Fighting Fire with Fire: The Case for an Agentic SOC

/in , , /by

Here is an uncomfortable number for you to start your morning: 4. In a documented intrusion this year, an attacker gained access, moved laterally, and began exfiltrating data in just four minutes. And that is not the extreme: The fastest breakout time CrowdStrike recorded was just 27 seconds. That’s less time than it takes most of us to find a parking spot or buy a coffee.

Your analysts are talented. They are also human. This means they sleep, they go on vacation, and they occasionally need a second cup of coffee before the alerts start making sense in the morning. The threat actors running AI agents doing reconnaissance against your environment require none of those things. They do not get tired at 2 a.m. on a Saturday night and do not wait for your change control approvals to execute their attacks.

This is the heart of the problem we keep raising with security leaders. The threat has accelerated past humans-in-the-loop for every decision and action. CrowdStrike’s 2026 Global Threat Report measured an 89% year-over-year jump in AI-enabled adversary activity. The gap is widening. While you cannot out-click a machine, you can out-think one. This requires giving your people agents of their own, enabling them to fight fire with fire.

Your Adversary Already Put AI on the Payroll. Your SOC Deserves the Same Advantage.

Throughout the history of cybersecurity, attackers held a structural advantage. Nation-state actors built their zero-day war chests and chained them together for years before defenders could respond. By the time they were detected, the attackers had already won.

AI broke that pattern. The same foundational advances powering attacker’s automation became available to defenders to out-automate their opponents. We call this the Cyber AI Parity Window: a rare stretch of time when defenders hold technology equal to their adversaries.

Parity is a gift. It is also temporary. Advantage will go to the team that operationalizes AI fastest and most thoughtfully. While sitting on the sidelines and waiting for technology to mature is an option, it’s a decision that quietly concedes defeat.

What Does an Agentic SOC Actually Do?

When we walk clients through the Agentic SOC, we are careful to differentiate it from the scripted automation SOAR has been promising since it became a tool vendors could monetize. These automations followed rigid playbooks and broke the moment anything changed.

Agentic SOCs deliver intelligent and adaptive reasoning. They plan and take action with human oversight. A modern triage agent investigates an alert the way a seasoned analyst would: building the timeline, working out how far the problem has spread and which systems it touched, pattern and context matching (e.g. connecting the dots across your different tools), and delivering a clear verdict you can trace back to the evidence, all in seconds. Work that used to consume hours to create arrives at your analyst’s desk already structured and ready for them to act. And the best part? These agents don’t need that second cup of coffee or vacations. They deliver constant vigilance.

Architecture matters here. The early assumption was that the alert landing in the SOAR platform could run an entire investigation on its own. Real-world use taught us otherwise. A real investigation pulls clues from many different tools, validates the data against threat intelligence feeds, and checks its work along the way (with or without human-in-the-loop guidance).

A coordinated team of agents is what security organizations require. Each agent has a specialty. Some gather the supporting evidence, some work through what it means, some confirm the findings, and some carry out the response, with the whole team adjusting based on the kind of alert and environment in scope.

The Human/AI Operating Model: Who Does What

This is work In Balance IT helps our clients define. It’s the part that we see most vendors skip yet CISOs and security organizations require. What is the most effective way for my organization to adopt AI and build an agentic SOC?

Buying agents is easy. Governing them is the job that requires focus. The In Balance IT Human/AI Operating Model divides security activities into four quadrants, with each based on how much human judgment an agent’s actions require.

  1. AI runs autonomously – This is where the call is clear and the clock is unforgiving. Confirmed threat actor malware does not need a committee’s sign-off. Kill the session, revoke the access, and quickly isolate the affected machine. In low level non-production environments, this is a great option. Containing the problem in real time keeps the threat from spreading while cutting the appropriate ticket for further investigation and triage.
  2. AI acts with human oversight – This is where context changes the answer. An anomalous behavioral pattern might be a real intrusion, or it might just be a developer doing something creative in a test environment. AI assembles the evidence and recommends the response option. An experienced practitioner makes the call.
  3. Humans lead with AI assistance – Volume is high and judgment is critical. AI narrows 3,000 known security flaws down to the 30 that are actual risks. People approve the remediation windows and certify the actions. The rubber-stamping era is over.
  4. Humans own the decision outright – This is where the consequences of decisions made cascade for years. Risk acceptance, breach disclosure timing, ransom decisions, board reporting, and multi-year strategy belong in the boardroom. No algorithm should be weighing whether to take production offline or how to report risk to your board. A named executive owns accountability for that.

