I have a multi-hundred-page playbook on how to be a CISO. Plans, programs, measurement mechanisms, policy structures across a variety of industry verticals. I use that book with AI to generate everything from risk registers and POAMs to SOC playbooks customized to the technology and people of a new enterprise. The words are mine, and the customizations are ours. Over the last three years, I have applied that same approach to developing skills and custom prompts that accelerate every facet of the protect, detect, respond, and recover functions of running a security program.
What, no agents? A guy has to have his secrets.
Some of the AI tools are outpacing my internal capabilities, but I keep finding the same pattern in the gaps. The pieces left unsolved by the vendors are exactly the ones I have trouble getting done because they are the hardest problems to solve. I have said many times that a particular tool is great but adds little value beyond restating the problem we already knew existed, without much in the way of actual help.
I have run incident response from a moving truck on day four of a new job. I have run incident response from a boat, more than once. I have run incident response and made high-stakes, unpopular decisions from a hotel bar. AI has its place in the augmentation role, and post-compromise is where it can really shine.
Threat Model
The previous chapters in this series covered AI-augmented reconnaissance and AI-powered detection evasion. Those are pre-intrusion and intrusion problems. What happens after initial access is a different operational challenge, and AI changes its economics in ways that break the assumptions defenders have relied on for two decades.
The traditional kill chain assumed a human attacker who had to think between each phase. After gaining initial access, the attacker would manually enumerate the internal network. They would read file share names and directory structures to identify high-value targets. They would probe Active Directory to map trust relationships and find the shortest path to domain admin. They would select and test exfiltration methods. They would pick locations for persistence mechanisms. Each of those steps required judgment calls, and each judgment call took time. Time to assess what they found, time to decide what to do next, time to test whether their next move would trip an alarm. That thinking time was structural to the attack, and defenders built their entire detection and response model around it.
An AI-augmented attacker compresses that structure. The post-compromise playbook can be scripted in advance: a decision tree that covers enumeration, target identification, privilege escalation, lateral movement, persistence, and exfiltration as a single automated sequence. The attacker feeds the AI a target profile before initial access is even achieved. What operating systems are likely present. What directory services to expect. What file share naming conventions suggest high-value data. What lateral movement techniques to prefer based on the EDR product most common in that industry vertical. The AI generates a post-compromise playbook that branches based on what it discovers at each step, and the attacker loads that playbook into an execution framework that runs without human intervention once initial access is established.
Anthropic’s June 2026 analysis of 832 banned accounts mapped to the MITRE ATT&CK framework found that threat actors are actively using AI in the later, more complex stages of cyber operations, including lateral movement, persistence, and credential access. Of those 832 actors, 54 used AI to assist with lateral movement specifically. One actor, designated GTG-1002, built a platform where the AI agent autonomously scanned networks, exploited vulnerabilities, stole credentials, and made tactical decisions with minimal human input. That operation scored a 100 on Anthropic’s risk methodology across 30 techniques and 13 tactics. A separate case, disclosed by Anthropic in August 2025 and tracked as GTG-2002, involved a single attacker who used Claude Code to run data extortion against at least 17 organizations in a short timeframe, with the AI scanning thousands of VPN endpoints, penetrating networks, harvesting credentials, and generating ransom notes.
CrowdStrike’s 2026 Global Threat Report puts hard numbers on the compression. Average eCrime breakout time, the interval between initial access and first lateral movement, dropped to 29 minutes in 2025. That is down from 48 minutes in 2024 and 98 minutes in 2021. The fastest observed breakout was 27 seconds. In one case, data exfiltration began four minutes after initial compromise. And 82% of detections in 2025 were malware-free, meaning the attacker used valid credentials, native administrative utilities, and commercial remote access tools rather than dropping detectable binaries.
The attacker who thinks between phases is becoming the attacker who thought before the first phase and executes the rest on autopilot. The constraints that still apply are real: the attacker still needs initial access, still generates network traffic, still touches endpoints, still creates authentication events. The physics of the network have not changed. But the operational tempo has, and that tempo change is the threat.
The target profile for this threat model is the same company that has appeared throughout this series: 500 to 1500 employees, one to three security staff, standard commercial EDR, a SIEM that somebody looks at during business hours, flat or lightly segmented networks, and Active Directory that was set up by the last IT director and has not been meaningfully restructured since. These companies are not running 24/7 SOCs. They are running EDR with an alert queue that someone checks in the morning.
