AI is helping threat actors to accelerate attacks, but it can also empower incident responders to quickly contain threats, according to ReliaQuest. The firm’s Annual Cyber-Threat Report 2026 is based on an analysis of customer incidents and found that breakout time last year averaged 34 minutes, 29% quicker than in 2024, with the fastest ever recorded time from access to lateral movement of four minutes—85% faster than the year before.
The fastest recorded exfiltration time was six minutes, down from 4 hours 29 minutes in 2024. ReliaQuest said these stats can be explained by the growing use of automation and AI, with 80% of ransomware groups using one or both in their attacks last year. The firm also notes AI is used prior to attacks to aid reconnaissance by automating the analysis of social media profiles, corporate websites and public data sources to identify high-value targets and draft social engineering scripts.
Mike McPherson of ReliaQuest said agentic AI enables defenders to achieve an average containment time of four minutes, emphasising a shift toward predictive security.