The logic is simple. AI absorbs the repetitive, high-volume, lower-risk, time-sensitive work. Your people move upstream toward oversight, design, and judgment calls that carry real weight.

Hand those repetitive investigations to agents and your analysts shift from overburdened alert triage experts to real SOC analysts. They define the investigation logic, set escalation thresholds, and refine the playbooks the agents run their logic against. When this is done correctly, backlogs shrink, engagement climbs, and your SOC analysts get to work on the problems that drew them into security in the first place.

Where to Start

The first move is honest measurement:

  • Where does your SOC stand today?
  • Which decisions can safely be moved to autonomous response?
  • Where does your operating model still depend on a human?

That is exactly what In Balance IT’s Adaptive Defense Agentic SOC Maturity Assessment is built to answer. We measure whether your defenses can operate at machine speed, where there are gaps and opportunities for improvement, and we map an operating model that keeps humans accountable while machines handle the high-volume work.

The parity window is still open. Let’s make your SOC agentic.

About This Series

This post is the third in the Adaptive Defense series. Each article addresses a specific domain where traditional frameworks fall short of today’s agentic AI threat landscape.

Post 1 — Why NIST, ISO 27001 & COBIT Can’t Keep Up With AI Threats

Post 2 — Agentic Adoption, the New Pattern for Cybersecurity

Post 3 — Non-Human Identity Security: An Attack Surface You Can’t See

Post 4 — Your Coding Agents Have Admin Rights and Trust Issues

Your Coding Agents Have Admin Rights and Trust Issues

/in , , /by

Here is an uncomfortable truth about modern software development. The most privileged identity in your engineering organization is no longer a person. It is an AI coding agent that reads your source code, runs commands in your terminal, holds your cloud credentials, and connects to whatever tools a developer wires up on a Tuesday afternoon.

Claude Code, Cursor, GitHub Copilot, OpenAI Codex, and Devin have quietly become production infrastructure. Most security programs are blind to their capability to run amok.

Banning the tools slows innovation. The productivity gains are real. Organizations must secure them the way we secure any other powerful, autonomous, internet-connected system: with a healthy dose of distrust.

The new attack surface is the coding agent, not just the app

Traditional application security asks whether the code you ship is safe. Coding agent security asks a different and newer question:

“Is the agent writing that code being manipulated while it works?”

Those are not the same problem, and the second one has major blind spots.

These exploits are not hypothetical. Security researchers have already documented and catalogued cases where a single piece of injected text, arriving through a connected tool or a repository file, rewrites an agent’s configuration and executes attacker-controlled commands on a developer’s machine. In controlled testing, getting these agents to run malicious instructions succeeds far more often than anyone will admit.

The pattern is consistent: feed the agent poisoned input, and its considerable privileges silently become the attacker’s windfall. Stolen credentials, supply chain injections, dead-man switches. All real, all a threat to your business.

The mechanism behind most of these is indirect prompt injection. A coding agent reads a GitHub readme file, an email or poisoned RAG document, a Teams or Slack message, and buried in that content are instructions the agent dutifully follows. It cannot reliably tell the difference between approved actions and novel attack patterns.

MCP is the connective tissue, and the soft underbelly

The Model Context Protocol, the open standard that lets agents plug into external tools and data, is what makes these agents genuinely useful. It is also where a lot of the risk lives. These connections get set up by developers, not security teams, which means most organizations have not built the practices to inventory, approve, and constantly retest for compromise. Supply chain attacks delivering credential-stealing malware through cloned connectors have already happened.

You cannot apply least privilege to a tool you did not know existed. Discovery and scanning of MCP servers, their privileges, and the systems they connect to is not a nice-to-have. It is a critical requirement for organizations embracing AI-assisted coding regardless of scale.

