Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More<\/em><\/p>\n\n\n\n Fifty-one seconds. That\u2019s all it takes for an attacker to breach and move laterally across your network, undetected, using stolen credentials to evade detection.<\/p>\n\n\n\n Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, explained to VentureBeat just how quickly intruders can escalate privileges and move laterally once they penetrate a system. \u201c[T]he next phase typically involves some form of lateral movement, and this is what we like to calculate as breakout time. In other words, from the initial access, how long does it take till they get into another system? The fastest breakout time we observed was 51 seconds. So these adversaries are getting faster, and this is something that makes the defender\u2019s job a lot harder,\u201d Meyers said.<\/p>\n\n\n\n AI is far and away an attacker\u2019s weapon of choice today. It\u2019s cheap, fast and versatile, enabling attackers to create vishing (voice phishing) and deepfake scams and launch social engineering attacks in a fraction of the time previous technologies could.<\/p>\n\n\n\n Vishing is out of control due in large part to attackers fine-turning their tradecraft with AI. CrowdStrike\u2019s 2025 Global Threat Report found that vishing exploded by 442% in 2024. It\u2019s the top initial access method attackers use to manipulate victims into revealing sensitive information, resetting credentials and granting remote access over the phone.<\/p>\n\n\n\n \u201cWe saw a 442% increase in voice-based phishing in 2024. This is social engineering, and this is indicative of the fact that adversaries are finding new ways to gain access because\u2026we\u2019re kind of in this new world where adversaries have to work a little bit harder or differently to avoid modern endpoint security tools,\u201d Meyers said.<\/p>\n\n\n\n Phishing, too, continues to be a threat. Meyers said, \u201cWe\u2019ve seen that with phishing emails, they have a higher click-through rate when it\u2019s AI-generated content, a 54% click-through rate, versus 12% when a human is behind it.\u201d<\/p>\n\n\n\n The Chinese Green Cicada network has used an AI-driven content generator to create and run 5,000+ fake accounts on social media to spread election disinformation. North Korea\u2019s FAMOUS CHOLLIMA adversary group is using generative AI to create fake LinkedIn profiles of IT job candidates with the goal of infiltrating global aerospace, defense, software and tech companies as remote employees.<\/p>\n\n\n\n A sure sign attackers\u2019 AI tradecraft is maturing fast is how successful they\u2019re being with identity-based attacks. Identity attacks are overtaking malware as the primary breach method.\u00a0Seventy-nine percent of attacks to gain initial access in 2024 were malware-free, relying instead on stolen credentials, AI-driven phishing and deepfake scams\u200b. One in three, or 35%, of cloud intrusions leveraged valid credentials\u200b last year.<\/p>\n\n\n\n \u201cAdversaries have figured out that one of the fastest ways to gain access to an environment is to steal legitimate credentials or to use social engineering. Bringing malware into the modern enterprise that has modern security tools on it is kind of like trying to bring a water bottle into the airport \u2014 TSA is probably going to catch you,\u201d explains Meyers.<\/p>\n\n\n\n \u201cWe found a gap in our ability to revoke legitimate identity session tokens at the resource side,\u201d Alex Philips, CIO at National Oilwell Varco (NOV), told VentureBeat in a recent interview. \u201cWe now have a startup company who is helping us create solutions for our most common resources where we would need to quickly revoke access. It isn\u2019t enough to just reset a password or disable an account. You have to revoke session tokens.\u201d<\/p>\n\n\n\n NOV is fighting back against attacks using a wide variety of techniques. Philips shared the following as essential for shutting down increasingly AI-driven attacks that rely on deception through vishing, stolen credentials and identities:\u00a0\u00a0\u00a0<\/p>\n\n\n\n 51-second breakouts are a symptom of a much larger and more severe identity and access management (IAM) weakness in organizations. Core to this breakdown in IAM security is assuming trust is enough to protect your business (it isn\u2019t). Authenticating every identity, session and request for resources is. Assuming your company has<\/em> been breached is the place to start.\u00a0<\/p>\n\n\n\n What follows are three lessons about about shutting down lightning-fast breaches, shared by Philips and validated by CrowdStrike\u2019s research showing these attacks are the new normal of weaponized AI:<\/p>\n\n\n\n Cut off attacks at the authentication layer first, before the breach spreads. <\/strong>Make stolen credentials and session tokens useless as fast as you can. That needs to start with identifying how to shorten token lifetimes and implement real-time revocation to stop attackers mid-movement.<\/p>\n\n\n\n Use AI-driven threat detection to spot attacks in real time.\u00a0<\/strong>AI and machine learning (ML) excel at anomaly detection across large datasets that they also train on over time. Identifying a potential breach or intrusion attempt and containing it in real time is the goal. AI and ML techniques continue to improve as the attack datasets they\u2019re trained on improve.<\/p>\n\n\n\n Unify endpoint, cloud and identity security to stop lateral movement. <\/strong>Core to zero trust is defining segmentation at the endpoint and network level in order to contain a breach within the segments\u2019 boundaries. The goal is to keep enterprise systems and infrastructure secure. By having them unified, lightning-quick attacks are contained and don\u2019t spread laterally across a network.<\/p>\n\n\n\n To win the AI war, attackers are weaponizing AI to launch lightning-quick attacks while at the same time creating vishing, deepfakes and social engineered campaigns to steal identities. Phillips\u2019 methods for stopping them, including employing AI-driven detection and instantly revoking tokens to kill stolen sessions before they spread, are proving effective.<\/p>\n\n\n\n At the center of Philips\u2019 and many other cybersecurity and IT leaders\u2019 strategies is the need for zero trust. Time and again, VentureBeat sees security leaders who succeed in battling back against machine-speed attacks are those championing least privileged access, network and endpoint segmentation, monitoring every transaction and request for resources, and continually verifying identities.<\/p>\n Daily insights on business use cases with VB Daily<\/strong><\/p>\n If you want to impress your boss, VB Daily has you covered. We give you the inside scoop on what companies are doing with generative AI, from regulatory shifts to practical deployments, so you can share insights for maximum ROI.<\/p>\n \n\t\t\t\t\tThanks for subscribing. Check out more VB newsletters here.\n\t\t\t\t<\/p>\n An error occured.<\/p>\n<\/p><\/div>\n
\n<\/div>Weaponized AI demanding an ever-greater need for speed<\/strong><\/h2>\n\n\n\n
CIOs, CISOs are finding new ways to fight back<\/strong><\/h2>\n\n\n\n
\n
\n
\n
Three core strategies for stopping lightning-fast breaches<\/strong><\/h2>\n\n\n\n
\n\n\n\n
\n
\n
\n\n\n\n
\n
\n
\n\n\n\n
\n
\n
\n
Using AI to block high-speed attacks<\/strong><\/h2>\n\n\n\n
![\"\"\/](\"https:\/\/venturebeat.com\/wp-content\/themes\/vb-news\/brand\/img\/vb-daily-phone.png\")
\n\t\t\t\t<\/div>\n<\/p><\/div>\n<\/div>\t\t\t<\/div>\r\n