Inside the Breaches AI Is Already Shaping

What our own breach investigations show about speed, persistence, and a response industry under strain.

AI's role in cyberattacks is no longer a prediction. The major threat reports now say so plainly. But most of the conversation still looks forward, to fully autonomous attacks and what arrives next year. Far less attention goes to what AI-assisted attacks are already doing inside real breaches today, including how fast they move, how much they leave behind, and how quickly they are outrunning the people who have to clean them up.

MOXFIVE investigates breaches every day, so we went back through our own recent forensic investigations to measure it. The picture is not subtle.

What an AI-assisted intrusion looks like

In a recent cloud intrusion, the attacker's first attempt to run code in the victim's environment failed. Thirty seconds later, a new version ran, reworked around the exact error the first attempt returned. That cycle repeated throughout the intrusion. No human operator reads an error, works out a fix, and tries again in half a minute, over and over, for the length of an attack. That is what it looks like when an attacker has a model doing the work.

The rest of the intrusion moved at the same pace. The attacker worked through the cloud secrets store, chained one service account into the next, copied a large share of the company's source code, ran up significant charges on the victim's own AI infrastructure, and built layer after layer of persistence to protect their access. One of our responders noted that this level of cloud fluency is something we used to see only from the most capable state-backed groups.

Raw speed stands out, but it is only part of the picture. The bigger shift is how quickly attackers adjust. When something blocks them, the next attempt arrives already changed. They change course, test multiple paths of attack, and execute the one that works, at times within seconds. No human reasons through an unfamiliar environment that quickly. A model can.

In the fourth quarter of 2025, about one in six of our investigations showed clear evidence of machine-speed attacker activity, such as attacks that changed within seconds of being blocked, bursts of cloud API calls, or actions spreading across systems faster than a human could operate. By the third quarter of 2026, it was more than six in ten.

Speed changes the outcome, and nowhere more than in the cloud. Ransomware operators have gotten faster too, often reaching encryption within hours in our recent cases. But they still have to move through a network and exfiltrate before they encrypt, and that takes time. Machine-speed cloud intrusions don't wait. In the third quarter of 2026, the median time from an attacker's first activity to real impact in those cases was about two hours, and more than four in ten reached impact within the first hour. By the time most organizations have confirmed an alert is real, the damage is already done.

The first twenty minutes of five cloud intrusions we investigated over the past few months show what that looks like in practice.

The barrier to entry has collapsed

Cloud intrusions are not new. Part of our own team came from modePUSH, a firm built around investigating cloud-native attacks against the control planes of providers like AWS, Azure, and Google Cloud, which MOXFIVE acquired in 2025. But across the industry, cloud cases used to be a small share of the breaches responders handled, and they were largely the work of well-known groups such as Scattered Spider and ShinyHunters, who understood identity providers, cloud consoles, and developer tooling well enough to live inside them.

That scarcity no longer holds. Abliterated models, open-weight AI models with their ability to refuse surgically removed, now let far less experienced actors read an unfamiliar environment, write working tooling on the fly, and adapt the moment something blocks them. Abliterated copies of the most capable open-weight model released this year were public within days, and they run on hardware no one else can see. An attacker no longer needs to know how a cloud platform works. They need a model that does.

Our caseload shows the result. Two years ago, cloud cases were a small share of our investigations, not the main focus. In the third quarter of 2026, more than half of our investigations centered on the cloud. That is not because ransomware went away. We handle more ransomware cases today than we did two years ago. Cloud attacks grew faster and now make up a larger share of the work. Attackers shift between methods constantly, and ransomware could take the lead again at any time.

What has changed is who can operate in the cloud. Ransomware crews that once worked only inside on-premises networks now move into cloud control planes too. And the speed and breadth that used to take an organized group like Scattered Spider can now come from a single attacker with the right model.

AI breaches can call for a nation-state playbook

Our recent cloud cases leave behind more persistence, and more kinds of it, than we have seen before. In the third quarter of 2026, we handled intrusions with hundreds of separate persistence mechanisms, spread across nearly every layer of the cloud, from identity and access policies to code pipelines, container registries, serverless automation, and the integrations that connect them. Some carry more weight than others. An attacker who can change the code behind an application you host in the cloud doesn't need to hold the door open. Your own pipeline ships their access for them on the next deploy.

