Assume autonomy: Why security teams need to rethink defence at machine speed | Computer Weekly

"For years, cyber security strategy has been built around a simple premise: attackers and defenders operate at roughly the same speed. Humans make decisions, tools assist, and processes are designed to give analysts time to detect, investigate, and respond. That assumption is now broken."

"Recent advances in AI are fundamentally changing how attacks are discovered and executed. In controlled testing, modern models are already capable of identifying vulnerabilities and generating working exploits with minimal human input. Autonomy is reshaping cyber security more fundamentally than any trend in recent memory."

"Many organisations are still misaligned. Many continue to operate under "assume breach" or "proactive security" models, both of which were designed for a human adversary. They assume there is time to validate, escalate and decide. In an environment where discovery, exploitation and lateral movement can be chained together autonomously, that delay becomes the weakness."

"The challenge is not just speed, but structure. Many organisations have invested heavily in tools, yet still lack a coherent operational picture. Data is fragmented, visibility is inconsistent, and the hardest parts of the environment remain the least understood: unmanaged devices, operational technology, and remote assets. This creates a dangerous gap between perceived control and actual exposure."

Cybersecurity strategy has relied on the idea that attackers and defenders operate at roughly the same speed, giving analysts time to detect, investigate, and respond. Advances in AI are changing attack discovery and execution, enabling models to identify vulnerabilities and generate working exploits with minimal human input. Many organizations remain misaligned by using assume-breach or proactive security models built for human adversaries, where delays allow validation, escalation, and decision-making. When discovery, exploitation, and lateral movement can be chained autonomously, delay becomes a weakness. The shift is conceptual: security architectures must be designed for autonomous action on both sides. Tool investment alone is insufficient when operational visibility is fragmented, especially across unmanaged devices, operational technology, and remote assets. Autonomy amplifies existing gaps, and insider threats extend beyond people to any trusted entity with permission, context, and agency. Without clear visibility, organizations cannot safely automate decisions, patch unseen systems, or enforce policy effectively.

Read at ComputerWeekly.com