers can move from finding a potential weakness to exploiting it much faster than security teams can respond. Even when an organisation knows about a vulnerability, there may be a considerable gap between identifying it and putting effective protection in place.

And there's growing evidence that the time available to defenders is shrinking. Microsoft's Digital Defense Report 2026, published in October, indicated that the median time between a vulnerability being identified in the wild and being transformed into a workable attack has dropped to well below 24 hours. 

There's also evidence that attackers are employing AI to run increasingly sophisticated operations. In September 2026, Google Threat Intelligence Group detailed an event where attackers infiltrated a cloud resource and then designed, created and executed an AI agent-enabled credential-harvesting campaign in less than six hours. 

None of this means that cyberattacks are suddenly completely autonomous. Humans are still vital in complex incursions, but attackers are increasingly able to automate portions of the process that had previously limited just how quickly they could operate.

Why Defending an Enterprise Costs More Than Finding a Weakness

All an attacker needs to start an intrusion is one exploitable opening. Security teams, on the other hand, don’t have it quite that easy. They’re working in environments that are continuously changing; with multiple systems, applications, identities and data that could all be the source of that one opening on any given day and point in time.

Think about what happens when a company rolls out a new application. Someone has to decide who has access to it, what security standards apply to it, and whether the current measures are appropriate to safeguard it. Those decisions could involve several teams, each with their own security solutions. And each of those solutions comes with its own responsibilities and settings.

Now multiply that task across a whole enterprise. So having the right security technology doesn't mean the work is done. Someone still has to check how it's configured, investigate weaknesses and test any changes before they can be confident the protections are working. And all of that needs to happen without disrupting the services the business relies on.

And the difference in operating speed is becoming hard to ignore. Microsoft’s 2026 research said that it takes businesses 30 to 60 days to fix severe external vulnerabilities, while attackers can create functioning exploits in less than a day. Separate from this, Mandiant’s M-Trends 2026 report stated that vulnerability exploitation accounted for 32% of the intrusions Mandiant researched in 2025.

Can AI Make Existing Security Controls More Effective?

Most enterprises already have tools that can block suspicious activity, restrict access and prevent certain attacks. Knowing whether those tools are set up properly and whether they're actually protecting the systems that need them is a lot more difficult.

And this is where solutions like Reach can help. The right AI-powered security operations could help teams go beyond just identifying weaknesses to actually closing the gaps attackers could exploit. And they can do this with the tools they already have, rather than adding another product to the roster they need to manage.

Identify gaps that create exploitable exposure

A vulnerability scanner might flag hundreds of weaknesses, but they won't all pose the same level of risk. Some may already be covered by existing security controls, while others could give an attacker a much easier way into the organisation's systems.

Fortunately, AI-assisted security exposure management can help security teams bring together information about vulnerabilities, the controls they already have, the systems affected and the routes an attacker might use. With all of that in view, it's easier to work out which weaknesses need attention first.

For security teams with huge remediation backlogs of remediation, this could cut down the time they spend examining issues that are already covered by other protections. There's a catch, though. General-purpose AI doesn't necessarily have the specialised knowledge or context needed to assess an organisation's security controls accurately. 

That's where domain-specific AI becomes important, although it still needs reliable, up-to-date information about the protections already in place. Otherwise, teams could end up acting on recommendations that don't reflect what's actually happening in their environment.

Strengthen protection without waiting for every patch

Patching is still important, but not necessarily something that organisations can do immediately. Some upgrades need testing or a dedicated maintenance window, while others involve systems that can't simply be taken offline during normal business operations. Sometimes, the organisation already has another way to protect the vulnerable system while it waits for a security update.

That's where compensating controls come in. They can use existing security measures to make the chances of an attack less likely. For example, a team could restrict who or what can connect to a vulnerable service, or change its endpoint security settings to block a known attack technique before it causes damage.

Of course, teams still need to check that those measures actually work. Having a security rule in place doesn't help much if an attacker can still get through because the rule doesn't cover the route they're using. AI-assisted assessment could help teams work out which protections to use, while carefully managed automated remediation could help them put those protections in place without having to handle every step manually.

