The Attack Loop Is Compressing. The SOC Is Not.

In an earlier From Noise to Narrative series, I argued that the SOC has to move from alerts to context, from context to narratives, and from narratives to decisions. That was the defensive side of the problem. But while security teams are still trying to rebuild that operating model, the offensive side, covered in this three-part series, is changing underneath them.

We are spending too much time debating whether AI can create a completely new class of cyberattack.

It does not have to.

An attacker does not need an AI-generated zero-day in every campaign. They need faster research, faster adaptation, cheaper experimentation, and fewer dead ends. They need to turn a failed attempt into the next attempt before the defender has finished assigning the alert.

That is the shift security leaders need to understand.

The immediate risk is not that AI suddenly makes every attacker brilliant. It is that AI makes iteration cheap.

Guardrails Are Useful. They Are Not A Security Boundary.

Model providers have invested heavily in safeguards, classifiers, acceptable-use policies, monitoring, and abuse disruption. That work matters. It raises the cost of misuse and gives providers a way to identify and remove malicious actors.

But a provider’s guardrail is not part of your enterprise control plane.

It is an external friction point. Attackers can probe it, reframe requests, switch models, use open-weight systems, break work into smaller tasks, or build tooling around the model. The guardrail can make misuse harder without making it impossible.

That distinction matters because security has a bad habit of turning friction into reassurance.

What The Threat Reporting Shows

In early 2025, Google Threat Intelligence Group reported that state-backed actors were mostly using generative AI for familiar work: research, troubleshooting, scripting, translation, and content generation. That was not a cyber singularity. It was a productivity gain.

By late 2025, the picture had moved. GTIG documented malware experimenting with models during execution, a growing market for illicit AI tooling, and actors using research or capture-the-flag pretexts to get around safeguards. Anthropic reported disrupting an extortion operation in which AI supported reconnaissance, credential harvesting, network penetration, data analysis, and ransom decisions across multiple victims.

These reports describe cases the providers observed and disrupted. They are not a census of global threat activity. But they do show direction: AI is moving from an occasional assistant toward a more integrated part of attacker workflows.

That direction continued in 2026. In May, GTIG reported the first threat-actor use of a zero-day it believes was developed with AI, alongside broader movement toward agentic workflows for scaled operations. The important word is believes. Attribution and prevalence remain difficult. The capability curve is still moving.

The lesson is not that guardrails are pointless. The lesson is that attacker adoption is a curve, not a switch.

We should stop asking whether AI is contained and start asking where it is removing time, skill, and cost from the attack loop.

The Economics Changed Before The Tactics Did

Consider a simple example.

An attacker obtains access to a low-privilege cloud account. The first privilege-escalation attempt fails. Historically, the attacker might search documentation, inspect permissions, modify a script, troubleshoot an API error, and try again. Each step requires knowledge and time. Some operators get stuck.

The Boring Middle Of An Attack

Now put an AI assistant inside that loop.

The model explains the error. It summarizes the relevant API behavior. It rewrites the script. It suggests a different enumeration path. It helps interpret the output and prepares the next attempt.

None of those actions changes the attack on its own. That is exactly why the cumulative effect is easy to underestimate.

The model is industrializing the boring middle of an attack: the research, translation, debugging, adaptation, and sequencing that sit between intent and outcome.

The attacker still needs access. The model can still hallucinate. Tools still break. Environments remain messy. Long-running autonomous operations can lose the plot. Anthropic’s own cyber evaluations have shown both meaningful gains in multistep attack performance and continued difficulty maintaining coherent plans when unexpected obstacles appear.

Those limits are real. They are not comforting.

An attacker does not need perfect autonomy to gain an advantage. They only need the next useful action to arrive faster and more often.

The New Advantage Is Loop Speed

Real Attacks Are Loops

We tend to describe attacks as a linear lifecycle: reconnaissance, initial access, execution, persistence, lateral movement, impact.

Real attacks are loops.

Observe. Form a hypothesis. Try something. Read the result. Adjust.

AI compresses the time between those steps. It gives less-skilled operators more endurance and gives skilled operators more throughput. It can help one person run more experiments, maintain more infrastructure, tailor more lures, and recover from more failures.

That does not mean every campaign becomes autonomous or sophisticated. It means the economics favor more attempts and shorter adjustment cycles.