Traditional Tools
The standard defensive stack for post-compromise detection at a company this size includes several layers, each designed to catch attackers at a different phase of internal movement.
EDR sits on every managed endpoint and watches for suspicious process behavior, known attack patterns, and anomalous system calls. Products like CrowdStrike Falcon, SentinelOne, and Microsoft Defender for Endpoint can detect many lateral movement techniques: pass-the-hash, pass-the-ticket, suspicious use of PsExec or WMI, and abnormal PowerShell execution. Some EDR products can automatically isolate an endpoint when a detection fires. SentinelOne’s ActiveEDR does this autonomously. CrowdStrike’s Real Time Response requires analyst initiation for rollback actions. The capability exists, but the workflow to trigger it varies between products and between how each organization configures them.
The SIEM aggregates logs from endpoints, firewalls, authentication systems, and network devices. Correlation rules look for patterns that indicate lateral movement: multiple failed authentications followed by a success, service account usage at unusual hours, RDP sessions between workstations that have never communicated before. The SIEM generates alerts when correlation rules fire. Those alerts go into a queue. Someone has to read the queue.
Network segmentation limits what an attacker can reach from a compromised endpoint. VLANs, firewall rules between segments, and access control lists restrict traffic flow. A well-segmented network forces the attacker to cross chokepoints where their traffic can be inspected. The problem is that most networks in this size range are not well segmented. They were built for convenience, expanded as the company grew, and segmentation was added after the fact in places where compliance required it. The HR segment might be isolated. The PCI cardholder data environment might be walled off. Everything else is likely flat or close to it.
Identity and access management controls include Active Directory group policies, privileged access management tools if the company has invested in one, and MFA on some or all accounts. These controls limit what credentials can do and where they can be used. Tiered administration, where domain admin credentials are restricted to domain controllers and never used on workstations, is the textbook defense against credential theft during lateral movement. Most companies this size have not implemented tiered administration. Many have not even audited what service accounts exist, what privileges they hold, or what systems they authenticate to.
SOAR platforms, where deployed, automate incident response workflows. They can chain together actions across tools: enrich an alert with threat intelligence, check whether the affected user’s credentials were in a recent breach, isolate the endpoint, disable the account, and open a ticket. The limitation is that SOAR workflows are only as good as the playbooks someone wrote, and those playbooks assume a particular sequence of events at a particular speed.
Each of these tools works. EDR catches lateral movement techniques. SIEMs correlate suspicious authentication patterns. Segmentation limits blast radius. Identity controls restrict credential abuse. SOAR automates response steps. A CISO who deployed all of them five years ago built a reasonable program. The question is what those tools assumed about the attacker they were designed to stop.
The Gap
Every tool in that stack relies on a single operational constraint: the attacker pauses between phases.
EDR detects lateral movement techniques and generates alerts. The alert goes into a queue. An analyst reviews the alert, assesses whether it is a true positive, decides on a response action, and executes that action. The workflow assumes that the time between the detection firing and the analyst responding is shorter than the time between the attacker’s first lateral movement and their arrival at the objective. That assumption held when attackers spent hours or days moving through a network. When the entire post-compromise sequence executes in minutes, the alert fires and goes into the same queue, but the attacker has already reached domain admin, staged exfiltration, and established persistence before the analyst opens the ticket.
CrowdStrike’s own data illustrates the math. Average breakout time is 29 minutes. Assume the EDR fires an alert at the first lateral movement attempt, which is generous since many techniques using valid credentials and native tools do not trigger alerts at all. The analyst needs to see the alert, assess context, determine it is a true positive, and decide on a containment action. For a company with a dedicated SOC analyst sitting at the console during business hours, that takes, in my experience, 10 to 15 minutes if the analyst is experienced and the alert provides good context. For a company where the SOC analyst is also the sysadmin who is currently on a call with a printer vendor, it takes longer. For a company that relies on a managed security service provider, the MSSP’s SLA for critical alerts, in the contracts I have seen, typically runs 15 to 30 minutes. By the time anyone is looking at the alert, the attacker’s scripted playbook has already run to completion.
The SIEM has the same timing problem. Correlation rules fire when they accumulate enough matching events. A rule that looks for five failed authentications followed by a success within 10 minutes was designed for a human attacker who tries credentials manually. An AI-scripted attack might generate those same events in 30 seconds, fire the correlation rule, and generate an alert that arrives in the queue alongside the EDR alert, both waiting for the same analyst who is on the same phone call.
