AI-Driven Autonomous Cyber Defenses

Attackers got faster. In November 2025, Anthropic published a report on what it described as the first reported AI-orchestrated cyber espionage campaign. A state-sponsored group used an AI coding agent to run roughly 80 to 90 percent of the campaign's tactical work against about 30 targets, with humans stepping in at only a handful of decision points. It sometimes hallucinated credentials, but it worked at a pace no human team can match. We broke down a similar pattern in how an AI agent can run a five-day cyberattack.

Defenders are still slow on the basics. The 2026 Verizon DBIR found exploitation of vulnerabilities was the most common initial access vector, at 31 percent of breaches in its dataset, up from 20 percent the year before. Among organizations in its vulnerability dataset, only 26 percent of known exploited vulnerabilities were fully remediated, and the median time to full resolution rose to 43 days.

That is the gap autonomous tooling is meant to close: attackers who move in minutes, defenders who move in weeks. IBM's Cost of a Data Breach Report 2026 found that organizations using AI and automation in security operations cut their breach costs by an average of $1.93 million, against a record global average of $4.99 million. That is a correlation, not a promise, but it is the strongest public number for automating response.

Vendors describe autonomy as a dial. I find three plain levels more useful, because each maps to a different risk owner.

The tool investigates, enriches the alert, maps it to a technique such as MITRE ATT&CK T1078 Valid Accounts, and suggests a response. A human decides and acts. The risk of a wrong recommendation is a few wasted minutes.

The tool prepares the action, for example "disable this service account and rotate its keys", and waits for a named person to approve it in Slack, Teams or the console. The work is already done; the human is the brake. For a small team, most real time savings sit here.

The tool acts immediately and tells you afterward. It suits only actions that are narrow, reversible and cheap to get wrong.

One short rule covers most decisions. If you cannot undo it in five minutes, a machine should not do it alone.

Here is the table I use with clients. Many vendors will dispute the bottom rows, because "full autonomy" is how they sell. For a company without a 24/7 SOC, I think they are wrong.

The machine gets high-volume, low-consequence work. Humans keep identity at scale, production availability, data and the outside world. This lines up with the defensive tactics in MITRE D3FEND: "Detect" and narrow "Isolate" steps automate well; broad "Evict" and "Restore" steps carry the most collateral damage.

Every autonomous action needs an off switch and an undo button, written down before go-live. Across our assessments, this is the step most teams skip.

A workable minimum looks like this:

The rate limit matters because an attacker can flood the tool with fake signals so it isolates your own systems. A cap turns that outage into an alert.

Fold all of this into your incident response plan rather than writing a separate document. NIST's SP 800-61 Revision 3, published in April 2025, ties incident response to the CSF 2.0 functions, which is a good frame for showing where automated containment sits. If your plan is still a draft, start with our incident response guide for small businesses.

This is the section vendors leave out.

Nor does it replace judgment. It cannot tell you whether you have a reportable breach under Canadian or US law, or what to tell your board. That is why we pair automation with human-AI security teams rather than treating it as a replacement.

Autonomous defense is a layer on top of a working program. It is not a substitute for one.

If you do not yet have central logging, MFA on every admin path, an inventoried and patched estate, and an incident response plan you have rehearsed at least once, the tool will have weak signal to learn from and plenty of noise to act on. You will spend your time tuning false positives instead of stopping attackers. A cybersecurity baseline assessment is the faster first step.

It is also premature for a single environment with low change volume, where managed detection and response plus native cloud controls cover you with less effort. And if nobody can own oversight of the tool, skip Level 3. An unattended autonomous system is an outage risk, not a defense.

This is the order of operations I would follow for a 30 to 200 person SaaS company.

By day 90 you should be able to answer, in one page, which actions your tooling takes alone, who approves the rest, and how you turn it all off. That page carries a lot of weight in SOC 2 and ISO 27001 conversations, and our process, risk and controls work usually starts there.

A vendor configures the product. It will not set your risk appetite or own the autonomy policy. That is the gap a virtual CISO fills. Our engagements start from $2,000 a month; the full tiers are on our pricing page. If the tool you are evaluating is itself AI-driven, our AI governance practice can fold it into your wider AI risk register.

Yes. Attackers can feed it misleading signals to trigger disruptive actions against your own systems, or blend in so it never fires. Rate limits, allow lists and human approval for high-impact actions are the main controls.

Auditors want documented, consistently applied controls with evidence. An autonomy policy, an action log and a tested rollback give them that.

Ask three questions: Can we undo it in five minutes? Does a wrong call affect one person or many customers? Will we see every action in a log we review? Three good answers means it is a candidate for Level 3.

If you want a second opinion on where your line should sit, book a consultation and we will review the autonomy settings you already own.