The machine-speed threat era

Attacks now run at machine speed

The time an attacker needs to move from a first foothold to the rest of a network keeps shrinking. CrowdStrike reports that the average eCrime breakout time fell to 29 minutes in 2025, that the fastest breakout it observed took 27 seconds, and that in one intrusion data exfiltration began within four minutes of initial access ^[1]. The same report notes that AI-enabled adversaries increased their operations by 89% year over year ^[1].

Exploitation is accelerating too. Mandiant measured the average time between a vulnerability becoming known and its exploitation at 63 days in 2018-2019, 32 days across 2021-2022 and just five days in 2023 ^[2]. Verizon found that exploitation of vulnerabilities as an initial access step grew by 34% and now accounts for 20% of breaches ^[3], and Mandiant’s M-Trends 2025 again lists exploits as the most common initial infection vector, at 33% ^[4].

Put those numbers next to a typical security operations day. An alert lands in a queue, waits for an analyst, is opened, enriched by hand, discussed and escalated. That cycle is measured in hours on a good day. When the attacker’s cycle is measured in minutes, a human-paced queue is not a slower defence; it is a defence that arrives after the outcome is decided.

Resources are stretched

Hiring is not a way out. ISC2 estimates the global cybersecurity workforce gap at 4.8 million people, a 19% increase in a year, with the workforce itself holding at about 5.5 million; 90% of respondents report skills shortages in their organisations ^[5]. Round-the-clock coverage needs several people per seat, and the night shift is where fatigue and missed signals concentrate.

The cost of falling behind is concrete. IBM puts the global average cost of a data breach at USD 4.44 million and the average time to identify and contain one at 241 days; organisations that use AI and automation extensively in security saved an average of USD 1.9 million and shortened that lifecycle by 80 days ^[6]. Managed security providers face the same arithmetic: when every new customer means more analysts, growth is bounded by headcount and burnout.

Frontier-model “AI SOC” add-ons don’t solve it

The first wave of AI in the SOC has mostly meant connecting a large cloud model to the existing workflow. It helps with reading and writing, but it does not change the economics or the speed of the work.

• Token-hungry at SOC volume: a SOC handles millions of events and many thousands of alerts. Sending them through a large general-purpose model makes cost scale with volume.
• Added latency: each call is a network round trip to a shared service, at the moment speed matters most.
• Sensitive logs leave the premises: alerts and raw logs contain user names, hosts, internal addresses and business data. Sending them to a third-party service raises data sovereignty and compliance questions many organisations cannot accept.
• A copilot, not a closed loop: most add-ons summarise an alert or answer a question, then hand the work back to a person. They do not carry a case from detection through investigation, verification and action, and they do not learn from the outcome.

Agentic AI is a stepping stone, not the destination

Agentic SOC tools go a step further: a frontier model plans, calls tools, reads results and calls more tools. That is real progress, and it also inherits the model’s weaknesses. The whole operation depends on a third-party model. Token cost multiplies with every step, every retry and every reflection loop. Latency is hard to predict, outputs vary from run to run, which makes them hard to audit, and a changed tool or schema can break a chain that worked yesterday.

The total cost is higher than the API bill suggests. You pay twice: once for tokens, and again for the infrastructure needed to run agents at SOC scale, whether GPU capacity or cloud inference, orchestration and monitoring. And because cost tracks alert volume, it grows as the business grows instead of falling as the system matures.

Most importantly, agents rarely learn your environment. Each run starts mostly from scratch, and lessons from one investigation seldom become a durable, verified improvement for the next. An autonomous SOC has to do the opposite: get better and cheaper the longer it runs.

No local or on-premises option

Many AI security offerings exist only as a cloud service tied to a cloud model. They cannot run on the customer’s own servers, inside a private cloud or on an air-gapped network. For banks, government agencies, telecom operators and energy companies, that is often the end of the conversation: regulation, contracts or simple prudence keep security telemetry inside the organisation.

These are also the sectors with the most to protect and the most demanding attackers. A security model that cannot be deployed where the data lives leaves exactly those organisations behind.

What that means for your team

• Local-first by design: compact models specialised per task and tuned to your environment run on your premises, and your data stays with you. Frontier or agentic reasoning is optional, used sparingly and only where your policy allows, and what it contributes becomes local capability.
• Autonomy that gets cheaper and better over time: as ApexAI learns your environment, more of the work is handled locally, so cost does not grow linearly with tokens or alert volume.
• Works with what you already run: Elastic, CrowdStrike Falcon and Palo Alto Cortex XSIAM today, Microsoft Sentinel next, with no rip-and-replace and read-only access first.
• Runs on modest on-premises infrastructure, including private clouds and isolated networks, rather than requiring a large GPU estate.
• Every step is recorded: what ApexAI concluded, on which evidence, what it proposed and who approved it.
• Honest about where it stands: the Autonomous SOC runs today in preview alongside analysts, and capabilities are switched on step by step after review.

One platform, not a stack of point products

The SecOps core does not stand alone. The ApexAI AI-native API Gateway brings API, AI and MCP traffic through one governed door; ApexAI Data Gate protects data in use, at field level, through governed APIs; and post-quantum cryptography keeps signing and transport ready for the next era. The gateway and Data Gate are in development. All of them feed the same Autonomous SOC and the same proposal-first response path, under one console and one identity.

Questions