Key Points
- AI agents are issuing up to 1,500 commands per hour, outpacing human hackers.
- Traditional security metrics such as 'breakout time' are no longer effective in measuring security performance.
- Security teams need to rethink their strategies and metrics to keep up with the speed and volume of AI-powered attacks.
The Rise of AI-Powered Attacks
Twenty-nine seconds after firewalls or access controls blocked its first attempt, an AI agent inside an Argentine healthcare organization's network switched tactics, targeting the domain controller through SQL, according to security provider CrowdStrike.
The attacker behind it compromised at least 15 Argentine healthcare organizations and took credentials and medical records from at least one, CrowdStrike said.
Human attackers at keyboards issue dozens of commands an hour, and AI agents issue about 1,500 an hour, according to Adam Meyers, CrowdStrike's senior vice president of counter adversary operations.
At a Glance
| CrowdStrike | security provider company mentioned in the article |
| AI agents | up to 1,500 commands per hour speed of AI-powered attacks |
| Breakout time | no longer effective traditional security metric |
| Mean time to detect | 19 minutes time it took for DIVD to detect the attack |
| Mean time to respond | 19 hours time it took for DIVD to contain the attack |
Where the Sides Stand
CrowdStrike
Position: moving away from 'breakout time' metric
Role in the story: security provider
Motivation: stated in the source
Palo Alto Networks
Position: seeing the same compression in attack speeds
Role in the story: security provider
Motivation: stated in the source
Rethinking Security Metrics and Strategies
The Speed of AI-Powered Attacks
The speed of AI-powered attacks is forcing security teams to rethink their strategies and metrics. With AI agents issuing up to 1,500 commands per hour, traditional metrics such as 'breakout time' are no longer effective in measuring security performance.
Rethinking Security Metrics
Security teams need to rethink their metrics to keep up with the speed and volume of AI-powered attacks. The 1-10-60 rule, which measures the time it takes to detect, investigate, and remediate an attack, is no longer effective.
What Security Teams Can Do
Security teams can track how long it takes to detect an intrusion, decide how to respond, and contain it. They can also track how quickly they can revoke an agent's access if it misbehaves, and how long it takes to close an exploitable vulnerability.
What Security Teams Can Do to Keep Up
What Security Teams Can Do to Keep Up
Show how this work connects vulnerability management to business risk. Answer the question: 'If this single internet-facing application is compromised, what is the potential impact on our business?'
Track the amount of time it takes to identify all exposed scripts, limit their attack surface, apply the patch, and verify that the patch was applied.
Measure how quickly you can revoke an agent's access if it misbehaves, and how long it takes to close an exploitable vulnerability.
Risk & Opportunity Assessment
| Commercial Risk | High | AI-powered attacks are becoming increasingly common and are outpacing human hackers. |
| Competitive Risk | Medium | Security teams are struggling to keep up with the speed and volume of AI-powered attacks. |
| Regulatory Risk | Low | There is currently no clear regulatory framework for AI-powered attacks. |
| Reputation Risk | High | AI-powered attacks can have a significant impact on a company's reputation if they are not handled properly. |
| Technology Disruption | High | AI-powered attacks are forcing security teams to rethink their strategies and metrics. |
| Commercial Opportunity | Medium | Companies that can develop effective strategies to deal with AI-powered attacks may have a competitive advantage in the market. |
Comments 0