And it doesn't hold still. With a model doing the work, an attacker can replace whatever responders close. Close one kind, and a new kind can appear somewhere else in the environment in as little as a minute, and usually within the hour.

Endpoint response has well-worn containment models. Isolate a single host, or for a large event, cut the entire network off at the internet edge and pinhole only the response tools back in. Either way, responders control the boundary and clean up at their own pace. Those options aren't as readily available in the cloud. You can still isolate a virtual machine, but much of the environment runs through identities and APIs that no network cutoff reaches, workloads appear and disappear in seconds, and the business runs on the same identities and pipelines the attacker is using. Shutting it all down can do as much damage as the attacker. So responders close what they find, the attacker opens something new, and the incident turns into a game of whack-a-mole.

Depending on the circumstances, we have sometimes had to take an approach similar to the one used against nation-state intruders. Rather than closing each door as we find it, we watch the attacker's activity, map every path they hold, and remove it all at once. It is counterintuitive, because it means leaving a known attacker active while the mapping happens, and it carries real cost in the most complex environments. But closing doors one at a time against an attacker who replaces them as fast as you close them is a contest responders lose.

The industry is on track to run low on responders

Breach response has usually had a seasonality to it. Firms staff for predictable surges and the quieter stretches in between. This year, the surge didn't wait for the season. By June, requests for forensic investigation had already passed last year's busiest month, and by September they were 50 percent above it. We expect the usual seasonal rise to push them higher still.

That influx is hitting every firm that does this work, and it lands on a narrow group. These aren't alerts to triage. They are breaches where the attacker is already inside, and the work falls to a small pool of experienced responders, and a smaller group still with deep cloud expertise. The early signs are already showing. Queues are starting to form, and organizations can wait longer for an investigation to begin. That has changed the role of incident response retainers. Larger, better-prepared organizations have always kept them. But over the past several years, many others let them lapse, because response services were easy to get, often arranged through a cyber insurance carrier after the fact. With this influx, a retainer arranged in advance is sometimes the only way to the front of the line.

AI has changed what a single responder can do. Since early 2025 we have built our own investigation platform, and today it handles much of the work that once consumed a responder's hours. Investigations move far faster, and each responder can carry many more of them at once. What the AI cannot do is run unsupervised. An experienced responder stays with every investigation, keeping it on course and confirming its findings before anyone acts on it. That oversight is the limit we run into now. We are building toward fully autonomous breach investigation and expect to lift much of it, but today every investigation still ends with a person signing off.

Even so, AI doesn't close the gap across the industry. Many response teams have yet to adopt it in earnest, the pool of cloud expertise hasn't grown to match demand, and offense still has the easier job. An attacker needs one path to work, and a model can try hundreds until one does. A defender has to find malicious behavior inside enormous volumes of legitimate activity, and act without breaking the business.

Do-it-yourself AI investigations are producing wrong answers

Some organizations are trying to work around the shortage by pointing AI tools at their own incidents. The instinct isn't wrong, and we use these tools ourselves. But the analyses we are handed often get the story wrong. One client's AI-written report counted duplicate log entries as separate events and overstated the activity roughly tenfold. In another case, an AI-generated alert summary told a client an attacker had stolen data from a financial platform and a mailbox. The actual evidence was a single denied sign-in, and the company went into crisis mode over an incident that never happened.

‍

Remediation is where do-it-yourself goes most wrong, with or without AI. We have seen internal teams reset an identity provider and consider an account contained while a connected application session stayed alive and data kept leaving for weeks. We have seen an internal review declare an environment clean, only for the same stolen tokens to return months later.

The missing piece is experience. Once you have seen enough attacks, you know which artifacts matter, how an intrusion unfolds, and what it takes to get an attacker out. An AI tool without that grounding produces a confident, plausible story, and acting on the wrong story either sends a team chasing a threat that isn't there or leaves the real one in place.

The red light

Breaches were already common, and they are becoming more common, at a pace the response industry is not yet staffed to absorb. Attacks are faster, reach deeper into the cloud, and leave more behind. The gap between how many organizations need help and how many experienced responders exist is widening, and the busiest season hasn't arrived yet.

That should have red lights flashing across the industry, from security vendors to insurers to the organizations that will one day need a responder and find a line where there didn't used to be one. The AI-shaped breach isn't on its way. It's already in the logs.

‍