Attacks at machine speed: why the defense must be reinvented now

We are facing a change of time in cybersecurity: the transition from threats to human rhythm to attacks that occur at the pace of the machine. For years the organizational response was articulated in predictable cycles - researcher, CVE, patch, deployment - with measurable reaction times in days or weeks. That cadence is no longer enough. With the arrival of agentist border models in 2026, the offensive capacity ceased to be merely assisted and became self-executing: finding a failure, designing an explosion and carrying out an intrusion can happen within minutes, many times before an analyst has completed his first coffee.

Speed is not the only worrying dimension. These agents amplify the anonymity and fugacity of the attack. The traditional taxonomy of commitment indicators and exploitation catalogues, such as the CISA KEV or risk scores of EPSS, remains useful, but risks being cut off from self-generated threats that mutate and disappear before being registered. In many scenarios, when a SIEM or a detection tool raises the voice, the agent has already pivoted, exfiltered and cleaned his prints.

IT / OT convergence makes that speed a physical danger. What used to be theoretically separate segments now share bridges: laptops of technicians, internal APIs and protocolary gateways linking business networks with PLCs and industrial sensors. An automated adversary does not see "segmentation," sees a path of less resistance. When IT is transformed into an OT event, we are no longer just talking about data loss, but about stopping production lines, handling processes and risks to people's safety.

In view of this new landscape, the reactive mentality must give way to environmental defence: reduce exploitable surfaces, minimize blind spots and close climbing routes before they exist. This implies, first and foremost, a revolution in asset management. A veracious and continuously updated inventory is no longer a compliance process to become the map that defines where the attacker can hunt.

In practice, this requires techniques that go beyond periodic credentials. Passive detection and unauthenticated exploration of industrial protocols can discover forgotten devices, hidden access points and backplans that conventional tools do not record. It is also appropriate to complement with mapping exercises of interactive attack roads: it is not enough to know what vulnerabilities exist, it is necessary to understand how they would focus on taking an adversary from an unanticipated station to a critical asset.

The management of access to internal IA tools deserves special attention. Many organizations have given agents with writing capabilities extensive permits on repositories and pipelines to accelerate delivery. This is now a risk vector: limiting privileges, requiring mandatory human reviews for sensitive changes, introducing short-term ephemeral tokens and enhanced audit are essential measures. In addition, it is recommended to audit any third-party integration that offers "Ai-as-a-wrapper" functions, because each external connection adds possibility of abuse.

Detection and response must also evolve. The traditional signature loses efficiency in the face of ephemeral and polymorphic attacks; behavior-based detection, anomaly modeling and low latency telemetry signals become relevant. In parallel, the defenses must try to make up for time: automate preapproved responses, deploy traps and canaries that alert as soon as an agentiva inference attempts lateral movement, and practice playbooks that close climbing routes in seconds rather than hours.

In the OT area it is crucial to reassess the false safety of the air gap. Where absolute isolation is not possible, it must be invested in compensatory controls: single-directional doors (data diodes) where appropriate, effective segmentation with next generation firewalls that filter industrial protocols, and strict policies for multi-hosted devices. Maintaining independent physical security and manual emergency procedures helps to mitigate risks when automation fails or is compromised.

The organizational and regulatory implications are not minor. The risk of incidents that cross the digital into the physical can affect business continuity, job safety and legal responsibility. Integrating the risk of automated agents into impact assessment scenarios and incident response plans should be a priority for management boards and risk committees.

As concrete short-term measures: invest in continuous inventory and discovery that includes industrial protocols, reduce the writing permits of IA agents and audit their integrations, automate responses that limit lateral movement, and run red-teaching that use agentist models to expose real attack routes. It also shares intelligence with peers and public sources to detect emerging trends: resources such as MITRE ATT & CK and CISA's warnings remain valuable references for contextualizing and prioritizing mitigation.

The opponent is already learning to operate at machine speed. The defensive advantage will not disappear if we adapt our approach: to privilege complete visibility, to reduce privileges proactively, to automate critical responses and to treat IT / OT convergence as a concrete and measurable risk. The good news is that many of the techniques needed to contain this new wave are not science fiction; however they require organizational will, sustained investment and a process update that puts visibility and resilience ahead of mere operational efficiency.