AI Isn’t Changing How Attacks Work. It’s Changing How Fast

This guide is for business owners, IT managers and anyone who looks after systems for a small or growing organisation. A wave of security research published in 2026 points to one clear conclusion: artificial intelligence has not invented a new kind of cyberattack. Criminals still need a way in, they still move from one machine to the next, and they still steal or lock up data. What AI has changed is the speed at which every one of those steps happens. That shift matters more than any futuristic “AI super-hacker”, because it quietly breaks the timelines many organisations still rely on.

Key takeaways

• Same playbook, faster clock: Sophos, Microsoft, CrowdStrike and Fortinet all report that AI mainly makes familiar attack steps quicker and cheaper rather than creating brand-new techniques.
• Exploits arrive in hours: Microsoft says the median time from a vulnerability being found in the wild to being weaponised is now well under 24 hours.
• Break-outs take minutes: CrowdStrike measured an average eCrime “breakout time” of 29 minutes in 2025, with the fastest at 27 seconds.
• Phishing has scaled up: Microsoft found phishing was the way in for 23% of the intrusions its responders handled, up from 7% a year earlier.
• Your response plan needs a new stopwatch: monthly patching, next-day log reviews and manual approvals are now too slow for internet-facing systems.

What the research actually says

It is easy to dismiss “AI is changing security” as marketing. The value of the 2026 reports is that several companies, looking at different data, landed on the same message.

Sophos: speed, not new tricks

Sophos’s AI Security 2026 report, released in July and based on its incident response work and telemetry from more than 625,000 customers, says AI is compressing attack workflows from weeks to days. The company’s chief technology officer, John Peterson, summed it up this way: attackers still need initial access, still move laterally and still exfiltrate data; what has changed is how fast they do it. Sophos describes AI as an operational force multiplier that leaves defenders less time to detect and contain activity.

The report also documents one of the first clear cases of AI driving a real operation. A group tracked as STAC6994 used around a dozen AI agents to write and test attack code against well-known endpoint security products, producing nearly 80 modules and more than 70 evasion techniques in a few days. Sophos says the same work would previously have taken people weeks.

Microsoft: exploitation in under a day

Microsoft’s 2026 Digital Defense Report, covering July 2025 to June 2026, describes AI as “changing the physics” of cybersecurity. Its headline figure is that the median time between a vulnerability being discovered in the wild and attackers weaponising it is now well under 24 hours. Microsoft also expects a record of roughly 72,000 CVEs in 2026, and warns that because fixing flaws is slower than finding them, unpatched vulnerabilities will pile up for years.

The same report shows how familiar entry points are growing: exploits against public-facing applications rose from 15% to 24% of the intrusions Microsoft investigated, and phishing jumped from 7% to 23%. AI lets attackers personalise every message, which Microsoft says turns targeted “spear phishing” into a mass-market operation.

CrowdStrike: minutes to move inside

CrowdStrike’s 2026 Global Threat Report, published in February, measures “breakout time”, the gap between an attacker’s first foothold and their first move to another system. The average for criminal groups fell to 29 minutes in 2025, the fastest recorded case took just 27 seconds, and in one intrusion data theft started within four minutes. CrowdStrike also reported an 89% year-on-year increase in operations by AI-enabled adversaries, and found that 42% of vulnerabilities were exploited before they were publicly disclosed.

Fortinet and J.P. Morgan: velocity is the new risk

Fortinet’s 2026 Global Threat Landscape Report frames risk in terms of “velocity” rather than sophistication. Its FortiGuard Labs team observed 122 billion exploitation attempts in 2025 and says time-to-exploit is now measured in hours. A J.P. Morgan report covered by the OECD’s AI incident monitor in August made the same point: AI helps attackers find and exploit software flaws within a single day of disclosure, while organisations struggle to patch fast enough.

How AI speeds up each stage of an attack

Thinking about a typical attack as a chain helps explain why speed is the real story.

1. Finding a way in

Reading a security advisory, understanding the bug and writing working exploit code used to take skilled people days. AI tools can now help with research, code generation and testing, which is why researchers keep reporting shorter gaps between disclosure and attack. Microsoft notes that state-backed groups use AI to hunt for vulnerabilities and tips on exploiting them, while others use AI-generated tooling to scale up.

2. Tricking people

Language and polish used to give phishing away. AI now writes convincing, personalised messages in many languages at almost no cost. Sophos highlights deepfakes and AI-assisted scams that are more scalable and more believable, including a UK victim who lost hundreds of thousands of pounds to a fake AI investment platform after months of coordinated messaging.