Network segmentation constrains movement but does not stop it when the attacker has valid credentials for systems in the target segment. If the attacker’s pre-scripted playbook includes enumerating segment boundaries and selecting credentials or tokens appropriate for each segment, segmentation becomes a speed bump rather than a wall. A human attacker hitting a segment boundary would stop, probe, think about options, and try something. That pause was where segmentation created detection opportunity. An AI-scripted sequence probes, selects the appropriate credential from what it has already harvested, and crosses the boundary in the same automated pass.
SOAR playbooks execute at machine speed, which should help. But they execute pre-written sequences triggered by specific alert types. If the playbook says “when EDR fires a lateral movement alert, isolate the source endpoint,” it will isolate the endpoint where the lateral movement started. If the attacker’s scripted sequence has already moved to three more endpoints by the time the SOAR playbook fires, the isolation contains the wrong machine. The SOAR playbook ran as designed, but the containment action arrived too late because the playbook was written for an attacker who moved at human speed.
Identity controls face the same compression. Credential revocation procedures assume a human operator deciding which accounts to disable based on an investigation that determines what was compromised. An AI-scripted attacker harvests credentials from the first compromised endpoint, uses them on the next three systems simultaneously, harvests new credentials from each, and fans out across the network in a branching pattern that creates more compromised accounts faster than a human investigator can identify them.
The constraint was never stated explicitly in any vendor documentation or security framework. Nobody wrote “this tool assumes the attacker takes at least 30 minutes between compromise stages.” But that assumption was baked into every workflow, every SLA, every playbook, and every staffing model, and AI has removed it.
AI Augmentation
The augmentation for this threat is a real-time correlation engine that can trigger automated containment without waiting for human triage. It is a layer built on top of the EDR, SIEM, and identity infrastructure that already exists, using AI to compress the defensive decision loop to match the compressed attack loop.
The core problem is that individual alerts do not carry enough weight to trigger automated containment. An EDR alert for suspicious PowerShell execution could be an attacker or could be the sysadmin running a legitimate maintenance script. A SIEM correlation for unusual RDP traffic could be lateral movement or could be someone troubleshooting a server from the wrong workstation. Each alert in isolation has a false positive rate high enough that auto-containment would disrupt business operations.
The augmentation changes the math by correlating across sources in a compressed time window. Build a script, or use AI to help you build one, that consumes the alert feeds from your EDR, your SIEM, your identity provider, and your firewall logs into a single correlation layer. The AI component evaluates incoming alerts not individually but as a temporal cluster. Its job is to answer one question: in the last five minutes, has this environment generated a combination of signals that, taken together, indicate post-compromise lateral movement?
Those signals include: a new authentication from a machine or account that has not authenticated to that destination before, within two minutes of an EDR behavioral alert on the source machine. An SMB or RDP connection between two workstations in a segment where workstation-to-workstation traffic is not normal. A service account authenticating interactively. Multiple accounts authenticating from the same source IP within a narrow window. File share enumeration from a system that does not normally browse file shares. LDAP queries against Active Directory that match reconnaissance patterns, like enumerating domain admins or trust relationships, from a workstation.
None of those signals alone justifies automated containment. Three of them within five minutes from related systems justifies isolating the source endpoints, disabling the involved accounts, and paging the analyst with a pre-enriched incident package. The AI component does fast pattern matching across data sources that currently sit in separate consoles, applying a threshold that a human analyst would apply if they could see all the data simultaneously and react in under a minute.
The implementation uses what you already have. Your EDR has an API. CrowdStrike, SentinelOne, and Defender all expose alert feeds, endpoint metadata, and containment actions through REST APIs. Your SIEM has a log ingestion pipeline. Your identity provider, whether Microsoft Entra ID, Okta, or on-premises Active Directory, logs authentication events. A Python service running on a small VM or container pulls alerts from the EDR API on a polling loop or webhook, pulls authentication events from the identity provider, and pulls firewall connection logs from the SIEM or directly from the syslog stream. The AI layer processes each incoming event, maintains a sliding five-minute window of recent events, and evaluates whether the current cluster crosses the containment threshold.
