The cyberattack now fits in 29 minutes. Sometimes 27 seconds.

Adam Meyers, SVP of Intelligence at CrowdStrike, said at Fal.Con on Wednesday that agentic AI has compressed the gap between initial access and lateral movement inside a target network, the "breakout time" defenders use to measure their response window. Ransomware, espionage, and hacktivism operations now all run AI agents inside the intrusion, performing work that previously required hands-on operators.

CrowdStrike is tracking roughly 26 such adversary groups in the last 30 days, more than the full prior year combined. Two are named: REVENANT SPIDER, a tracked threat group using an agent inside the intrusion, and VAULT PANDA, another tracked group observed running 1,100 commands in 58 minutes and visibly learning in real time.

The fastest breakout the firm recorded in its 2026 global threat report was 27 seconds. The average was 29 minutes. Agents iterate at machine speed; defenders do not.

Meyers pointed to the Sality botnet takedown as a working counter-model. The 23-year-old network fell this week after a decade-long operation pairing CrowdStrike with law enforcement. "We do need to bring the fight to the bad guys... raise the cost of doing business for them," he told theCUBE's Dave Vellante and Rebecca Knight.

The figures are CrowdStrike-attributed, drawn from the vendor's own telemetry and put on the record at its conference. Independent corroboration has not been published.