A follow-up to my assume-breach post. If the burglar is already in the house, only two questions matter: how would you know, and how fast can you answer?
Start with the uncomfortable part. Only a machine is fast enough to catch a machine. CrowdStrike’s latest threat report clocks the average breakout at 29 minutes… the fastest at 27 seconds. A human working alerts in a queue is bringing a notepad to a gunfight. By the time the ticket opens, the intruder has taken its next thousand steps.
So agentic detection isn’t a nice-to-have tool. It’s core infrastructure. And it has to be trained on the right signature, because a machine intruder doesn’t look human. It looks like an inhuman volume of individually unremarkable actions… patient, tireless, never bored.
Now the harder half, where most programs quietly fail. Detection speed isn’t what limits your damage. Containment speed is. Seeing the intruder is worthless if approval to act waits for a signature Monday morning.
So pre-authorize the response now, while it’s calm. Give your defenses standing permission to isolate a compromised machine and revoke stolen credentials the moment the pattern shows. Yes, that will occasionally halt something legitimate. Trivial next to a weekend-long breach… and leadership should go on record accepting it, so nobody hesitates at 2am waiting for permission that was never granted.
This quarter, run one tabletop: an autonomous agent loose in your network on a Friday night. Who can authorize containment, and how fast? Rehearse it until the honest answer is measured in minutes.
Source: 2026 CrowdStrike Global Threat Report: AI Accelerates Adversaries and Reshapes the Attack Surface
Originally posted on LinkedIn.
RationalAI helps organizations turn ideas like this into results: AI strategy and advisory services. Previous article: Assume the Burglar Is Already in the House
