Symantec Warns AI Era Demands Cybersecurity Shift to Mitigation

Organisations can no longer rely on patching to secure their systems in the age of artificial intelligence, according to Dick O’Brien, principal intelligence analyst at Symantec. Instead, security teams must pivot to post-exploitation mitigation strategies, embracing an “assume exploit” mindset.

Speaking at the IRISSCON 2026 conference in Dublin, O’Brien highlighted the rapid closure of the vulnerability patch window over the past year. This acceleration is largely attributed to threat actors leveraging AI tools for zero-day flaw discovery and frontier AI models chaining together low-severity vulnerabilities to uncover complex exploit paths that humans might miss.

The Shrinking Vulnerability Window

Data from the Zero Day Clock initiative indicates a dramatic decrease in the average time-to-exploit (TTE) following public disclosure of a vulnerability. The average TTE fell from one week in 2025 to just one day in 2026. Projections suggest this could shrink further to a mere minute by 2027.

“Once you get to a minute, what can you do realistically? We need to start thinking beyond patching to address vulnerabilities,” O’Brien stressed.

An example of this speed was the PHP2Shell vulnerability disclosed in October 2026, which saw exploitation attempts within 19 minutes of its public release. Intriguingly, Amazon reported detecting attempted exploitation of PHP2Shell four days prior to its public disclosure, underscoring the advanced capabilities of threat actors.

The increasing role of AI in discovering and exploiting flaws has been a growing concern across the industry. Privacy Needle has previously explored how AI-powered vulnerability discovery changes the threat landscape.

Rise of Agentic AI Attacks

Beyond rapid exploitation, O’Brien anticipates a shift towards “end-to-end agentic orchestration of attacks” within the next year. This marks a move from AI assisting human attackers to AI agents independently conducting attacks, operating at machine speed and making detection and response significantly harder for defenders.

One such instance occurred in September 2026, when an attack on the Dutch Institute of Vulnerability Disclosure (DIVD) saw AI agents autonomously execute post-compromise tasks. Symantec’s analysis of DIVD’s assessment report revealed detection within 19 minutes, but the response only began 19 hours later, with containment taking an additional nine hours. This totals over 24 hours to address an attack moving at machine speed, a timeframe O’Brien described as unsustainable.

Adopting an ‘Assume Exploit’ Mindset

Given this evolving threat landscape, organisations must assume exploitation is inevitable and prepare for machine-speed post-compromise activity, where attackers can move from initial access to impact in minutes. O’Brien advised security teams to “Stop measuring your mean time to patch and start measuring your mean time to mitigate.”

He outlined several immediate mitigation tasks:

• Behaviour blocking
• Default-deny for what runs
• Least privilege for every agent and token
• Inspect data before it leaves the device
• Bind every agent action to a named human

“These are all things you can start doing right now before you become aware of a vulnerability,” O’Brien added. Longer-term, organisations must integrate advanced detection and protection technologies across multiple control points capable of identifying anomalous behaviours of rogue or malicious AI agents.