Zero Trust for AI Agents is the answer

Anthropic’s recent eBook, Zero Trust for AI Agents, makes the case better than any vendor pitch.

Its three principles will sound familiar to anyone who has done network zero trust: never trust and always verify, assume breach has already occurred, and enforce least privilege.

The paper adds a sharp new wrinkle it calls least agency: where least privilege limits what an agent can access, least agency limits what each agent tool can actually do, how often, and where.

Where AI runtime guardrails come in

AI runtime guardrails sit at the coding agent’s boundaries, integrated via hooks or a proxy, and inspect every tool call the agent makes before it executes. The controls that matter run two detection engines in parallel on each call. A rule-based engine matches commands, arguments, and file references against curated patterns to catch known attacks fast and deterministically. An LLM-based engine adds semantic analysis to catch what patterns miss: novel attack techniques, obfuscated payloads, and context-dependent threats where the same command is benign in one session and malicious in another. Together they evaluate every prompt, response, and tool call for injection, credential and data exfiltration, and tool abuse. Just as important, they constrain the overly privileged actions that turn a single compromised call into a breach, blocking the offending tool call rather than killing the session.

  • Granular enforcement that blocks or rewrites the offending tool call rather than killing the whole session, so a single flagged action does not halt legitimate work.
  • Continuous red teaming that attacks your agents the way a real adversary would, in CI/CD before they reach production, mapped to frameworks like the OWASP Top 10 for Agentic Applications.
  • MCP discovery and scanning that inventories every agent and connected server in your environment and flags the poisoned, abandoned, or over-permissioned ones.

Together these controls add up to a zero-trust posture for coding agents. Verify every call continuously with both engines, you assume the agent can be tricked, and you constrain what each tool is allowed to do and how far a single call can reach.

Guardrails supplement good DevSecOps

AI runtime guardrails secure the coding agent and AI Agent Actions. They do not secure the shipped code the agent helps you build. You still need good DevSecOps procedures for your DevOps pipelines, unit tests, code scanning, etc.

Static Application Security Testing (SAST) analyzes your source code and binaries without running them, catching flaws like injection and insecure cryptography early in the development lifecycle. Dynamic Application Security Testing (DAST) tests the running application from the outside, finding the issues that only appear under execution.

Neither one can see what your coding agent is doing in the IDE, and runtime guardrails cannot prove your shipped code is free of SQL injection. Defense in depth is never optional. The coding agents just added a layer.

Let us pressure-test your coding agents together

In Balance IT Solutions is co-presenting a Summer Security Series with Straiker focused on securing AI agents in the enterprise, and coding agent security is front and center. If your developers are running Claude Code, Cursor, Copilot, Codex, or Devin, and your security team does not yet have an inventory of the MCP servers attached to them, that gap is worth a conversation.

Schedule time with In Balance IT Solutions to walk through your current coding agent security plans, and register for the Summer Security Series to see runtime guardrails, agent red teaming, and MCP scanning in action. Reach out to your In Balance account team or visit our site to claim a seat. Bring your hardest questions. We will bring the red team.

About This Series

This post is the third in the Adaptive Defense series. Each article addresses a specific domain where traditional frameworks fall short of today’s agentic AI threat landscape.

Post 1 — Why NIST, ISO 27001 & COBIT Can’t Keep Up With AI Threats

Post 2 — Agentic Adoption, the New Pattern for Cybersecurity

Post 3 — Non-Human Identity Security: An Attack Surface You Can’t See

Post 5 — Fighting Fire with Fire: The Case for an Agentic SOC

Non-Human Identity Security: An Attack Surface You Can’t See

/in , /by

Eighty percent of breaches begin with identity. But most organizations are still treating identity as an access control problem — a gate to pass through — rather than an attack surface to monitor, baseline, and defend continuously.

When security practitioners talk about identity, they typically mean user authentication. MFA enforcement, password policy, privileged access management (PAM) — controls designed to keep the wrong person from logging in. That framing made sense when the identity surface was primarily human, but it no longer meets the challenge.

