The report shows that AI is now a clear force multiplier for threat actors. It doesn’t give them an “easy button,” but it does remove friction across the entire attack lifecycle.

Three shifts stand out:

• Faster exploitation of new vulnerabilities: Unit 42 research found that attackers start scanning for newly disclosed vulnerabilities within 15 minutes of a CVE being announced. Exploitation attempts often begin before many security teams have finished reading the advisory.
• Compressed time-to-exfiltration: In a simulated AI-assisted attack, time-to-exfiltration dropped to 25 minutes. Real-world data backs this up: the fastest 25% of intrusions reached data exfiltration in 72 minutes, down from 285 minutes the year before.
• Scale without more operators: AI-assisted workflows let attackers run reconnaissance and initial access attempts across hundreds of targets in parallel, then focus on the weakest ones. This is especially visible in ransomware operations, where AI is used for script generation, templating, and even extortion messaging.

AI is also improving attacker outcomes by:

• Enabling hyper-personalized social engineering using automated OSINT.
• Supporting synthetic identities and deepfake-enabled hiring fraud.
• Lowering the barrier to entry via malicious or jailbroken LLMs that help generate scripts and lures.

For defenders, this means the window between initial access and serious impact is shrinking. What happens in the first minutes after an intrusion now often determines whether an incident stays contained or becomes a full breach.

The report makes it clear that identity has effectively become the new perimeter. Instead of relying mainly on exploits, attackers increasingly just log in.

Key data points from Unit 42 investigations:

• Nearly 90% of investigations involved material identity weaknesses.
• 65% of initial access was driven by identity-based techniques.
• Identity-related social engineering accounted for 33% of initial access, including 22% from identity-focused phishing and 11% from other social engineering.
• Credential misuse and brute force made up another 21% (with 13% from previously compromised credentials and 8% from brute force).
• Identity policy and insider risk contributed 11%, including 3% from IAM misconfigurations and 8% from insider threats.

In practice, attackers are:

• Using stolen credentials, hijacked sessions, or mis-scoped privileges to log into VPNs, cloud portals, and SaaS apps.
• Bypassing MFA through session hijacking and MFA-focused social engineering.
• Abusing over-permissive roles and legacy grants to escalate privileges once inside.

The report also highlights that identity and vulnerability management are tightly linked. A leaked credential can create the same level of exposure as an unpatched internet-facing system. As organizations move deeper into cloud, SaaS, and AI, fragmented identity estates and expanding machine identities give attackers more paths to exploit.

The report emphasizes that most breaches are enabled by exposure, not attacker genius. In over 90% of incidents, preventable gaps like misconfigurations, inconsistent controls, and excessive identity trust materially enabled the intrusion.

Three priority areas stand out:

1. Reduce exposure across applications and browsers
   • Secure the broader application ecosystem, including third-party dependencies and SaaS integrations, since attackers increasingly misuse trusted connectivity.
   • Harden the browser, as nearly 48% of intrusions involved browser-based activity tied to everyday workflows like email, web access, and SaaS usage.
   • Automate external patching for critical CVEs on internet-facing assets to close the 24-hour exploitation window that AI-accelerated attackers now target.
2. Constrain impact through stronger identity and zero trust
   • Advance zero trust principles to limit lateral movement and reduce the blast radius of a single compromised identity.
   • Tighten IAM by removing excessive permissions and legacy grants. In one analysis of more than 680,000 cloud identities, 99% had excessive permissions, many unused for 60+ days.
   • Address both human and machine identities, including service accounts, API keys, and AI agents, which are often over-privileged and under-monitored.
3. Modernize detection and response for AI-era threats
   • Consolidate telemetry so the SOC can see activity across endpoints, networks, cloud, SaaS, and identity in one place. In 87% of intrusions, attackers operated across multiple attack surfaces.
   • Use AI-driven response to drive down mean time to detect and respond, and to contain threats before automated lateral movement takes hold.
   • Upgrade email defenses from signature-based filters to behavioral engines that spot anomalies in communication patterns, and adopt out-of-band verification for sensitive requests like wire transfers or credential resets.

The overarching message is that security is still solvable. By closing known gaps, reducing excessive trust, and enabling the SOC to operate at machine speed, organizations can better keep pace with AI-enabled adversaries.