Exploit speed drops to sub-eight minutes, demanding agentic defense
The window between a CVE announcement and in-the-wild exploitation has shrunk to under eight minutes. Cisco argues that traditional human-speed security operations are now obsolete against AI-enabled attacks.
The time between a CVE announcement and the appearance of an in-the-wild exploit has dropped from months or years to sub-eight minutes, a trend that is only decreasing. DJ Sampath cited a recent PHP vulnerability where Cloudflare observed millions of attempts to exploit open websites immediately after the CVE was published. He referenced Greg Brockman's concept of the 'defender's window,' noting that powerful AI models provide a finite timeframe for defenders to identify and fix vulnerabilities.
Sampath highlighted a recent Microsoft attack involving 120,000 failed login attempts as an example of attacks operating at 'agent speed.' He asserts that traditional human-speed security operations are obsolete and that organizations must invest in AI-driven defense mechanisms to match the speed of AI-enabled attacks. Cisco is participating in the Glasswing and Daybreak projects with Anthropic and OpenAI to use AI models for vulnerability discovery.
Sampath argues that defenders must adopt agentic SOCs that understand application context and identity to react at the same speed as attackers. "The amount of time it takes, you know, for an exploit to show up in the wild from the time that a CVE was announced... now it's like sub eight minutes and it's only decreasing," he said.