They Built AI to Move Faster. So Did the Attackers.

The old security operations rule was simple enough to remember and hard enough to execute. Detect the intrusion in one minute. Investigate it in 10. Respond in 60.

That model gave security teams a practical way to beat human-driven attackers. A person at a keyboard still needed time to move through an environment. They had to escalate privileges, run internal reconnaissance, test access, identify useful systems, stage data, and begin exfiltration. Each step created signals that a mature security operations team could detect and investigate.

The value of the 1-10-60 model was not that every organization could meet it perfectly. The value was that it gave defenders a timing discipline. It forced teams to measure how quickly they could find an intrusion, understand what was happening, and stop the attacker before the damage spread.

AI changes that timing problem. If privilege escalation, reconnaissance, scripting, lateral movement, and data discovery can happen at machine speed, defenders no longer have the same margin for investigation. AI threat detection still matters, but detection cannot be the first meaningful control if the attacker can reach sensitive systems before a human analyst finishes triage.

For defense contractors, this is more than a security operations concern. The systems attackers want are often the same systems that store, process, or transmit Controlled Unclassified Information. A detect and respond model becomes fragile when the attack timeline compresses faster than the response process.

The 1-10-60 Model Was Built for Human Speed

The 1-10-60 framework helped shape modern security operations because it matched the reality of hands-on-keyboard intrusions. Human operators needed time to make decisions, run commands, check results, change direction, and move deeper into the network. That gave defenders a window to interrupt the attack.

Endpoint detection and response grew in part because that window existed. EDR gave security teams telemetry from endpoints. SOC analysts used that telemetry to investigate suspicious behavior. Response actions could isolate a host, disable an account, stop a process, or contain activity before the attacker reached the objective.

The model assumed the defender could move quickly enough to matter. That assumption is now under pressure.

Attackers were already getting faster before AI became part of the conversation. Faster breakout times show that security teams have less time between initial access and lateral movement. AI adds more pressure because it can help attackers move through decision points that used to require more human time.

A model built around fast human response still has value, but it cannot be the entire strategy. Security teams need to think about what happens when the attacker’s useful actions happen faster than the defender’s investigation cycle.

AI Compresses the Attack Path

A traditional intrusion often unfolds through recognizable stages. Initial access leads to credential theft or privilege escalation. The attacker performs reconnaissance, identifies useful systems, moves laterally, finds valuable data, stages it, and begins exfiltration.

Security teams built detection logic around those stages because each stage produced signals. A strange login. A suspicious script. An account touching systems it normally never reaches. A device attempting unusual connections. A large data transfer outside normal patterns.

AI does not remove those stages. It makes them faster.

An attacker using AI can generate scripts quickly, interpret command output, test access paths, summarize directory structures, identify valuable files, and adjust tactics based on errors. Tasks that slowed down a human operator can become faster and easier to repeat.

This does not require a fully autonomous attacker. A human operator using AI assistance is enough to change the defender’s problem. The attacker still makes decisions, but AI can compress the time between those decisions.

That compression weakens security programs that depend too heavily on alert review, manual triage, delayed investigation, and response approvals that move at business speed. By the time the analyst understands the activity, the attacker may already be close to the systems that matter.

AI Threat Detection Still Has a Place

AI threat detection has real value. It can help correlate signals across endpoints, identities, cloud services, networks, and applications. It can surface patterns a human analyst might miss and reduce the time spent sorting through low-value alerts.

The mistake is treating AI threat detection as the whole answer.

If attackers can complete critical steps before a human can investigate, detection becomes a record of what happened instead of a way to prevent impact. That does not make detection useless. It changes the job detection has to perform.

Detection should support containment, investigation, forensics, tuning, and control improvement. It should help the security team understand which identity was used, which endpoint was touched, which path the attacker followed, and which control failed to stop the activity earlier.

The best use of AI threat detection is not waiting for a full incident to unfold. It is using the signals to close paths before they are used again. If alerts show repeated attempts against privileged accounts, tighten identity controls. If endpoint telemetry shows risky script behavior, restrict execution. If cloud signals show unusual access to CUI repositories, adjust access and monitoring before that path becomes a breach.

Prevention Has to Carry More Weight

Before EDR reshaped security operations, prevention carried most of the burden. That older prevention model was not enough, which is why the industry moved toward deeper visibility and response. Defenders needed a way to find attackers already inside the environment.

That shift made sense for human-speed attacks. AI-speed attacks force security teams to bring prevention back toward the center, but in a more mature form.

Modern prevention is not simple antivirus thinking. It means reducing the attacker’s ability to act before detection becomes necessary. For defense contractors, that includes least privilege, stronger identity governance, conditional access, endpoint hardening, application control, segmentation, secure configuration, patch discipline, and tighter control over CUI repositories.

The goal is to make useful attacker actions harder, slower, and more visible. If one user is compromised, that user should not have broad access to CUI. If one endpoint is compromised, it should not provide an easy path to file shares, administrative tools, or cloud repositories. If credentials are stolen, identity controls should make those credentials harder to use.

Prevention does not replace detection. It gives detection a better environment to work inside.

What This Means for Defense Contractors

Defense contractors face a different operating problem than ordinary commercial organizations. Their environments may contain CUI, export-controlled data, program files, technical drawings, contract documentation, and information tied to prime contractor relationships.

AI-speed attacks put pressure on the same areas CMMC already cares about. Identity must be controlled because credentials are often the fastest path into sensitive systems. Endpoints must be hardened because they remain a common execution point. CUI access must be scoped because broad access turns one compromise into a larger exposure. Cloud collaboration tools must be configured carefully because attackers often follow the same paths employees use every day.

Flat networks, over-permissioned users, unmanaged devices, and loosely governed file repositories give attackers room to move quickly. A defense contractor cannot solve that problem with detection alone.

This is where AI threat detection connects directly to CMMC. A CMMC-aligned program should already be reducing unnecessary access, strengthening configuration, documenting systems, reviewing accounts, monitoring activity, and preparing for incident response. AI-speed attacks make those controls more urgent because they reduce the time available to recover from weak implementation.

What Security Teams Should Measure Now

The old timing metrics still matter. Security teams should know how fast they detect, investigate, and contain suspicious activity. A slow SOC remains a serious problem.

AI-speed attacks add a different set of measurements. Security leaders should understand how quickly high-risk access can be revoked, how fast an endpoint can be isolated, how much of the environment enforces least privilege, and how much CUI is exposed to broad access groups.

They should also understand how many privileged accounts are continuously monitored, how many systems a standard user can reach without a business need, and how quickly security teams can act without waiting for a long approval chain.

Those measurements shift attention closer to prevention and containment. For defense contractors, the most important question may be how much damage a single compromised account or endpoint can do before the SOC sees it. If the answer is too much, the problem is architecture, access, and governance as much as detection speed.

Sentinel Blue Perspective

AI threat detection will remain part of modern security operations. Defense contractors still need visibility, investigation, alert triage, and response. A monitored environment is better than an unmonitored one.

The problem is dependence on detection as the first real moment of control. AI-speed attacks reduce the time between compromise and impact, which means security programs need to move more protection closer to the point of attack.

For organizations in the Defense Industrial Base, the stronger model is one where prevention, detection, and response support each other. Prevention reduces the attacker’s options. Detection shows what is happening. Response limits the damage.

That model is better suited for AI-speed attacks than a program that waits for an alert and hopes there is still time.