Attacks at machine speed: why human-paced triage can’t keep up

The clock has changed

Breakout time is the window between an attacker’s first foothold and their first move to another system. It matters because it is the defender’s best chance: stop an intrusion before it spreads, and it stays a contained incident rather than a company-wide breach.

That window has collapsed. CrowdStrike reports that the average eCrime breakout time fell to 29 minutes in 2025, with the fastest breakout it observed taking 27 seconds. In one intrusion, data exfiltration began within four minutes of initial access ^[1]. The same report notes an 89% year-over-year increase in operations by AI-enabled adversaries ^[1]. Automation and AI tooling let one operator run many intrusions in parallel, script the reconnaissance, and move as soon as a door opens.

Exploitation follows disclosure faster every year

The second clock is the one that starts when a vulnerability becomes known. Mandiant tracks the average time to exploit: it was 63 days in 2018-2019, 44 days in 2020 to early 2021, 32 days across 2021-2022 and just five days in 2023 ^[2]. Many of the vulnerabilities exploited are zero-days, abused before a patch exists at all.

Breach data points the same way. Verizon reports that exploitation of vulnerabilities as an initial access step grew by 34% and now accounts for 20% of breaches ^[3]. Mandiant’s M-Trends 2025 lists exploits as the most common initial infection vector for yet another year, at 33% ^[4]. Patch cycles measured in weeks, and change windows measured in months, are now longer than the attacker’s timeline.

More people do not change the shape of the problem

Each step above is reasonable. Together they take hours, and on a busy night far longer. Adding analysts shortens the queue a little but leaves every step in place, and the attacker’s cycle is now shorter than the time it takes to read the alert, gather context and agree on a decision.

There is also a mismatch of shape. Attackers work on a story: a phishing click, a credential, a new process, a connection to a server, a copy of data. SOC tooling usually delivers those pieces as separate alerts, each with its own severity, often to different people. The work of reassembling the story is exactly the work that takes the most time.

Speed also pays off in money. IBM’s 2025 study puts the average time to identify and contain a breach at 241 days, and finds that organisations using AI and automation extensively in security shortened that lifecycle by 80 days and saved an average of USD 1.9 million ^[5]. Faster is not only safer; it is cheaper.

Keeping people in charge

Machine speed does not mean removing people. It means moving them to where their judgement matters: approving actions, handling the genuinely ambiguous cases and setting policy. The routine parts of triage and investigation, which consume most of an analyst’s day, are the parts machines can now do faster and more consistently.

Trust has to be earned in steps. A sensible path is to let an autonomous system work alongside analysts first, compare its conclusions with theirs, and widen its autonomy one capability at a time as the evidence supports it. Response stays proposal-first, with a person approving each action and an audit trail of every step.

This is the approach behind ApexAI: an autonomous SOC that reads every alert, builds the story and proposes the response at machine speed, while people keep the decision. You can read more about the wider problem on our Why ApexAI page.

Questions