AI Is Compressing the Cybersecurity Clock
A security team discovers suspicious activity on Friday afternoon. Someone has to assemble the logs, identify the affected accounts, decide what to disable and check whether the attacker is still inside. An attacker has a similar queue: investigate a target, adapt a tool, interpret the result and try again. AI is beginning to compress both queues. The useful question is how much time each side gains, and whether the other side can keep up.
Recent primary-source reports make this more concrete than a debate about hypothetical superhuman hackers. They describe AI being used within real operations, alongside persistent dependence on human decisions and familiar access weaknesses.
What has actually been observed
Anthropic's September 2026 threat intelligence report describes activity disrupted between December 2025 and August 2026. In one operation attributed to a suspected Russian state-linked actor, AI supported phishing, infrastructure work, data extraction and rebuilding malware after detection. Humans still selected targets and reviewed extracted material. The report presents selected notable cases, rather than a representative measurement of all malicious use.
That is evidence of an accelerated workflow. It does not establish that every attacker has acquired the same capability, or that an agent can reliably run an entire intrusion without supervision. Those distinctions matter when deciding what to buy or change.
An earlier Anthropic investigation published in November 2025 reported attempts against roughly 30 targets, with a small number of successful intrusions. The company estimated that AI performed 80–90% of the campaign's work. It also described errors, including invented credentials and mistaken claims about extracted data. Attempted targets should not be counted as confirmed victims, and a vendor's automation estimate should not be treated as a universal benchmark.
The advantage comes from iteration
Consider an illustrative workflow with ten investigative steps. If each step previously took an hour, reducing it to ten minutes changes the rhythm of the operation even if the underlying technique stays familiar. More attempts fit inside the same working day. A failed attempt becomes cheaper to diagnose. A defender who reviews alerts once a day can lose ground without any spectacular new exploit appearing.
This is why a demonstration of an AI finding a vulnerability is only part of the story. The operational question is what happens afterward: can the organization identify which deployed systems are affected, apply the correction and confirm that exposure has ended? Discovery and remediation run on different clocks.
Defenders can compress their queue too
The Microsoft Digital Defense Report 2026 describes both AI-enabled attacks and AI systems becoming targets themselves. It also reports that organizations using Security Copilot summarize threats 60–70% faster. That is a vendor-reported workflow result, not independent evidence that those organizations suffer proportionally fewer breaches. The report continues to emphasize identity and credential abuse as central security problems.
.jpg){kind=link}
A useful defensive assistant would assemble evidence for an analyst, identify missing information and make its conclusions traceable to the underlying events. A fast, confident summary that conceals uncertainty can create a new delay: someone must later unwind the wrong conclusion. Reviewability belongs in the productivity calculation.
What a small engineering team should measure
My practical recommendation is to start with three intervals: exposure to detection, detection to containment, and containment to verified recovery. Pick one repeated bottleneck within those intervals and measure an assistant against it. For example, test whether it can turn a set of authentication events into an accurate timeline that a developer can check quickly. Record corrections and false alarms alongside time saved.
Keep destructive actions and broad access changes behind explicit controls. An assistant that reads a suspicious message should not inherit permission to obey it. Treat external text as evidence to inspect, and enforce authority in the surrounding system.
The emerging advantage is the ability to turn reliable observations into timely action. AI can help with that, but the meaningful result is a shorter, verified response cycle. A faster answer alone is an incomplete security outcome.
Sources: Anthropic, September 2026 threat intelligence report; Anthropic, November 2025 cyber espionage investigation; Microsoft Digital Defense Report 2026. Reporting checked October 12, 2026. The workflow examples and recommendations are the author's analysis.