3. Moving and stealing inside

Once inside, attackers often reuse stolen passwords and tokens. Microsoft found that in more than half of intrusions that began with a valid account, attackers harvested more credentials once inside. Sophos says identity is now the top initial access vector, and that AI identities themselves, such as OAuth tokens, agents, APIs and developer tools, are becoming high-value targets.

4. Avoiding detection

The STAC6994 case shows AI being used to mass-produce variations designed to slip past security tools. More variations, produced faster, means signature-based defences and slow manual reviews fall further behind.

Why speed hurts small and medium businesses most

Large enterprises have round-the-clock security operations centres. Most small businesses, schools, clinics and shops in Nigeria and across Africa do not. Many rely on one IT person, an outside support company or a “we’ll patch at the end of the month” routine. When exploitation happens within a day and a break-out within half an hour, that routine leaves a wide window open.

The local fraud picture shows the human side of the same trend. Nigeria Inter-Bank Settlement System (NIBSS) data reported this year named social engineering as the most common fraud technique against bank customers. AI-polished messages make that technique cheaper for criminals to run at scale.

What defenders should change

You cannot out-type an automated attacker, but you can remove the slow steps that give them time.

Shrink your patch window for exposed systems

• List every system reachable from the internet: VPNs, firewalls, remote access tools, email servers, websites and file-sharing portals.
• Turn on automatic updates wherever the vendor supports them.
• For critical flaws in internet-facing systems, aim to patch or apply the vendor’s mitigation within 24 to 48 hours, not at the next monthly cycle.
• Subscribe to security advisories from the vendors you use, and to alerts from CISA and your national CERT, such as ngCERT in Nigeria.

Make stolen passwords less useful

• Require multi-factor authentication on email, VPN, cloud and admin accounts, preferring phishing-resistant options where available.
• Remove unused accounts, API keys and app connections, and review which third-party and AI tools have access to company data.
• Give staff and service accounts only the access they need.

Detect and respond in minutes, not days

• Use endpoint protection with automatic isolation or blocking, not just alerts someone reads the next morning.
• If you cannot staff monitoring yourself, consider a managed detection and response (MDR) provider.
• Agree in advance who can disconnect a machine or disable an account without waiting for a meeting.

Train people for convincing fakes

• Teach staff that perfect grammar and personal details no longer prove a message is genuine.
• Set a rule that any request involving money, passwords or bank details must be confirmed through a known phone number or in person.

Govern your own AI use

• Keep an inventory of AI tools, agents and integrations in use, and the accounts and tokens they rely on.
• Store backups offline or in immutable storage, and test restoring them, so a fast attack does not become a permanent loss.

Frequently asked questions

Is AI creating brand-new types of cyberattack?

Mostly not yet. The research above consistently says AI is making existing steps, such as exploitation, phishing and evasion, faster and cheaper. That is still serious, because speed removes the time defenders used to have.

Do small businesses really need to worry?

Yes. Automation lets attackers target many organisations at once, so being small no longer means being ignored. Internet-facing systems are scanned constantly regardless of who owns them.

Can AI help defenders too?

It can. Security tools increasingly use AI to spot suspicious behaviour and respond automatically. The key is to let those tools act quickly, for example by isolating an infected laptop, rather than only sending alerts.

What is the single most useful change to make first?

For most organisations, it is a combination of turning on multi-factor authentication everywhere and patching internet-facing systems within a day or two of a critical fix.

Next steps

1. This week, list every internet-facing system you run and confirm who is responsible for updating each one.
2. Switch on automatic updates and multi-factor authentication wherever they are available.
3. Set a written target for patching critical, exposed flaws within 24 to 48 hours.
4. Decide who can isolate a device or disable an account at any hour, and write down how to reach them.
5. Review which AI tools and integrations can reach your data, and remove any you no longer use.
6. Run a short refresher with staff on AI-written phishing and voice or video impersonation.

Attackers have not rewritten the rules; they have simply pressed fast-forward. Organisations that remove delays from patching, access control and response will close most of the gap.

Sources

• AI is giving attackers a head start, Microsoft warns (Help Net Security)
• Sophos AI Security Report: AI is compressing cyberattack timelines
• 2026 CrowdStrike Global Threat Report
• Fortinet 2026 Global Threat Landscape Report
• OECD.AI: AI accelerates cyber exploits, shrinking response time

Featured image: Photo: “Globe Computer Code and Security” by perspec_photo88, CC BY-SA 2.0, via Openverse — source