The modern enterprise identity fabric contains five distinct identity classes, most of which traditional IAM architectures were not designed to govern. Human accounts (the original target of identity controls) represent a shrinking fraction of the total identity population. Service accounts, machine identities, OAuth tokens, workload identities, and AI agent credentials collectively outnumber human accounts in most organizations, often by a ratio of 82 to 1. Most of them have elevated permissions. Almost none of them are behaviorally baselined. Many of them are never reviewed at all.

88%Of basic web application attacks used stolen credentials (Verizon DBIR 2025)
30%Of all incidents began with valid account abuse (IBM X-Force Threat Intelligence Index)
292 daysAverage to identify and contain a credential-based breach (IBM 2025)
82:1Machine-to-human identity ratio in typical enterprise environments (CyberArk 2025 Identity Security Landscape)

The five classes and why each is different

Human accounts carry the highest individual blast radius when compromised, particularly privileged accounts. But they also carry the most governance investment. MFA is widely deployed for human identities. Behavioral anomaly detection for humans exists in most mature security programs. While access over-provisioning is still a common occurrence, human identity management is not the biggest threat. The challenge is that human identity governance was built for a binary trust model (authenticate, then trust) rather than a continuous verification model.

Service accounts are the most commonly abused non-human identity class. They frequently carry far more permissions than their declared function requires, deployed against a broad permission set and rarely reviewed. In many organizations, many service accounts have never been audited after initial provisioning. Some are “owned” by systems, applications, or projects that no longer exist. These are orphan credentials with a blast radius that can include production environments.

OAuth tokens present a different problem. They are granted through consent flows that users rarely read carefully, often to third-party applications that acquire permissions far in excess of their stated function. Token scope right-sizing — auditing what each OAuth token is authorized to access versus what it actually needs — is not a standard organizational practice. It should be at least a weekly one.

Workload identities — the credentials used by cloud workloads, containers, and serverless functions — are particularly attractive targets because they often carry infrastructure-level permissions and are provisioned automatically at deploy time. The 2025 Salesloft Drift breach involved adversaries stealing OAuth tokens from a chatbot and using them to access hundreds of Salesforce instances (Google Threat Intelligence Group, 2025). A single compromised workload identity with over-privileged scope can become a cloudwide vulnerability and attack surface.

AI agent credentials are the newest class and the fastest growing. Every internal AI agent connected to production data or enterprise communication channels has an identity. That identity carries permissions. Those permissions are almost never JIT-scoped. As an example, an agent that has standing read access to the customer database for the purposes of feature testing that completed months ago is a standing attack surface. Those credentials are often never revoked because it is largely unmanaged.

The behavioral baseline is the prerequisite for everything

Every identity detection capability depends on an expected behavioral baseline, otherwise you can’t detect anomalous authentication behavior. You cannot detect a service account that is being abused for lateral movement if you have never mapped what that service account legitimately calls. Behavioral baselines are not just features of security tooling, they are data structures that must be deliberately built and continuously maintained.

For human identities, the baseline captures authentication timing patterns, device fingerprints, geographic access patterns, and the set of resources each identity normally accesses.

For machine identities, it captures which services each identity calls, at what frequency, and with what response patterns. Deviation from baseline can be the first indication of a malicious signature, and what enables detection of credential-based attacks that leave no malware behind.

“We have realized that AI Agents are synthetic identities. We have to identify them like we would a human. Authenticate them, scope what that agent can and should be able to do, and then maintain observability fine enough to detect anomalous behavior quickly.”

— David Malcom, In Balance IT cybersecurity practice lead

JIT access and NHI lifecycle governance

Just-in-time access architecture eliminates standing privileges, which are the most exploitable condition in the enterprise identity fabric. Under JIT, credentials are issued per task, scoped to the minimum permissions required, and expire automatically on task completion. The standing attack surface is reduced to near zero because there are no standing permissions to compromise.

NHI lifecycle governance is the operational practice of tracking, rotating, right-sizing, and decommissioning non-human identities throughout their lifecycle. The target: All machine identities with active rotation, documented ownership, and current scope documentation. Given the increased attack surface and the machine speed threat actors, these tactics have become basic discipline, applied to a class of assets that most security teams have historically treated as invisible.

