The 18 Hour Attack

Security teams used to have something on their side: symmetry. It used to be that attacks took days, weeks, or months. Why was that the case? An attacker was still, at the end of the day, human. They had lives and families. They went to the gym, they ate meals, and they did things for fun. The point being, attackers were like the good guys…fundamentally inefficient, moving at human speed.

For better or for worse, attackers and defenders are no longer symmetric, largely due to the adoption of AI. Bain estimates that typical AI-powered attacks take 18 hours, versus 4 weeks in the "before time".

Source: Bain & Company.

When a16z recently published their New Security Agenda, the top worry from executives for 2027 was AI-powered attacks outpacing their team's ability to respond. Everybody knows that the speed and scale of AI have changed the once symmetric relationship between attackers and defenders.

• Frontier models are able to find vulnerabilities at a scale that is unprecedented
• AI in the hands of bad actors allows attacks to happen at machine speed, instead of at human speed

To boot, companies are fundamentally going to move slower than individuals (especially attackers) when it comes to adopting new technologies. Even though 55% of leaders in the a16z report cite AI-speed attacks as their #1 concern, the same report showed only 18% have adopted an AI SOC capability, and only 9% AI-powered detection engineering & threat hunting.

The defender's clock must change

In the old world of 4 week attacks, alert triage and investigation could be the crown jewel of a security team. It was reasonable to expect that you could catch and respond to most breaches before they became catastrophic. In that old world, teams focused on MTTR and invested heavily in human-led activity…that's just the way the world worked.

Now, AI-powered attacks make response only a piece of the puzzle. Where the clock used to start on the alert, we think the clock must now start much, much earlier.

SecOps in a world of AI

In a world of AI-powered attacks, the moment a new technique shows up in the wild is the new gold standard for action. If nothing in your environment is built to see that technique, there's no alert to triage, fast or slow. Security teams must now measure themselves on 1) finding threats (not alerts of threats in your environment), and 2) turning those threats into working detections.

To be clear, MTTR still matters. A great response team is still a great response team…but response matters less (relatively) than ever before.

Here's what matters today:

1. Time to find a gap. How long until you know that a threat that matters to you isn't covered?
2. Time to close a gap. Once you know, how long until a working, tested detection is live?
3. Time to cover a new threat. When a new technique drops, how long until you can see it in your environment?

For most programs, all three are currently measured in months. In our work with security teams, authoring a new detection took 121 days on average before they started working with Spectrum. Do the math on that one: 121 days is about 2,900 hours. An attacker could run an 18-hour playbook more than 160 times before that detection goes live.

A real example: PHP-to-shell

Let's take PHP2Shell, the hottest new hotness. It's a classic AI-discovered vulnerability example: old code, new attack, machine speed.

When this threat surfaced, Spectrum took it from "we've seen this" to a working detection in a customer's environment in 15 minutes. Then it looked back through the data the customer already had, and found 3 hits that were already sitting there.

On the old clock, that detection lands months later. Those 3 hits sit there the whole time, and since no alert ever fires, there's nothing for even the fastest SOC to triage.

How to think about SecOps now

None of this means you should stop investing in response. Triage and investigation still matter, and an AI SOC can be a real help to a team that's drowning in alerts. They come later in the story.

If speed is your #1 worry (and for 55% of CISOs, it is), the place to win it is before an alert fires: that's where you are susceptible to being beaten today.

So what does winning before the alert actually look like?

• A focus on detection engineering, and what goes into that: using SIEM data as a strategic tool to sharpen your detection quality.
• Better quality coverage, so that when your SOC team does need to triage they aren't drowning in low-quality noise.
• Adopting AI aggressively, to win against the bad guys. How can you leverage AI tooling to get ahead of the 18 hour attack?

In the meantime, here's one question to bring to your next team meeting:

If a new technique dropped this morning, when could we see it?

If the honest answer is "in a few weeks," you've found where your speed problem actually lives.

Stay tuned for more in our 4-part series on the a16z New Security Agenda.

---

Survey stats: a16z CISO Survey, N=100, organizations with 1,000+ employees, 10/18/2026. Attack timing: Bain & Company, cited by a16z.