When the threshold is crossed, the service calls the EDR API to isolate the identified endpoints. It calls the identity provider API to disable the compromised accounts or revoke their sessions. It sends a high-priority alert to the on-call analyst with a structured summary: which endpoints were isolated, which accounts were disabled, what alerts triggered the action, and a timeline of the correlated events. The analyst’s job is no longer “detect and decide.” It is “review and release.” The containment already happened. The analyst determines whether it was correct, restores access if it was a false positive, and investigates the scope if it was real.
For network segmentation response, the same correlation engine can trigger dynamic firewall rules. If the correlated signals indicate lateral movement across a segment boundary, the service pushes a temporary deny rule to the firewall that blocks all traffic from the compromised segment to the target segment except for pre-approved management traffic. This is more aggressive than endpoint isolation and carries higher business disruption risk. Implement it as a second tier that requires a higher correlation score or a specific combination of signals, like credential harvesting evidence combined with cross-segment authentication, rather than the same threshold as endpoint isolation.
The dependency risk is real and has to be addressed. If this correlation engine fails, either through a bug, a misconfiguration, or an adversary deliberately disrupting it, the defender reverts to the traditional workflow. The manual fallback is the existing alert queue, the existing SOAR playbooks, and the existing analyst triage process. That process is too slow for an AI-accelerated attack, which is why the augmentation exists, but it is better than nothing and it is what you already know how to do. Build the correlation engine so that its health is monitored by the same infrastructure that monitors everything else. If the service goes down, a heartbeat alert fires and the on-call analyst knows they need to watch the alert queue actively rather than relying on auto-containment.
An adversary who knows this engine exists could attempt to trigger it deliberately to cause business disruption. Flooding the environment with signals that mimic lateral movement, causing the engine to isolate legitimate endpoints and disable legitimate accounts, is a denial of service attack through your own defenses. The counter is a rate limiter on containment actions. If the engine attempts to isolate more than a threshold number of endpoints within a single window, say more than five in 10 minutes, it stops auto-containing and escalates to the analyst with a flag that the pattern may be adversary-induced disruption rather than actual lateral movement. The analyst makes the judgment call. The engine does not try to be smarter than the adversary across every possible scenario. It handles the common case fast and escalates the adversarial edge cases to a human.
Credential revocation creates its own cascading effects. Disabling an account that turns out to be a service account running a production application causes an outage. Before enabling automated credential revocation, build an inventory of which accounts are service accounts, what systems they support, and what the impact of disabling them would be. Exclude service accounts from automated disabling and handle them through a separate, analyst-reviewed workflow. This is not ideal from a pure security perspective, but it is honest about the operational tradeoffs. An organization that has never inventoried its service accounts is not ready for automated credential revocation. Doing the inventory is the prerequisite, and it has value independent of this augmentation.
The prototype path for a small team: start with a read-only version. Build the correlation engine, feed it your alert data, and have it generate alerts with containment recommendations but not execute them automatically. Run it for two weeks. Measure the false positive rate. Tune the correlation thresholds based on what your environment actually looks like. A healthcare organization with 24/7 nursing stations will have a different baseline for off-hours authentication than a manufacturing company where nobody should be logging in after 6 PM. After tuning, enable auto-containment for endpoint isolation first, since it is the most reversible action. Add credential revocation after the service account inventory is complete. Add segment lockdown last, since it carries the highest business impact.
This is not a perfect defense. A well-funded attacker who knows your environment, knows your detection capabilities, and specifically targets your correlation engine can beat it. But that attacker is spending significant resources on a targeted campaign against one organization. The augmentation is designed for the more common threat: automated post-compromise playbooks that compress the kill chain against hundreds of targets simultaneously, where speed is the adversary’s primary advantage and matching that speed is the defender’s primary need.
Works Cited
Anthropic. (2025, August). Threat intelligence report: August 2025. https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf
Anthropic. (2026, June 3). LLM ATT&CK navigator: A year of AI-enabled cyber threats. https://www.anthropic.com/research/attack-navigator
CrowdStrike. (2022, September 13). CrowdStrike’s annual threat hunting report reveals one potential intrusion is identified every seven minutes [Press release; cites 2022 GTR breakout time]. https://www.crowdstrike.com/en-us/press-releases/crowdstrike-annual-threat-hunting-report-reveals-one-potential-intrusion-is-identified-every-seven-minutes/
CrowdStrike. (2026, February 24). 2026 CrowdStrike Global Threat Report: AI accelerates adversaries and reshapes the attack surface [Press release]. https://www.crowdstrike.com/en-us/press-releases/2026-crowdstrike-global-threat-report/
About the Author