Identity as telemetry infrastructure

The identity fabric, when properly instrumented, is one of the most reliable sources of high-fidelity threat telemetry in the enterprise. Every authentication event, every privilege use, and every lateral movement attempt leaves a trace in identity logs.

The organizations that treat identity as a gate (validate credentials, grant access, stop watching) throw away this telemetry the moment the authentication succeeds. The organizations that treat identity as a battlefield collect and analyze that telemetry continuously because they understand that the authentication succeeding is not evidence that the session is safe.

ITDR — Identity Threat Detection and Response — is the operational program that turns identity telemetry into detection and containment capability. It is not a product category. It is a program that combines behavioral baselining, anomaly detection, and automated response across all five identity classes, continuously.

The identity question to ask this week

How many non-human identities does your organization currently have documented with active ownership, rotation schedules, and scope reviews? If the answer is a percentage below 90, the identity attack surface is larger than your security program currently addresses.

About This Series

This post is the third in the Adaptive Defense series. Each article addresses a specific domain where traditional frameworks fall short of today’s agentic AI threat landscape.

Post 1 — Why NIST, ISO 27001 & COBIT Can’t Keep Up With AI Threats

Post 2 — Agentic Adoption, the New Pattern for Cybersecurity

Post 4 — Your Coding Agents Have Admin Rights and Trust Issues

Post 5 — Fighting Fire with Fire: The Case for an Agentic SOC

Agentic Adoption, the New Pattern for Cybersecurity

/in , /by

The question is not whether to automate security operations. The question is which decisions belong to machines, which belong to humans, and what happens when you get that boundary wrong in either direction.

There are two ways to get the human-machine boundary wrong in security operations. The first is keeping humans in every decision loop, ensuring that no action is taken without analyst review. Given the mean response times for detection and response within organizations is much longer than than the 29-minute adversary breakout times, these attacks can complete before containment begins. The second is removing humans from the decisions that require judgment and granting machines authority over ambiguous scenarios where the cost of a wrong decision is high. Both failures are common. Both should be considered cautionary tales.

The Adaptive Defense human-AI operating model is built around a single design principle: the right actor for each decision is determined by the speed at which that decision must be made and the degree of ambiguity it carries. Map every security operation onto those two axes, and four quadrants emerge, each with a different answer to the question of where the human sits.

The Four Quadrants

The first quadrant is machine autonomous. In this quadrant, the threat is high speed, low ambiguity. These decisions must be made in seconds and carry clear, well-bounded indicators. Examples include identity session revocation on confirmed anomaly breach, network micro-segmentation on high-confidence threat signals, and deception token triggers that lead to autonomous isolation. When the context is clear and the window is measured in seconds, human review is not a governance improvement, but rather a timing liability. The machine acts within approved thresholds; humans review outcomes, not decisions.

The second quadrant is human plus machine — high speed, high ambiguity. The machine surfaces context and generates a decision brief. The human decides, in under five minutes. Scenarios such as novel TTP alerts, insider threat signals, and lateral movement events carry genuine uncertainty that a confidence score cannot resolve. The analyst becomes a decision-maker, proactively informed by AI instrumentation. That is a fundamentally different role, and it requires a fundamentally different skill set. Over time, repeated responses to novel threats can be instrumented and moved into the autonomous quadrant as the threat becomes more defined.

The third quadrant is machine assisted, characterized by low speed and low ambiguity. Examples include vulnerability patch scheduling, AI-scored access certification reviews, and continuous compliance drift monitoring. The machine executes at scale; the human approves outcomes. This is where most practitioner bandwidth historically has been consumed and where automation returns the most working hours to higher-stakes work.

The fourth quadrant is solidly human. Low speed, high ambiguity. This is where operational posture is established. Security strategy and risk appetite. The governance of the autonomy boundary itself. The decisions about which actions machines are permitted to take. Board reporting and crisis decision-making. These cannot be delegated to a machine, not because the machine lacks capability, but because the accountability for these decisions cannot be delegated.

