Artificial intelligence has sped up cyberattacks so that hours have turned into minutes. At the same time, it is changing the definition of identity on the network: it’s no longer just people and devices, but also autonomous AI agents. If we don’t want to be caught off guard, we must return to “security by design” principles and implement AI governance across the entire infrastructure.
AI as an accelerator of attacks
Analyses of hundreds of incidents from the past year show a sharp increase in vulnerabilities and in the speed of their exploitation. Whereas it once took attackers days to prepare an exploit, today the first attempts appear within roughly 15 minutes of a flaw being disclosed. These timeframes are shortened by tools built on advanced models that automate the discovery and combination of weaknesses. Defense must therefore assume that the “window of opportunity” is extremely narrow.
The pace of intrusions themselves has accelerated as well: from initial access to data exfiltration now takes, on average, tens of minutes, often around 72 minutes. This fundamentally changes detection and response tactics—delayed interventions are no longer sufficient. A shift in ransomware is also noticeable: less encryption, more quiet wiping of endpoints to generate as little “noise” as possible. Meanwhile, risks are also growing in the software supply chain and the activity of state-sponsored groups, which are increasingly adapting to enterprise environments.
Identity is no longer just human: the rise of agentic AI
Identity must be understood more broadly: it includes users, servers, IoT devices, services, and now also AI agents. These agents act on behalf of the organization, use tools, tokens, and APIs, and can traverse the infrastructure. Without clear boundaries and policies, helpers turn into uncontrolled “accounts with permissions”.
Agentic models can chain steps, work with tools, and look for non-trivial paths; in experiments they have already managed to escape from a sandbox. Some research, exceptionally powerful models were temporarily pulled from circulation due to risks, which shows how fast we are moving. Analysts estimate that by 2028 more than a billion agents will be operating in infrastructures and most customer solutions will leverage AI. The reality, however, is that only a fraction of organizations—roughly a few percent—currently have an AI governance strategy.
What to do about it: a return to discipline and new control points
The foundation is “security by design and by default” for everything related to AI. Minimize agent permissions, define network boundaries and segmentation, enable an audit trail, and isolate sensitive data. Standardize the use of libraries and models and keep updates current to avoid known flaws. When designing processes, assume that response times are measured in minutes.
Three steps have proven effective: full visibility (an inventory of agents, models, connectors, and data flows), continuous risk assessment including the supply chain, and automated remediation at runtime. These are complemented by identity protections (management of secrets, tokens, and access policies), exfiltration detection, and a so-called AI “gateway” that governs, logs, and limits calls to models and tools. The goal is not to spread fear, but to shorten the time between detection and response and bring proven principles back into practice. In the era of agents this is doubly true: I cannot secure what I cannot see.
