By Brad Medairy, president, Booz Allen’s National Cyber business
For years, we’ve talked about attackers getting faster—automating reconnaissance, scaling phishing, accelerating exploitation. But what’s happening now with AI is fundamentally different. The timeline of cyber operations isn’t just speeding up. It’s collapsing.
We’re moving from a world where attacks unfolded over hours or days to one where they happen in seconds. And that shift breaks more than tools. It breaks the operating model cybersecurity has been built on.
AI is compressing the cyber timeline
The latest generation of AI models makes this clear.
Reports around Anthropic’s Claude Mythos describe a system capable of identifying large volumes of previously unknown vulnerabilities across widely used software—some of them decades old. That’s a powerful defensive capability in the right hands.
But it also points to something bigger.
AI not only autonomously discovers vulnerabilities at scale; it can also accelerate how those vulnerabilities are exploited. Discovery, weaponization, and execution—steps that used to require time, coordination, and expertise—can now be compressed and chained together.
We’re already seeing early versions of this in the wild: AI-assisted vulnerability discovery, exploit development, and automated malware variation, which are automatically chained to adaptive attack paths that change in real time.
The takeaway is that AI completely changes the speed, scale, persistence, and economics of existing categories of risk.
And speed is the variable that matters most.
The cybersecurity model was built for a different tempo
Most cybersecurity organizations are still operating on assumptions that no longer hold.
Security operations centers rely on alert queues, human triage, and forensic investigation. Detection engineering often depends on known patterns or rules that are updated after the fact. Response workflows include manual decision points by design.
Those approaches made sense when defenders and attackers moved at roughly comparable speeds.
They don’t hold up when adversaries operate autonomously and continuously.
In Booz Allen’s latest threat research, When Cyberattacks Happen at AI Speed, we found that breakout times—the window between initial compromise and meaningful movement inside a network—have shrunk dramatically. In some cases, it’s minutes. In others, effectively seconds.
At that pace, even well-resourced teams are forced into a reactive posture.
Every handoff, every queue, every manual decision becomes friction. And in a machine-speed environment, friction is vulnerability.
This is why adding more tools, analysts, and capacity isn’t enough. The constraint is architecture.
What we’ve learned at mission scale
In national security environments, we’ve been dealing with versions of this problem for some time.
The systems we help defend are persistently targeted by sophisticated adversaries who adapt quickly and operate with increasing levels of automation. Waiting to observe, analyze, and then respond is no longer viable.
So, the model must be transformed—toward:
- Continuous sensing instead of periodic visibility
- Detection that evolves with adversary behavior, not just signatures
- Environments that are constantly being tested—through emulation and simulation—so you’re not learning about gaps for the first time during an incident.
And critically, you move toward systems that take action on detection. They flag activity, then contain it; identify risk, then reduce it;inform operators, then work alongside them.
That’s what it takes to defend in a machine-speed environment.
What’s changed is that this is no longer a niche requirement. The threat attacking commercial enterprises is converging with what was previously limited to government and critical infrastructure.
The baseline has shifted.
What a machine-speed cybersecurity model looks like
So, what does a different model look like?
At a high level, it has a few defining characteristics:
- Autonomy at the core. AI systems don’t just assist—they analyze, decide, and act within defined boundaries.
- Environmental awareness. AI maintains an accurate, current picture of assets and activity so actions reflect the environment as it truly is.
- Continuous adaptation. Detection and response evolve as the threat evolves, not on a fixed update cycle.
- Integrated lifecycle. Reconnaissance, detection, response, and validation operate as a continuous loop.
- Built-in adversary pressure. Environments are constantly tested by emulated threats so defenses are fully proven.
We’ve been applying these principles in our own work, which is what led us to develop our Vellox Agentic Cyber product suite.
Vellox reflects a shift toward agentic systems that can autonomously map environments, generate detections aligned to real adversary behavior, emulate attacks, and take action when needed as part of a continuous, adaptive system.
There are different ways to implement that vision. But the direction is consistent: cyber defense must operate at the same speed—and with the same level of autonomy—as the threats it’s designed to counter.
The window to adapt Is shrinking
AI isn’t just another capability to integrate into existing security stacks. AI is forcing a rethink of how those stacks are designed in the first place.
Organizations that continue to rely on human-paced workflows—no matter how well optimized—will find themselves increasingly outmatched. This is because the threat landscape is moving faster than even skilled teams can keep up with.
Rather than removing humans from the loop, the right response is to redesign the loop.
To build systems where humans set intent, define boundaries, and oversee outcomes—but where execution happens at machine speed—you need AI that operates as a true wingman: a trusted partner that handles autonomous action within guardrails while elevating human awareness, judgment, and control.
That requires replatforming key parts of the cybersecurity operating model around autonomy, continuous validation, and integrated AI-driven operations.
The good news is that the building blocks exist today. The question is how quickly organizations are willing to adopt them.
