Twenty-nine seconds after firewalls or access controls blocked its first attempt, an AI agent inside an Argentine healthcare organization’s network switched tactics, targeting the domain controller through SQL, according to security provider CrowdStrike. Seventeen minutes later, it had pulled five credential hashes from the domain controller. The attacker behind it compromised at least 15 Argentine healthcare organizations and took credentials and medical records from at least one, CrowdStrike said.

CrowdStrike’s October 21 report profiles four previously unreported attackers the company traced between May and August, and it names Claude Code in all four. CrowdStrike wrote that the four cases “likely demonstrate that agentic AI commoditizes baseline offensive cyber operations.” It saw agents at work because each attacker “left their offensive agent frameworks exposed via open directories,” it wrote. In the Argentine campaign, a “Supervisor” Claude Code agent picked the next task and an “Executor” agent carried it out. Anthropic was contacted and did not respond by press time.

Human attackers at keyboards issue dozens of commands an hour, and AI agents issue about 1,500 an hour, according to Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations. “It’s just speed and volume,” Meyers told VentureBeat. “This is not using new and unseen exploits. It’s just using things that we already knew about, but it’s doing it faster, and it’s kind of connecting the dots at a volume that we’re not used to seeing.”

The report also says CrowdStrike's threat hunters had already recorded three times as many agentic intrusions in the second half of 2026 as in the first half.

The speed of these attacks is why CrowdStrike is moving away from “breakout time” — the time an intruder needs to move from the first host it compromises to another one on the network — a metric it introduced in 2018 and that the industry has cited ever since. Even CrowdStrike’s own executives have yet to agree on what should replace it.

VentureBeat Intelligence’s October Agentic Security and Identity survey suggests a different clock worth watching: how quickly security teams can shut down their own agents.

Why CrowdStrike is moving on from breakout time

CrowdStrike reported an average breakout time of 1 hour and 58 minutes in its 2018 Global Threat Report. By its 2026 report, the eCrime average was 29 minutes, and the fastest recorded breakout hit 27 seconds.

At CrowdStrike’s Fal.Con 2026 conference in Las Vegas on September 1, CEO George Kurtz said he had been wrong to call last year’s 27-second breakout machine speed. “This was human speed with better tools, and breakout time is over,” he said. Breakout time gives defenders a benchmark for how quickly they need to contain an intrusion before the attacker moves across the network. “There’s no gap left to measure,” CrowdStrike President Michael Sentonas said during his keynote.

CrowdStrike’s 1-10-60 rule — detect in one minute, investigate in 10, remediate in 60 — came under pressure as average breakout times dropped to 48 minutes in its 2025 Global Threat Report. “We were using that metric to set the bar for ourselves,” Meyers said, and the team concluded, “1-10-60 is kind of dead.” CrowdStrike is still debating what should replace breakout time. “We are having those debates internally,” Meyers said.

Palo Alto Networks’ Unit 42 sees the same compression. “In the fastest cases we investigated, attackers needed just 72 minutes to move from initial access to data exfiltration, 4x faster than last year,” Unit 42 wrote.

The metrics fall into two groups: Command throughput and access-broker handoff time measure attackers, while stage clocks, mean time to defense, damage-to-discovery and agent revocation time measure defenders. But none of these measures alone tells a security team whether it can contain an attack before the damage is done.

The attacker clocks

An attacker’s speed matters not just in moving between machines, but in how much they can accomplish before a security team intervenes.

Command throughput

Command throughput measures how many commands an attacker issues in a given period. The quality of those commands “is pretty high because of AI,” said Meyers.

Amazon CISO CJ Moses told the Fal.Con audience on September 2 that one of AWS’ MadPot honeypots caught an AI agent in July “completing a full cyber attack, and it did it in 12 minutes and 42 seconds.” The honeypot logged “94 events, zero syntax errors,” and the agent could “respond in less than 500 milliseconds, which no human could actually distill what was being presented back to them and respond.”

