For years, cybersecurity teams have worked around a familiar model: Detect. Investigate. Respond. Recover. But AI is changing the speed at which parts of the attack lifecycle can happen. Threat actors are increasingly using AI to accelerate reconnaissance, vulnerability research, credential harvesting, phishing, malware development and other activities.
For years, cybersecurity teams have worked around a familiar model: Detect. Investigate. Respond. Recover. But AI is changing the speed at which parts of the attack lifecycle can happen. Threat actors are increasingly using AI to accelerate reconnaissance, vulnerability research, credential harvesting, phishing, malware development and other activities.
The result isn't necessarily that every cyberattack is now fully autonomous. The more important shift is that AI can reduce the amount of human time required to carry out parts of an attack. And that changes the defensive equation.
From Automation to Agentic Attacks
Automation has always been part of cybercrime. Attackers have long used scripts, bots and automated tools. What's changing is the increasing ability to combine automation with AI systems capable of reasoning through tasks, adapting workflows and coordinating multiple activities.
Google Threat Intelligence Group reported in September 2026 that it had observed threat actors moving beyond basic prompting toward agentic AI workflows and AI-enabled automation. In one Q2 2026 case, GTIG observed threat actors compromise a cloud resource and then plan, build and execute an agent-enabled mass credential-harvesting campaign in under six hours.
That doesn't mean cyberattacks have become universally autonomous. Google explicitly notes that it has not yet observed threat actors deploying fully autonomous pipelines for exploitation against targets in the wild in the context discussed in its report. But the direction is significant: more AI, more automation, less human latency.
Why Does Speed Matter?
A conventional attack may involve multiple stages: Reconnaissance → Initial Access → Credential Theft → Privilege Escalation → Lateral Movement → Data Access → Exfiltration. Historically, many of these stages required substantial human effort. AI can increasingly assist with parts of this workflow.
This creates a challenge for defenders. If an attacker can accelerate several stages of an operation, security teams may have less time between detection and impact. Google Threat Intelligence describes this as a reduction in human-in-the-loop latency, compressing the traditional window available to defenders.
The Democratisation of Cyber Capability
One of the more significant implications is accessibility. Cybersecurity expertise has traditionally been a major barrier to executing sophisticated attacks. AI can lower parts of that barrier by assisting with technical research, code generation, reconnaissance and data analysis.
Anthropic's September 2026 threat intelligence report describes multiple cases in which threat actors used AI across cyber operations, including reconnaissance, exploitation, phishing, persistence and data exfiltration. Anthropic also reports that AI-enabled workflows were being used beyond simple chatbot interactions, including multi-agent frameworks supporting reconnaissance, exploitation and data exfiltration.
This doesn't mean that AI independently replaces the attacker. Human involvement can remain significant, particularly around target selection and strategic decisions. But AI can potentially allow fewer people to perform more work.
What Does This Mean for Security Operations Centres?
If attackers can increase their operational speed, security teams need to think carefully about the speed of detection and response. This is where modern Security Operations Centres (SOCs) are evolving. The focus is increasingly moving toward: continuous monitoring, automated triage, behaviour-based detection, threat intelligence, and human + AI collaboration.
Threat detection shouldn't depend entirely on manual investigation after an alert appears. Large volumes of alerts need to be prioritised so analysts can focus on the events that matter most. Security teams need visibility into unusual activity, not just known signatures. Understanding emerging tactics can help teams identify patterns before they become major incidents. AI can assist with investigation, correlation and analysis while humans retain appropriate oversight and decision-making authority.
Gartner's 2026 cybersecurity research identifies the emergence of AI-driven SOC solutions as a major trend, noting their potential to enhance alert triage and investigation while also creating new operational and workforce considerations.
The New Security Question
The question isn't simply: “Can we detect an attack?” It's: “Can we detect and respond quickly enough as attackers increasingly automate their operations?”
The answer won't come from automation alone. Organisations need a combination of people, process, technology and intelligence. AI can accelerate defence—but it also accelerates parts of the attack lifecycle. That makes visibility, identity controls, continuous monitoring and well-designed response processes increasingly important.
The Cybersecurity Race Is Changing
Cybersecurity has always been a race between attackers and defenders. AI is adding another dimension to that race: speed. The organisations that understand how AI is changing the threat landscape—and adapt their security operations accordingly—will be better positioned to manage this evolving environment. Because when parts of an attack can operate at machine speed, security operations need to be designed for a world where response time matters more than ever.
References: Google Threat Intelligence Group: GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI, September 8, 2026. Anthropic Threat Intelligence: Detecting and Countering Misuse of AI: September 2026. Gartner: Gartner Identifies the Top Cybersecurity Trends for 2026, February 5, 2026.