Organizations Must Rethink Cybersecurity Approaches in the Age of AI, Expert Urges at IRISSCON 2026
In a stirring address at the IRISSCON 2026 conference held in Dublin, Ireland, on November 11, Dick O’Brien, the principal intelligence analyst at Symantec, made a compelling case for organizations to shift their cybersecurity strategies in light of rapidly evolving artificial intelligence (AI) threats. O’Brien asserted that merely applying patches to vulnerabilities is no longer a viable solution, urging companies to concentrate on mitigation strategies after exploitations occur.
O’Brien’s remarks underscore a troubling trend: the window of opportunity for attackers to exploit vulnerabilities has dramatically narrowed over the past year. With the advent of advanced AI tools capable of identifying zero-day vulnerabilities, these attackers now have an unprecedented ability to chain together lower-severity vulnerabilities to construct exploit paths that human hackers could scarcely emulate. This alarming evolution emphasizes the shift in tactics that defenders will need to address.
To bolster his argument, O’Brien referenced the Zero Day Clock, which offers live data tracking the diminishing time-to-exploit (TTE) window following the public disclosure of vulnerabilities. According to the initiative’s estimates, this crucial timeframe has fallen sharply from one week in 2025 to a mere single day in 2026. Alarmingly, projections for 2027 suggest that the average time to exploitation could dwindle to just one minute. “Once you reach a minute, one must ask: what can realistically be done?” O’Brien questioned, highlighting the urgent need for a paradigm shift beyond traditional patching methods to proactively address vulnerabilities.
O’Brien illustrated this urgency with a recent example involving the PHP2Shell vulnerability, which made headlines after it was disclosed in October 2026. Remarkably, the first reported attempts to exploit this vulnerability were recorded just 19 minutes after its public announcement. In another disturbing revelation, Amazon reported that it had detected attempted exploitations of PHP2Shell a full four days before the vulnerability details were made public. This rapid pace signifies a critical challenge for organizations striving to maintain robust cybersecurity defenses.
The Rise of Autonomous AI in Cyber Attacks
Looking ahead, O’Brien predicts a shift toward "end-to-end agentic orchestration of attacks." In the coming year, he anticipates that threat actors will move away from employing AI exclusively as an assistant for various tasks to enable autonomous AI agents to execute cyber attacks independently. This development could significantly hinder the capabilities of cybersecurity defenders, complicating their efforts to detect and respond to threats lurking in their environments.
O’Brien pointed to the September 2026 attack on the Dutch Institute of Vulnerability Disclosure (DIVD) as a real-world example of this emerging trend. During this incident, AI agents executed post-compromise actions autonomously, operating at machine speed. Symantec’s analysis of the DIVD’s assessment report revealed a stark reality: it took 19 minutes for the initial attack to be detected, but an agonizing 19 hours before any response was mobilized, followed by an additional nine hours to fully contain the threat. “What we’re dealing with is a process exceeding 24 hours long, and it’s evident that we cannot compete with something moving at machine speed,” O’Brien remarked.
Embracing an Assume Exploit Mindset
These evolving threats compel organizations to adopt a mindset that assumes exploitation is not just possible but likely. O’Brien emphasized the importance of preparing for rapid post-compromise actions, where attackers can transition from initial access to significant impacts in mere minutes. “Cease measuring your mean time to patch; instead, focus on your mean time to mitigate. Organizations must operate under the assumption that an exploit will eventually occur and plan their preparedness accordingly,” he advised.
To assist security teams in this transformative landscape, O’Brien outlined a series of immediate mitigation measures that organizations can adopt:
- Behavior Blocking: Implement mechanisms to detect and halt suspicious activities.
- Default-Deny Policy: Create stringent permissions regarding what can run on organizational systems.
- Enforcing Least Privilege: Allocate minimal privileges for each agent and token, reducing potential damage.
- Data Inspection: Scrutinize data before it exits any device, ensuring sensitive information is safeguarded.
- Accountability Measures: Require every agent action to be bound to a named human, enhancing accountability.
“These actions can be initiated without waiting for a vulnerability to be identified,” O’Brien stated, underscoring their immediate applicability.
For long-term resilience, organizations must weave detection and protection technologies into a variety of control points. This will enable them to identify behavioral anomalies stemming from rogue or malicious AI agents before significant damage occurs. In an era defined by escalating AI sophistication, the time has come for organizations to rethink their cybersecurity paradigms and take proactive measures against emerging threats.