Access-broker handoff time

Access-broker handoff time measures how long the intruder who first breaks in takes to pass that access to a second group. Mandiant’s M-Trends 2026 put the median at more than eight hours in 2022 and 22 seconds in 2025. Mandiant attributes the shrinking window in part to access brokers installing the malware or network tunnels their partners will need before handing over access.

The defender clocks

For defenders, the question is where their own security operations are losing time — and which delays they can actually do something about.

Stage clocks

Stage clocks time each step of a response separately. On September 21, attackers used two zero-days to reach root on the Zammad ticketing system of the Dutch Institute for Vulnerability Disclosure (DIVD), a volunteer-run nonprofit. From there, DIVD says, AI agents ran the rest of the attack.

DIVD published its clocks. Mean time to detect was 19 minutes. It took 19 hours to mount its first response, during which the team developed a containment plan, and another nine hours to contain the attack.

DIVD is not an enterprise SOC; its volunteer incident response team had to assemble in person as part of the containment effort.

Tomer Weingarten, SentinelOne’s co-founder and CEO, speaking about the industry rather than DIVD’s case, told VentureBeat he expects the long-standing speed metrics to stay, with “more stages that allow us to look at the problem in a more granular way that can help us just remove the bottlenecks.” Each stage, he said, is its own problem. “The time that you collect the first signal has almost nothing to do with your AI triage.” SentinelOne, like CrowdStrike, sells AI-driven detection and response.

DIVD’s timeline shows what that granularity exposes. The longest clock was the response, and that is where the bottleneck sat. Success, Weingarten said, is “much more profound if you say I’ve compressed your mean time to respond, not even to detect, but mean time to respond,” first “from hours to minutes” and eventually from “seconds to milliseconds.”

Weingarten also cautioned against treating new tooling as progress. “I don’t think it’s any success to just say that you deployed more controls,” he said.

Mean time to defense

Mean time to defense is the time from a flaw’s public disclosure to its fix. Moses said he coined the term as AWS CISO three years ago, and he told the Fal.Con audience on September 2 that counting how many vulnerabilities a team finds was never the metric that mattered.

Damage-to-discovery time

Damage-to-discovery time measures how long damage goes unnoticed. Sentonas floated a different successor in his Fal.Con keynote. “The new measurement may be the time from when the damage is done to when damage is discovered,” he said. He said the idea did not sit well with him. His answer is “investigations at machine speed,” because, he said, “the attack moves in minutes or less. The investigation cannot take hours.”

Meyers, who followed him on stage, called it “a more interesting metric that we’ll need to start to look at.”

Agent revocation time

The October survey asked 89 respondents running AI agents in production or piloting them how fast they can revoke one that misbehaves. Respondents whose organizations give each agent its own identity are nearly twice as likely as those whose agents share credentials to say they can revoke an agent’s access within minutes. Fifty-three respondents said their organizations give each agent its own identity, and 32 of them said a named owner could revoke access within minutes, while only one said it would take more than a day or require tracing the credential first. Of the other 36 respondents who said their organizations let agents share credentials, 10 said revocation would take more than a day or require them to trace the credential first, and only 12 said minutes.

Across all 89, 44 said a named owner could revoke within minutes, and another 32 pointed to a security or platform team that could do it in hours. Eleven needed more than a day or a credential trace, which leaves two who were not certain or did not know. Twenty of the survey’s 102 respondents are consultants answering for a client organization. The survey did not test whether giving each agent its own identity makes revocation faster.

The problem with a shared key is that revoking it cuts off every agent and person using it, the survey report notes.

The shrinking window to patch

On June 10, CISA replaced its old patch deadlines with Binding Operational Directive 26-04, which ranks each flaw on four risk criteria, including whether exploitation can be automated, and gives federal civilian agencies three days to fix the most dangerous ones. CISA tied the change to AI potentially shortening the time between a flaw’s disclosure and its exploitation. The 2021 directive it replaced set a default two-week deadline for exploited vulnerabilities assigned CVEs in 2021 or later. Agencies must be on the new timelines by December 7, 180 days after the directive was issued.

