To Fight AI-Powered Attackers, Enterprises Need Agentic Defense.

Meanwhile, enterprise environments have grown more complex, with data scattered across cloud infrastructure, remote workers, newly acquired companies and business units that don’t talk to each other, making the attack surface larger than ever and harder to secure.

Yet most enterprises are defending against these threats with tools and processes built for a slower pace.

A new operating model is emerging: agentic cyber defense, a fundamentally different architecture for enterprise defense.

Take a classic phishing attack. It once had obvious tells: a typo-ridden email or formatting that gave the game away. Now, agentic AI writes believable messages and adjusts them at scale, testing what works and refining along the way. One careless click is all it takes to let an attacker in. From there, autonomous agents get to work immediately: stealing credentials, moving through connected systems and expanding their reach, all without waiting for a human hacker to guide the next step.

“The fastest attack we’ve seen so far this year has been about five minutes of reconnaissance, attack and data exfiltration attempt,” says Joe Partlow, chief technology officer at ReliaQuest.

The Speed Gap: Five Minutes To Attack, 40 Minutes To Notice

Security analysts juggling alerts from fragmented tools and coordinating responses manually lose valuable minutes while attackers keep moving. Partlow says it can take 30 to 40 minutes for an analyst to even become aware of an attack, and even more time to contain it.

Visibility is patchy: security teams see only what feeds into their tools. One common fix — routing all security data into a central system before acting — doesn’t solve the speed problem. The data has to arrive and be translated into a format it understands before your human defenders can respond.

The most effective approach applies AI across the SOC.

It’s built around three capabilities that make that possible: