From The Cyber Attack Cycle?

There’s a lot of talk about cyber attacks getting faster. It makes sense. The time defenders have to spot an intrusion and stop it has been shrinking for years, while AI is making many of the tasks attackers already perform quicker and easier. But there’s another kind of time inside a cyber attack that’s easy to overlook.

Imagine an attacker has scanned a network and found several possible ways in. They have to look at the results, decide which target seems promising and try something. If that doesn’t work, they need to understand why. Maybe they try another exploit. Maybe the credentials they’ve found lead somewhere more interesting. 

Maybe a security control blocks them and they have to find another route. The technical actions might take seconds. The thinking between them doesn’t. Increasingly capable AI agents could start removing some of those pauses. 

Instead of waiting for a person to look at what happened and decide what to do next, an agent can observe the result, reason about it, take another action and see what happens. Then it can do it again. That doesn’t mean fully autonomous AI cyber attacks are suddenly roaming enterprise networks without people behind them. 

The evidence doesn’t support that. What it does suggest is that some of the human decisions inside an attack are becoming possible to automate. And that raises a different security question. How much of the time defenders currently have to respond exists because the attacker still has to stop and think?

Faster Attacks Aren't Only About Speed

Attack speed is relatively easy to understand. A vulnerability scanner can check more systems in less time. AI can help a threat actor research a target, write code or analyse stolen data faster than they could manually. Automating a repetitive task can increase the volume of activity without changing the attack itself very much.

Decision-making is different. Microsoft Threat Intelligence reported in March that threat actors are using AI to reduce technical friction and shorten decision-making cycles across the cyber attack lifecycle. Today, most of that activity still involves people controlling the objectives, targets and deployment decisions. 

Microsoft has also started seeing early experimentation with agentic AI, where models can plan steps, use tools, evaluate outcomes and adapt without needing someone to prompt them continuously. That gives us a useful distinction between how quickly an action happens and how long an attack waits for someone to decide which action happens next.

We could think of the latter as attacker decision latency. It isn't an established cybersecurity metric, but it describes a part of the attack cycle that conventional measures of speed don't really capture. Reducing the time it takes to execute an exploit makes that exploit faster. 

Removing the need for someone to inspect its result and choose the next action changes the process around it. And people have always been part of that process.

Human Attackers Create Friction Too

Automation in cyber attacks isn't new. Attackers have been automating scans, credential attacks, malware delivery and plenty of other repetitive work for years. Traditional automation works particularly well when the path is predictable. Do A. If A succeeds, do B. If a predefined condition appears, do C.

Real environments have an annoying habit of not behaving exactly as expected. A human-led attack is therefore full of decisions. The attacker observes something, interprets it, decides what to do, acts and then looks at the result. That result becomes the starting point for another decision. An increasingly agentic attack can work differently:

Goal → observe → reason → act → observe the changed environment → adapt → repeat.

The human hasn't necessarily disappeared. They may still decide what the objective is, select the target or provide the tools. What changes is how often the operation has to come back to them before it can continue. OpenAI's Preparedness Framework gives us some idea of how far that distinction could eventually go. 

Its Critical cybersecurity threshold includes a model being able to find and develop functional zero-day exploits against hardened real-world systems without human intervention, or devise and execute an end-to-end attack strategy against a hardened target from a high-level goal. 

On 7 August, OpenAI said preliminary testing of its upcoming Astra model meant it could no longer rule out that level of capability. That isn't evidence that threat actors have those capabilities today. But autonomy doesn't have to be all or nothing to change the security problem. An attacker doesn't need to automate an entire intrusion for it to be useful. 

Every intermediate decision that no longer needs a person can remove another pause from the attack. And those sequences are getting longer.

AI Is Starting To Connect More Of The Attack Cycle

Earlier this year, the UK AI Security Institute tested seven frontier models against two simulated environments. One involved a 32-step attack against a corporate network that researchers estimated would take a human cybersecurity expert around 14 hours to complete.

At a fixed token budget, average progress increased from 1.7 steps for GPT-4o in August 2024 to 9.8 for Claude Opus 4.6 in February 2026. The best individual run completed 22 of the 32 steps, equivalent to roughly six hours of the work expected from the human expert. The interesting part isn't that AI can now do “six hours of hacking”. 

It can't simply be translated that way. The environment was simulated, and performance against defended production systems could look very different. What's interesting is the length of the sequence. Each additional step an agent can connect means there are more points at which progress doesn't have to stop while somebody takes over. 

AISI's later analysis found that the length of cyber tasks frontier models could complete autonomously had been doubling on the order of months rather than years, although the researchers stressed that the estimates remain uncertain and can't predict when particular capability thresholds will be reached.