What Makes Autonomous Cyber Defence Worth the Investment?

It's easy to see why autonomous cyber defence appeals to security teams. If a system can spot a problem, work out how to address it and apply the fix — that's potentially hours of manual work they no longer have to do themselves. There's a risk in letting software make those changes, though.

If it makes a mistake, legitimate users could be locked out, important services could be disrupted, or some other security vulnerability could be left exposed to attackers.

Reliable decisions need more than AI recommendations

General-purpose AI tools are famous for getting things wrong, especially when they don’t have all the information they need or make a recommendation based on what seems likely rather than what's actually been confirmed. So teams first need to know that an AI is working with the right data, and have confidence in the actions it proposes.

Only then can they trust it to start actually changing any security settings. This means teams have to work with accurate control data and any changes suggested by AI still have to be tested. They also need clear rules about what AI is authorised to do autonomously and when a person needs to sign off on a change.

You might want to automate the low-risk actions, but anything that affects a critical system should always require a human sign-off. And that human needs to have the experience and knowledge needed to understand exactly what they’re signing off on. And if any change causes unexpected problems, organisations need to be able to undo it without making things worse.

Measure protection gained, not just work automated

There's promising evidence that AI-assisted security operations can provide financial benefits. Companies that have implemented AI and automation in security operations experienced an average breach cost of about $2 million less than organisations that didn’t have these capabilities, according to the IBM 2026 Cost of a Data Breach Report.

That doesn't necessarily mean AI and automation were responsible for the difference. IBM found a connection between their use and lower breach costs, but the research doesn't prove one caused the other. For organisations using security automation, it's worth asking what's actually improved since they started using it.

• Was there a reduction in the time to set up effective mitigation?
• Are there fewer exploitable holes left open?
• Are analysts spending less time on rote evaluations?
• And are automatic changes increasing protection without causing unnecessary disruption?

In other words, it's easy enough to count how many tasks have been automated. But that doesn't tell security leaders very much about the results. They still need to know whether those changes have improved protection and whether the investment has been worthwhile.

How Should Enterprises Evaluate Their Defensive Economics?

Before spending more on AI security capabilities, organisations need to understand where their time and money are already going, and whether all that effort is actually keeping them protected. One place to start is by looking at what happens after a security weakness is found. How long does it take to get it fixed? And then how long to check that the fix actually works?

There could be delays along the way, especially when different teams need to get involved or changes have to be approved by multiple parties. Those delays aren't always obvious from security reports. A good starting point for security leaders is to ask five questions:

• Where does manual security assessment consume the most time? Identify repetitious processes that could be automated without losing accuracy.
• What vulnerabilities remain exposed for exploitation despite current security investments? Look at whether present measures could offer protection that isn’t being used.
• How quickly can teams have effective mitigation in place and verified? Measure the time till the protection is operating, not just when a ticket is closed.
• What protective adjustments can be safely automated? Define where testing, human approvals and roll-back processes are needed.
• How will stronger protection be quantified? Consider exposure reduction, analyst effort, and operational disturbance combined.

The answers should give security leaders a better idea of where automation could save their teams time or improve protection, and where they'd be better off fixing the way they're already doing things. They can also help organisations assess vendors without assuming that a product is worth buying just because it can do things autonomously.

Final Thoughts: Better Cyber Defence Starts With Making Existing Protection Work

AI is making it easier for attackers to do more with less, but enterprise defenders can't afford to respond by continually adding more security products. They need to know where their existing protections are falling short, which weaknesses actually leave them exposed and how quickly they can close those gaps without disrupting the business.

AI could help them do that, but giving it more responsibility also means being able to trust the information it's working with, verify the changes it makes and step in when something goes wrong. As autonomous defence becomes more capable, security leaders will need to decide how much of that work they're comfortable handing over, and what evidence they'll need before they do.

That's where Reach Security's focus on getting more from existing controls becomes particularly relevant. Organisations interested in how AI could help them close exploitable gaps without adding more tools may find its work worth exploring, while EM360Tech's wider cybersecurity coverage offers more perspectives on the challenges of putting AI-driven defence into practice.