Quad 1 — Machine autonomousHigh speed • Low ambiguityReviews outcomes, not decisionsMTTC < 2 min
Quad 2 — Human + machineHigh speed • High ambiguityDecision-maker from machine briefAnalyst decision time < 5 min
Quad 3 — Machine assistedLow speed • Low ambiguityApproves outcomes at scaleNHI lifecycle compliance > 92%
Quad 4 — Human ledLow speed • High ambiguityOwns the decision and its accountabilityQuarterly boundary review

The Skill Gap the Industry is Not Talking About

The operating model requires three competency profiles that did not exist as distinct disciplines five years ago in the SOC landscape. Security AI Engineers build, train, and adversarially red-team the detection and response models. They own the confidence scoring model and threshold calibration. The critical question they must be able to answer is not “Does the model work?” but “Can this model be evaded? Is the training data poisoned? Do the false positive rates hold at 3 a.m. on a Sunday?”

Identity Security Architects treat the full identity fabric — human accounts, machine identities, service principals, OAuth tokens, AI agent credentials — as a living attack surface to be modeled, monitored, and minimized continuously. Not managed periodically. Not reviewed quarterly. Continuously.

Agentic SecOps Leads design the autonomous playbook library, define the thresholds for machine action, manage human escalation paths, and conduct tabletop exercises on human-machine handoff points. This role carries a specific authority that no previous security role has carried: the authority to adjust the autonomy boundary under operational pressure. That authority must be explicitly documented because the organization that grants machines the ability to take autonomous action must have a human who is accountable for where that line sits.

“Cybersecurity has become an agentic arena, and there is no shortage of technology and platforms to ‘fight fire with fire.’ But for many organizations, this is new muscle. The Human-AI operating model helps our customers rationalize where, how, and how much to instrument for autonomous operation, and how to evolve as the organization matures.”

— David Malcom, In Balance IT cybersecurity practice lead

The Override Rate as a Calibration Signal

One of the most underappreciated metrics in the operating model is the analyst override rate — the percentage of machine-recommended actions that analysts reverse or modify. The target is 5 to 15 percent. Below 5 percent, analysts are rubber-stamping machine decisions without genuine review; the human governance layer has become theater. Above 15 percent, the confidence model is mismatched — machines are making recommendations that trained practitioners routinely reject.

The override rate is not primarily a performance metric for the AI system. It is a calibration signal for the boundary between Quadrant 1 and 2. When override rates drift above the threshold, it is evidence that actions classified as machine-autonomous carry more ambiguity than the model accounts for — and the boundary needs to move.

The Governance Infrastructure That Makes Autonomy Safe

Every autonomous action must carry a reasoning chain, a confidence score, a timestamp, and a reference to the governance policy that authorized it. This is the evidentiary foundation that makes machine-speed defense auditable. When a machine revokes an identity session in 60 seconds, the organization must be able to show the regulator exactly why, under what authority, and with what evidence. If it cannot, it will face a choice between moving fast or staying compliant. With the right governance infrastructure, it does not have to choose.

The autonomy boundary review is a quarterly minimum, not an annual obligation. In a threat environment that evolves on a weekly cadence, a governance policy that has not been reviewed in six months is already stale. The Agentic SecOps Lead is accountable for triggering a review within 30 days of any material threat landscape change or any autonomous incident that produced an unexpected outcome.

The Velocity Gap is Not Optional

Organizations that maintain fully human-gated security operations in 2026 are not making a conservative choice. They are opting out of the fight. Adversary breakout timelines do not pause for analyst availability. Technology will always promise outcomes, but a bad actor only has to be right once to be successful. Adoption and maturity of agentic operations will determine how an organization prevents and responds over time to novel threats.

The question is not whether to adopt the operating model, but whether to adopt it before or after the incident that makes the case for change unmistakably clear.

About This Series

This post is the second in the Adaptive Defense series. Each article addresses a specific domain where traditional frameworks fall short of today’s agentic AI threat landscape.

