From vulnerability discovery, to exploit development, to effect delivery, it's no longer theoretical—Google recently identified what it believes is one of the first zero-day exploits developed with AI assistance: a bypass of two-factor authentication in a widely used admin tool, marked by telltale signs like a hallucinated CVSS score and unusually textbook code.

The trend is accelerating. The Five Eyes intelligence alliance recently warned that major businesses and governments are only "months" from broad exposure to AI-enabled breaches. One recent research report found attackers using Claude successfully with nothing more than vague, low-skill prompts—letting the model handle reconnaissance, exploit development, and data harvesting on its own. Booz Allen's Incident Response teams are seeing the same pattern accelerate across public and private-sector engagements.

Better AI tools deployed inside an outdated operating model will simply enable the wrong decisions faster. The strategies that follow require a new foundation and a new way of thinking that breaks with old assumptions and ideas underlying traditional security architecture. Building this new foundation is a leadership challenge before it is a technical one—and CISOs are positioned to lead it because the required changes cut across legal, finance, compliance, and business operations simultaneously. Three priorities should anchor that effort.

The deeper question isn't just how to move faster—it's where human judgment sits in a loop when the adversary no longer operates at human speed. The fix isn't removing humans; it's moving their judgment upstream into pre-authorized, tiered response: low-risk actions (quarantining files) run autonomously, medium-risk actions (revoking credentials) run with single-human confirmation, and high-risk decisions stay human but pre-scripted against known trigger conditions rather than improvised under pressure. Tabletop exercises simulating AI-speed attacks are the most effective way to build this.

This is ultimately a workforce question as much as a policy one. Analysts who once monitored and triaged will increasingly serve as orchestrators and decision authorities. The organizations that treat Human-AI teaming as a core competency—rather than a tool adoption—will be the ones that close the speed gap.

The changing threat landscape has resourcing implications that leadership needs to understand explicitly—and CISOs need to be the ones making that case. This is a structural shift, not a technology refresh. Vulnerability management illustrates the point: In its first month alone, Anthropic's Project Glasswing uncovered roughly 10,000 critical and high-severity vulnerabilities across its own and partner efforts—a backlog that requires sustained, multi-year investment, not a one-time budget line.

CISOs who frame this conversation in business or mission terms—exposure to material breach, insurance gaps, supply chain liability, the compounding cost of reactive versus proactive posture—will be better positioned to secure the operating model changes and resources these strategies require.

The challenges are clear. Attacks are outrunning human response timelines. SOC architectures are drowning in telemetry while meaningful signals slip through. And defenders lack the landscape visibility to get ahead of threats rather than simply react to them. What follows is a framework for addressing all three—not as a future-state aspiration, but as an operational imperative that leading organizations are building now.

Closing the speed gap requires moving human judgment upstream and machine execution downstream. Autonomous agents can now increasingly handle endpoint detection, triage, and initial response—from alert prioritization to recommended containment action—surfacing only the decisions that genuinely require human authority. For example, testing by Booz Allen shows that automated malware analysis can compress work that would take human teams up to 10 days into just minutes.

The authorization framework built in the operating model phase is what makes this executable. Pre-authorized, tiered response thresholds—developed across legal, compliance, and leadership before any crisis requires them—mean that when an agent recommends containment, the decision has already been made. The goal is to move human decision-making into the planning cycle where it strengthens response, rather than leaving it as a gate on every containment action in real time.

AI isn’t an emerging threat on the horizon—it’s a disruptive reality already reshaping the cyber kill chain and compressing attack timelines from days to minutes. Our survey of federal cyber leaders puts a number on it: 79% are extremely or very concerned, and only 6% consider themselves fully prepared. That gap between concern and readiness is the real finding—and closing that gap takes more than deploying new tools. It requires rebuilding risk assumptions, authorization frameworks, and detection architecture around the actual threat timeline. 

The fundamentals of cybersecurity haven’t changed, and neither has the essential challenge: Find the threat before it finds you. What has changed is the speed at which that competition plays out and the organizational capacity required to win it. The frameworks exist. The strategies outlined here are being deployed by leading programs today. What determines outcomes is whether organizations treat this moment with the urgency it demands—because the adversary already is.