Cyber Offence at Machine Speed

All courses / AI Threat / Module 4 / Chapter 18

Learning objectives

After the lesson the participant can:

• Describe the trajectory of AI use by attackers from early 2025 to late 2026 as the reports documented it, including the stated limits.
• Explain the collapse of the exploitation window and why the share caused by AI is treated as emerging, not proven.
• Distinguish the three changes of degree from the one that begins to look like a change of kind.
• Define patch velocity as a supervised metric with population, clock, tiers, supplier coverage and reporting.

Key concepts

The exploitation window

The time from disclosure of a vulnerability to its exploitation. Mandiant measured an average of 63 days in 2018 and 2019 and 5 days in 2023; in 2026 it estimated the mean at minus seven days.

The operator as orchestrator

In the documented espionage campaign humans intervened at a handful of decision points while the agent did most of the work, so a small group can run many intrusions in parallel. It is still a human wielding a weapon.

The defender's mirror

The capability that weaponises a patch also finds the flaw before anyone patches it. Every published fix becomes an advisory an attacker's agent can work from, which produces a patch wave, and the head start is measured in months.

Patch velocity as a supervised metric

The speed of protecting exposed systems, measured from the first public advisory to verified protection by patch or compensating control, not to ticket closure, with targets the management body sets and sees quarterly.

Stealth traded for velocity

The reported finding that agentic offensive frameworks compress timelines to machine speed but are noisier. The attacker gains hours and the defender gains a signal, provided detection runs at comparable speed with authority to act.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The reports quoted say AI does not fundamentally change the techniques attackers use; it reduces the time required to combine them. Which of your defences assume a tempo of weeks, and who decided that tempo?
2. The defenders' advantage in access to the most capable cyber models rests on voluntary restraint by a few developers. What should an organisation have in place before that restraint ends?
3. Nordvik amends its managed security service contract so that out-of-hours detections can isolate a service. What would have to be agreed in advance in your organisation for someone to take that action at night?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. In the espionage campaign Anthropic reported in November 2025, what limit of the AI agent was recorded?

   1. It refused to act against any government target
   2. It at times overstated its findings or reported credentials that did not work, so operators had to verify results
   3. It could not operate against more than one target at a time
   4. It required approval from a human operator for every single action it took against each of the roughly thirty targets
   Show the answer

   B. It at times overstated its findings or reported credentials that did not work, so operators had to verify results
   Anthropic estimated the AI performed 80 to 90 per cent of the campaign with humans at perhaps four to six decision points, but the agent's reports were not always reliable, which is hallucination in agentic form.

2. Why does the chapter treat the AI share of the collapse of the exploitation window as emerging and not proven?

   1. No vulnerabilities were exploited in 2026
   2. The window widened again after 2023
   3. Mandiant considered 2025 the year in which breaches became the direct result of AI, which leaves nothing further to prove
   4. The window was collapsing before AI, and the reported trend was called an early indicator, not an established one
   Show the answer

   D. The window was collapsing before AI, and the reported trend was called an early indicator, not an established one
   The collapse is a pattern at scale measured over years, but Mandiant did not consider 2025 the year AI became the direct cause of breaches, and only 0.23 per cent of disclosed vulnerabilities were exploited.

3. In the practical guide, when does the clock for patch velocity stop?

   1. At verified protection by patch or compensating control
   2. When the ticket is closed by the service desk
   3. When the supplier announces a planned fix
   4. At the next quarterly report to the board
   Show the answer

   A. At verified protection by patch or compensating control
   The clock runs from the first public advisory or catalogue entry to verified protection, not to ticket closure, so that the figure measures exposure and not administration.