Logo
Machine Speed

Author

Prof. Dr. Daniel Patrick Politze
Prof. Dr. Daniel Patrick Politze

Professor & Head INS , INS Institut für Netzwerke und Sicherheit - OST

Published on:

November 12, 2026

Share via:

Machine Speed

Machine Speed: Why Cyber Defense Is Becoming a Collective Effort

AI is tipping the balance toward attackers as long as defenders act alone. Solid basics and coordinated defense across organizational boundaries can restore that balance.

Machine Speed Is the New Normal

AI helps both sides: attackers with reconnaissance, exploit development, and social engineering; defenders with alert triage, threat hunting, and containment. What matters most is tempo. According to CrowdStrike, average eCrime breakout time in 2025 was 29 minutes, and the fastest case took just 27 seconds.

Sophos documents a campaign in which roughly a dozen AI agents wrote and tested exploit modules and evasion techniques within days. A human team would have needed weeks.

Asymmetry Is Growing

An attacker needs only one gap, while a defender usually has a far larger attack surface to protect. Failed attempts cost the attacker almost nothing, whereas a wrong call by the defender can disrupt operations. The attacker automates without regard for side effects or rules. The defender remains bound by availability requirements, change processes, liability, and regulation.

Defenders do know their own environment and own the telemetry. Even so, an attacker using AI will tend to have the edge over a defender using AI who fights alone.

Basics Buy Time

The basics must be in place: identity security with phishing-resistant MFA, exposure management, segmentation, around-the-clock detection and response, and tested, immutable backups. Their purpose goes beyond preventing attacks; they also buy time. Every hurdle slows lateral movement and creates the window needed to detect and stop an attack before it is too late.

Mutual Trust and Coordination Are the Biggest Lever

Attackers reuse infrastructure, tools, and TTPs, so every detected attack can become a sensor for everyone. Rapid exchange within an industry, a country, or an alliance helps detect attack paths earlier, avoids solving the same problem twice, and lowers overall risk for all. The prerequisite is trust, and it must be built long before a crisis.

Defense then becomes a joint operation. Parallelizing means several organizations take on subtasks at the same time: one assesses exploitability, another develops detection rules, a third tests the workaround. Synchronizing means triggering measures simultaneously, such as blocking attacker infrastructure across an entire sector. Distributing means drawing on specialist expertise where it is strongest and making the results available to all. Machine-readable formats together with AI as a force multiplier, bring this alliance up to machine speed.

CSCs Are a First Step

The sector-specific Cyber Security Centers, advanced by Switzerland's federal cybersecurity office (BACS) together with its partners, are a first step, covering sectors such as finance, healthcare, and energy. However, the potential is far greater. What is needed is machine-readable exchange in near real time, cross-sector links, shared playbooks and exercises, and pooled analysis capacity.

Conclusion

Attackers using AI will remain faster than any single organization. That does not mean they have to be faster than a well-coordinated collective.

Share via:

Read more