AI is removing the one handicap that lets cyber defenders keep pace with attackers. Richard Ford, VP of Engineering at CyberCube, explains what that means for (re)insurers.

In Aesop’s fable the hare has all the characteristics needed for an undisputed win, but loses, because it takes a nap halfway round the course. Cyber defence is a bit like this. We’re the hare. We’re better funded and better equipped than we’ve ever been, yet most of our defence still waits for an alert before it acts. We lose more we should.

The attacker is the tortoise. It never stops, and it only needs to win once. For most of this industry’s history, what kept defenders ahead was the attacker’s lack of speed. Every attack was a chain of manual steps, with a human picking a target and then working through a network by hand. That took time, and time was where detection and response did their job.

AI takes that constraint away. CrowdStrike’s 2026 Global Threat Report puts average eCrime breakout time – the gap between initial access and lateral movement onto another system – at 29 minutes for 2025, down from 48 the year before. The fastest it observed was 27 seconds. Breakout time has been falling since at least 2022, and the rate of decline has accelerated.

Speed helps the attacker more than the defender. An attack that fails costs the attacker almost nothing – they simply retry. A defence that fails once is the breach. Equal error rates, wildly unequal consequences. So when a new capability makes both sides faster, the attacker banks the gain and the defender inherits the risk.

Physicists would call what comes next a phase change. Once the time an attacker needs to exploit a weakness drops below the time a defender needs to respond, the defender doesn’t get a turn, and the rules of the game fundamentally change. Detection arrives after the damage is done, and response turns into recovery.

The window is closing fastest on the most common security gaps. CyberCube’s H1 2026 Global Threat Briefing found threat actors exploiting identity misconfigurations and unpatched systems more quickly than before, compressing the time between initial compromise and operational disruption. The GTG-2002 extortion campaign, which Anthropic disrupted in August 2025, got in by scanning thousands of VPN endpoints for vulnerable targets. Claude Code then harvested credentials, moved through the networks and chose what to steal. Anthropic says the model was allowed to make both tactical and strategic decisions. AI ran the operation. An exposed VPN let it in.

The early 2026 FortiGate campaign shows where this leads. No Fortinet vulnerability was exploited: one actor of low-to-medium skill, augmented by AI, compromised more than 600 devices across 55-plus countries in five weeks through exposed management ports and reused credentials. They went for the backups, a likely ransomware precursor. No cyber insurance losses have been publicly confirmed.

This is where an engineering problem becomes an insurance problem. Huge numbers of firms sit behind the same firewall products and log in through the same identity providers. When an attacker can find every unpatched copy of one product and exploit them all at once, a single weakness turns into a cluster of losses.

Many observers simply assume AI makes familiar kinds of cyber-attack faster or more effective. For an attack on one company, that’s fair enough. It’s the same insurance claim as before, arriving sooner. A cluster of losses across hundreds of companies is a different problem. Instead of separate claims spread across the year, much of a portfolio claims at once, like a hurricane hitting a coastline.

The question to ask is how much of a book runs on the same software, now that exploiting all of it at once no longer takes a small army of skilled humans? Now ask the same question of AI itself: how many companies depend on the same model providers, clouds and data pipelines? Accumulation teams are starting to map those dependencies, with no standard approach yet.

The GTB points underwriters towards patch latency and identity security as the main drivers of how an attack spreads and turns into a loss. Once the response window closes, the size of a business interruption loss comes down to recovery. A firm that can restore systems in hours will file a very different claim from one that needs weeks.

Aesop’s moral was that persistence beats a sprinter who stops paying attention. Attackers always had the persistence. AI has now given them the speed as well. Aesop never wrote the version where the tortoise is fast too, and that’s the race we find ourselves in today.