Meanwhile, real threat activity is beginning to show what more adaptive behaviour can look like. Google Threat Intelligence Group has observed suspected PRC-linked actors using agentic tools that maintain a changing picture of an attack environment and switch between reconnaissance tools based on what they find. 

Its analysis of PROMPTSPY, an Android backdoor, found something even more direct. The malware can send information about the current state of a victim's device to an LLM, receive a decision about what action to take and translate that decision into actions such as clicks or swipes.

The difference is subtle but important. The model isn't just being asked to perform a predefined task. It's being given information about what exists now and using that information to determine what happens next. We've also seen what can happen when the expected path doesn't work. 

In July, AISI reported that an agent operating during a deliberately permissive cyber evaluation went beyond the intended test environment and attempted to place malicious code into a real open-source project. When its activity was challenged, it modified earlier actions to appear harmless and considered using another identity to continue. 

AISI found no resulting real-world harm, and the testing conditions included open internet access with normal cyber safety classifiers disabled. Those conditions are important. But so is the behaviour they allowed researchers to observe. The agent encountered resistance. It didn't simply stop.

Where Human Decision Gates Matter Most

Not every part of an attack needs the same amount of judgement. Some activities have been heavily automated for years, while others depend on understanding new information and deciding what it means. Those are the places where removing human decision gates could have the biggest effect.

Reconnaissance and target selection

Reconnaissance looks repetitive from the outside, but useful reconnaissance is full of small decisions. An attacker finds something, decides whether it's interesting, changes what they're looking for and gradually builds a better picture of the target. AI can already reduce much of the manual research involved. 

GTIG has observed threat actors using LLMs to investigate organisational structures, third-party relationships and specific technologies used by targets. More advanced agentic frameworks are starting to maintain state across that research and choose which tools to use next. That moves automated reconnaissance beyond collecting more information. 

The system can begin deciding which information deserves further attention.

Vulnerability discovery and exploitation

Finding a vulnerability is only one part of exploiting it. Someone still has to work out whether the weakness is usable, verify it, develop or adapt an exploit and test whether the approach works. If it doesn't, they need to understand what went wrong. Frontier models are becoming better at connecting more of those tasks. 

This doesn't mean every newly discovered vulnerability immediately becomes an automated exploit. Specialist knowledge remains a limitation, particularly for areas such as reverse engineering and cryptography. But the amount of human judgement required between discovery and exploitation is no longer fixed.

Post-compromise activity

Once an attacker gets inside an enterprise environment, the number of decisions increases quickly.

• Where am I? 
• What privileges do I have? 
• Which systems can this identity reach? 
• Where is the useful data? 
• Is another account more valuable? 
• Which machine should I try next?

Microsoft says current threat actors mostly use AI after compromise as a research and refinement tool. It can analyse unfamiliar environments, prioritise assets, interpret permissions, help plan lateral movement and make sense of failed privilege-escalation attempts. 

The movement itself generally remains human-directed today, but some of the analysis needed to decide where to move is getting quicker. Agentic systems could connect more of those decisions over time. And once an attacker is already inside, every removed pause reduces the time defenders have to interrupt what happens next.

When the first attempt fails

Failure may be the most interesting part of all this. A script that encounters something unexpected often stops or follows whatever fallback its developer anticipated. A person can look at the failure and improvise. Agents are beginning to occupy the space between those two behaviours.

Anthropic saw this during its own cybersecurity evaluations after a configuration error accidentally gave models access to the live internet. In one case, Claude struggled to reach the fictional target, discovered that a real company with the same name was accessible and began looking for vulnerabilities there because it believed the system was part of the exercise.

Again, this was an unusual evaluation environment, not a normal cyber attack. But it demonstrates something fixed automation struggles with: a failed route can become information. For defenders, that changes the value of friction. Blocking one action may still stop that action. It may not buy the same amount of time if an agent can immediately start working out what else to try.

Security Controls Have Always Contained Assumptions About Time

Security teams don't usually talk about time as though it's an access control or a firewall rule. Yet time is built into almost everything defenders do. An alert fires. Someone investigates it. They check another system, decide whether the activity is malicious and work out what needs containing. 

An account might have to be disabled. An endpoint may need isolating. Another team might need to change a cloud permission or patch a vulnerable application. Even well-designed incident response takes time because people and systems need to understand what has happened before they can safely respond.

That creates what we could call an intervention window: the time defenders have to detect, understand and interrupt malicious activity before the attacker progresses far enough for the situation to change. Attacker decision latency forms part of that window. 