Defense Also Operates As A Loop

A signal fires. The SOC gathers context. An analyst forms a hypothesis. The team validates scope, chooses an action, and feeds the result back into detection and prevention.

The problem is that most defensive loops are interrupted by queues and handoffs.

An alert waits to be assigned. Identity context sits in another console. Endpoint evidence belongs to a different team. The analyst discovers a telemetry gap, but the finding becomes a backlog item. A detection is closed as a false positive, but the reason never reaches the engineer who owns the rule. A containment recommendation waits for an application owner who has not seen the evidence.

The attacker receives feedback from the environment immediately.

The defender receives feedback through a ticket.

That is the asymmetry.

This Is Not A Race To Remove Humans

The obvious response is to automate everything. That would be a mistake.

Speed without control creates a different failure mode. A fast system can disable the wrong account, isolate a production server, erase useful evidence, or confidently act on incomplete telemetry.

The goal is not to make every defensive action autonomous. The goal is to remove unnecessary latency from the work that precedes judgment.

Machines are well suited to collecting evidence, resolving entities, checking telemetry coverage, comparing current behavior with prior cases, and maintaining state across systems. Humans are still needed to challenge the story, weigh business impact, accept risk, and authorize disruptive actions.

That distinction is important. The future SOC is not human-speed or machine-speed. It is machine-assisted where context can be assembled reliably and human-governed where consequences matter.

Queue Metrics Hide The Real Delay

Most SOCs measure mean time to acknowledge and mean time to respond. Those metrics are useful, but they flatten the problem.

An alert can be acknowledged quickly and still spend hours being reconstructed.

How much time did the analyst spend finding the right identity? How long did it take to confirm whether the endpoint was managed? How many people had to restate the same incident before someone could approve containment? How long did the lesson from the investigation take to reach detection engineering?

That is decision latency, and most SOCs do not measure it cleanly.

AI-assisted offense increases the cost of that delay. The attacker can run another experiment while the defender is still assembling the evidence from the last one.

This is why the traditional alert queue is becoming structurally mismatched to the threat. Not because analysts are too slow. Not because every attacker is suddenly autonomous. Because the attacker is tightening a learning loop while the defender keeps breaking its own loop into separate work queues.

The Hard Question

If we want to defend against faster iteration, we need to stop treating the SOC as a collection of tools connected by tickets.

The critical question is no longer, “How quickly did we process the alert?”

It is, “How much decision state did we preserve from first signal to final action?”

Did threat intelligence survive contact with the local environment? Did the hunt expose what could not be seen? Did the detection carry its assumptions into the investigation? Did the investigation preserve evidence, confidence, and missing context? Did the response owner understand both the threat and the operational risk of acting?

In too many SOCs, the answer is no.

The functions are connected. The context is not.

In the next article, I will follow that defensive loop across threat intelligence, hunting, detection engineering, investigation, and remediation. We will look at exactly what gets lost when the work changes hands, why strong analysts are forced to reconstruct it, and how that loss becomes decision latency.

That is the lossy handshake. Watch this space for Part 2.

Frequently Asked Questions

Does AI have to create a new class of cyberattack to matter?

No. An attacker does not need an AI-generated zero-day in every campaign. They need faster research, faster adaptation, cheaper experimentation, and fewer dead ends. The immediate risk is not that AI suddenly makes every attacker brilliant, it is that AI makes iteration cheap.

Are AI provider guardrails a security control for my enterprise?

They are useful, but they are not a security boundary you own. A provider’s guardrail sits outside your enterprise control plane and acts as an external friction point. Attackers can probe it, reframe requests, switch models, use open-weight systems, break work into smaller tasks, or build tooling around the model. Guardrails raise the cost of misuse without making it impossible.

What is decision latency in the SOC?

It is the delay that queue metrics hide. An alert can be acknowledged quickly and still spend hours being reconstructed: finding the right identity, confirming whether an endpoint was managed, restating the incident for each new owner, and carrying the lesson back to detection engineering. Mean time to acknowledge and mean time to respond do not measure that cleanly.

Does defending against faster attacker iteration mean automating everything?

No. Speed without control creates a different failure mode, where a fast system disables the wrong account, isolates a production server, erases useful evidence, or acts confidently on incomplete telemetry. The goal is to remove unnecessary latency from the work that precedes judgment, and to keep humans where they challenge the story, weigh business impact, accept risk, and authorize disruptive actions.