Post 1 — Why NIST, ISO 27001 & COBIT Can’t Keep Up With AI Threats

Post 3 — Non-Human Identity Security: An Attack Surface You Can’t See

Post 4 — Your Coding Agents Have Admin Rights and Trust Issues

Post 5 — Fighting Fire with Fire: The Case for an Agentic SOC

Why NIST, ISO 27001 & COBIT Can’t Keep Up With AI Threats

/in , /by

Every year, security teams across the world complete their NIST CSF assessments, renew their ISO 27001 certifications, and report green on their COBIT dashboards. Every year, the same teams get breached. The uncomfortable truth is that these two facts are not contradictory but reflect the disconnect between the systemic approach of traditional frameworks and the “controlled chaos” of real-world cybersecurity. The foundational frameworks upon which most governance and compliance systems are based were designed for a threat landscape that no longer exists.

NIST CSF was first published in 2014. ISO 27001 was substantially revised in 2013 and updated in 2022. COBIT 2019 reflects governance thinking from the same decade. All of them were designed, and supplemented through consortiums, around a set of assumptions about how adversaries operate. These assumptions were reasonable at the time, but are structurally lacking for today’s threat landscape.

Key Failings of Traditional Control Frameworks

Time Compression: The traditional frameworks assume human-speed adversaries. The 2014 threat model imagined attack cycles measured in days or weeks, long enough for human escalation chains, and quarterly assessments to reflect capability. In 2025, the average adversary breakout time (the interval between initial access and lateral movement) fell to 29 minutes, according to CrowdStrike’s 2026 Global Threat Report. The fastest recorded breakout was 27 seconds. The threat is happening before the time check.

Identity as an Attack Surface: The frameworks assume identity is a binary gate. Valid credential equals trusted session. MFA plus least-privilege forms the perimeter. The Verizon 2025 Data Breach Investigations Report found that 88% of basic web application attacks used stolen credentials. The IBM X-Force Threat Intelligence Index 2025 found that valid account abuse was the initial access vector in 30% of all incidents. The gate model fails when the attacker already has the key.

“As someone who has led an Audit practice, our expectation of access management controls were ensuring management performed a quarterly re-certification of user access and ensuring that the findings identified in the previous quarter had been actioned…this wasn’t a very effective control then, and it certainly isn’t an effective control now. The threats are using valid credentials and moving (if they choose) in minutes.”

— David Malcom, In Balance IT cybersecurity practice lead

Speed vs. Human Intervention: The frameworks assumed humans would be the actors, through SIEM correlation rules, analyst triage, and escalation chains, in time to intercept bad actors. That assumption fails against attackers who enter through valid credentials, lie in wait, move laterally and recon-to-exfiltration at machine speed before an analyst can respond.

29 minutes
Average adversary breakout time, 2025 (CrowdStrike, 2026)
27 seconds
Fastest recorded breakout time, 2025 (CrowdStrike, 2026)
82%
Of 2025 intrusions were malware-free — attackers log in, not break in (CrowdStrike)
241 days
Average breach lifecycle, 2025 (IBM Cost of a Data Breach Report)

The metrics are real, and so are the threats. You cannot document your way out of a timing gap. If your mean time to contain is four hours and an adversary’s kill chain completes in four minutes, no control framework revision closes that gap. It is a physics problem that requires operational solutions, and those solutions are (at least in part) the agentic capabilities required to detect and respond in the real world.

What Adaptive Defense Does Differently

Adaptive Defense recognizes that there is no “steady state” in cybersecurity. The investment organizations have made in traditional frameworks (NIST, ISO, COBIT) has value, but those control frameworks need to be extended and activated by mapping every framework control to real-time operational capabilities that operate at adversarial speeds rather than audit cadence.

The prime directive for any security leader should not be “are we compliant?”, but “at current mean time to contain, how many adversarial kill chains complete in our environment in a 24-hour window before we intercept them?” Most organizations have never answered that question. The answer, when measured, is the business case for everything that follows.

The rest of this series works through the specific attack surfaces and operating disciplines where the framework gap is widest, and what closing it looks like in practice.

About This Series

This post is the first in the Adaptive Defense series. Each article addresses a specific domain where traditional frameworks fall short of today’s agentic AI threat landscape.

Post 2 — Agentic Adoption, the New Pattern for Cybersecurity

Post 3 — Non-Human Identity Security: An Attack Surface You Can’t See

Post 4 — Your Coding Agents Have Admin Rights and Trust Issues

Post 5 — Fighting Fire with Fire: The Case for an Agentic SOC