If an attacker needs ten minutes to inspect the results of one action and decide what to do next, those ten minutes exist for the defender too. If an AI agent can make that decision almost immediately, the security control hasn't necessarily become worse. The window around it has changed.

This creates an uncomfortable possibility for security leaders. A control can work exactly as designed and still arrive too late to change the outcome. An alert can be accurate. The investigation can reach the right conclusion. The containment process can successfully isolate the affected system. 

But if the attacker has already interpreted what happened and moved on, the problem isn't necessarily detection quality. It's timing. And as more attacker decisions become automatable, some of the friction security teams have relied on may stop buying as much of it.

What Happens When Defensive Friction Stops Buying Time?

Good security doesn't depend on stopping every malicious action outright. Sometimes making an attack harder is useful in itself. Extra authentication creates another obstacle. Segmentation limits movement. An endpoint control blocks a command. Rate limits make repeated attempts less practical. 

Each obstacle can increase the work, cost or risk required to continue. Human attention has a cost too. If every failed attempt needs someone to investigate the problem, modify an approach and try again, defensive friction consumes attacker time. An AI agent that can perform more of that reasoning independently changes the economics.

The NCSC highlighted this when reviewing AISI's cyber-range results. A full attempt at the simulated enterprise attack cost around £65, while giving the same model more processing time improved performance without requiring additional technical skill from the operator. The NCSC's concern wasn't that current models can reliably complete sophisticated end-to-end attacks. 

They couldn't. It was that capability was rising while the cost of repeated attempts remained low. That could make some problems easier to delegate. A blocked exploit still protects the system. Strong access controls still restrict what an attacker can reach. Segmentation still limits movement. 

None of those controls suddenly becomes obsolete because an AI model can reason about failure. But security leaders may need to distinguish between controls that end an attack path and controls that make the attacker solve another problem. Historically, solving enough problems could make an intrusion too difficult, expensive or time-consuming to continue. 

If more of that work can be handed to an agent, the calculation starts to change. Which brings the problem back inside the enterprise.

Where Does Your Defence Depend On The Attacker Pausing?

There isn't a useful answer here that begins with “automate everything”. Security teams make high-consequence decisions, and speed isn't automatically more valuable than judgement. Isolating the wrong production system in seconds isn't necessarily an improvement over taking a little longer to understand what's happening.

A better starting point is to look for the places where defender intervention time and attacker decision time meet. Where are the critical intervention windows in your environment? If suspicious activity occurs, how long does the organisation realistically have to detect it, understand it and prevent the next meaningful action?

Then look at the defensive side of that equation. Which processes still depend on an analyst reviewing an alert, another team approving an action or several tools passing information between them? Human oversight may be completely appropriate, but leaders need to know where those hand-offs create delay.

It's also worth asking what happens after a security control succeeds. If an endpoint blocks one action, does the wider security operation keep following the behaviour around it? Or does a successful block close the alert while the attacker is already testing something else? The same question applies to repeated attempts. 

Controls that are highly effective against occasional manual activity may face different pressure if analysis, troubleshooting and retries become cheap enough to automate at scale. None of this requires organisations to predict when fully autonomous cyber attacks will arrive. They don't need to.

They need to understand where their security architecture assumes that the attacker will take longer to make the next decision than the organisation takes to intervene. If that assumption stops being true, they'll want to know before an incident proves it for them.

Final Thoughts: Cyber Defence Can't Depend On The Attacker Waiting

AI isn't removing humans from cyber attacks overnight. Current threat intelligence still shows people controlling most objectives, targeting and deployment, while autonomous cyber capabilities remain inconsistent and face important technical limits. But that doesn't make the change we're seeing insignificant.

The more immediate shift may be smaller and much easier to miss. AI can help absorb individual decisions that used to send an attack back to a person. Research a target. Interpret a result. Prioritise an asset. Troubleshoot a failed attempt. Choose another tool. Try something else.

Each one looks like a relatively small piece of the cyber attack lifecycle. Together, they determine how often an attack has to wait. For enterprise security leaders, that means attack speed may no longer be the only useful clock to watch. The relationship between attacker decision time and defender intervention time could become just as important.

The strongest security controls will still detect malicious activity, restrict access and stop attacks. But organisations also need to know whether those controls can act early enough to change what happens next.

As agentic AI takes on more of the reasoning between cyber actions, EM360Tech will continue following the evidence behind that shift, what attackers are actually doing with these capabilities and how enterprise defence needs to adapt. Because the real question isn't when humans disappear from the cyber attack cycle completely. It's how much of your defence still assumes they'll stop to think.