Verizon’s 2026 DBIR put the median time to fully remediate a known exploited vulnerability at 43 days, up from 32. Moody’s, citing Flashpoint research, says the average time from public disclosure to first exploitation fell from 115 days in 2024 to 44 days in 2025. Exploit windows are shrinking while patch times are growing.

Moody’s measured vulnerability exposure differently from Verizon. Its October 19 report cited earlier research using Bitsight data that found known exploited vulnerabilities remained visible from the internet for a median of 87 days. Verizon tracks how long organizations took to fully fix exploited flaws found inside their own environments. Moody’s tracks how long those flaws stayed visible from the internet on the networks of companies it rates. Moody’s cautioned that AI may have shortened the time to exploit since then and that remediation times may also have changed.

Meyers said his team used to tell people they had a 30-day window to patch. Now it is more like 30 hours. Kurtz told investors on September 2, “We hit the sound barrier on patching.”

Chase Cunningham, a retired Navy chief cryptologist known across the industry as Dr. Zero Trust, told VentureBeat that the assumption that teams have a few weeks needs to be challenged. “While your change advisory board meeting may be scheduled for next Tuesday, attackers face no such constraints and will immediately exploit newly disclosed issues,” he added.

Cunningham’s advice, written for the PHP flaws patched October 21, is to “track the amount of time it takes to (1) identify all of the exposed PHP scripts, (2) limit their attack surface, (3) apply the patch and verify that the patch was applied, and (4) determine what that compromised workload could do to the rest of the organization.”

Meyers put last year’s total at 48,200 published CVEs, matching the 48,185 CVEs published in 2025 in a count Trend Micro cites, and this year’s at 86,300 by late October. That growing patch burden was the focus of VentureBeat’s analysis of Microsoft’s record Patch Tuesday. Automated patching is “not something that’s widely done today,” Meyers said, because “you’re still going to be accountable for something that breaks because of a patch.”

The boardroom dilemma

Moody’s has warned that weak cyberdefenses could make borrowing more expensive. “Those with weak patching practices are likely to fall further behind, especially if they have large digital networks that greatly broaden their attack surface,” Moody’s said.

Yet incident counts have been the most commonly reported SOC metric for 10 straight years, with 70% of respondents citing them in SANS’s 2026 SOC survey.

Splunk’s 2026 CISO Report, an Oxford Economics survey of 650 CISOs taken in July and August 2025, found that incident reduction, mean time to detect and mean time to respond are the top metrics CISOs use to show leadership a return on security spending. Splunk is a Cisco company, and Cisco sells detection and response.

Kayne McGladrey, a CISO advisor and IEEE senior member, told VentureBeat the CISO “talks right past the CFO or the CEO because they focus on vanity metrics and they don’t phrase things in business terms.” The incentives lock it in. “Engineering is comped on getting product out the door quick, your internal audit team is comped on checking boxes to meet your compliance goals, and security is comped and sometimes penalized on a lack of incidents.”

McGladrey said that on a call with more than 100 CISOs, Fortune 500 and Global 1000 companies were building 2027 budget requests around “the things that they’ve learned to care about, which is your mean time to detect and your mean time to remediate.”

What’s next

Kurtz expects CrowdStrike to introduce another metric in its next report. But security teams don't need to wait for a new industry benchmark. They can already measure how long it takes to detect an intrusion, decide how to respond and contain it. They can also track how quickly they can revoke an agent’s access if it misbehaves, and how long it takes to close an exploitable vulnerability.

“Show how this work connects vulnerability management to business risk,” Cunningham said. He urged security teams to answer one question above all others: “If this single internet-facing application is compromised this afternoon, what will prevent that single foothold from becoming a larger incident down the road?”

Methodology: VentureBeat Intelligence fielded the VB Pulse survey in October 2026 and received 113 responses, of which 102 qualified. Respondents qualified if they work on AI at an organization with 100 or more employees, or consult for one as their main client with day-to-day or partial access to its AI systems. VentureBeat Intelligence surveys a self-selected group of VentureBeat readers and panel respondents.