72 Minutes to Exfiltration: Forensics in a Race Against AI
10.07.2026 incident responseai-driven attacksthreat intelligenceidentity security
When an incident response team gets paged today, the clock behaves differently than it did twelve months ago. Palo Alto Networks’ newly released Unit 42 2026 Global Incident Response Report offers a number that should be posted on every SOC wall: the quickest quartile of intrusions reached exfiltration in just over an hour (72 minutes) in calendar year 2025, down from nearly five hours (285 minutes) in 2024. The findings are based on analysis of over 750 major cyber incidents across every major industry in over 50 countries.
Why the Timeline Is a Problem for Forensics
For DFIR practitioners, this acceleration isn’t an abstract statistic — it’s a direct threat to the evidentiary base itself. Volatile artifacts such as network connections, process memory, and temp files often exist for minutes at best. When the gap between initial access and data theft shrinks to roughly an hour, there’s barely time for manual triage, let alone classic incident response workflows with escalation tiers and sign-offs.
The report is explicit about the cause: AI has become a force multiplier for threat actors. It compresses the attack lifecycle, from access to impact, while introducing new vectors. Unit 42 even simulated this effect internally: last year, Unit 42 simulated an AI-assisted attack that reduced time-to-exfiltration down to 25 minutes.
A real-world illustration of this shift is LAMEHUG, a malware family CERT-UA attributed to Russia’s APT28 in mid-2025. Unlike traditional malware, LAMEHUG leverages large language models hosted on Hugging Face to dynamically generate commands for reconnaissance, data theft, and system manipulation in real time. For forensic analysts this matters enormously: there’s no fixed command-line signature to hunt for anymore. This innovative approach allows threat actors to adapt their tactics during a compromise without needing new payloads, potentially making the malware harder to detect by security software or static analysis tools.
Identity as the Front Door — and a Forensic Blind Spot
The report’s second major finding concerns the attack surface itself: 65% of initial access is driven by identity-based techniques, like social engineering and credential misuse, while vulnerabilities account for initial access in 22% of all attacks. On top of that, 48% of attacks involve the browser, reflecting how routine web sessions are weaponized to harvest credentials and bypass local controls.
This complicates forensic work in two ways. First, stolen but legitimate credentials leave few of the suspicious artifacts a classic intrusion produces — attackers simply “log in.” Second, the crime scene itself is now distributed: 87% of attacks span two or more attack surfaces, blending activity across endpoints, cloud, SaaS platforms and identity systems, with Unit 42 tracking activity across as many as 10 different fronts simultaneously.
Tellingly, the acceleration is rarely a product of superior attacker sophistication but of structural defender weaknesses: attackers are evolving their tools and tactics, but they still win most often from exploited complexity, limited visibility and excessive trust — in over 90% of the incidents investigated, misconfigurations or gaps in security coverage materially enabled the attack, with tool sprawl as a big driver, as many organizations run 50 or more security products.
What This Means in Practice
Three consequences follow directly. First, continuous automated telemetry capture is replacing after-the-fact log collection, because a 72-minute window leaves no room to assemble data reactively. Second, identity forensics — analyzing token abuse, session anomalies, and OAuth grants — is becoming core discipline, since classic endpoint artifacts often simply aren’t there when the attacker “logged in” rather than broke in. Third, analyzing AI-generated attacker commands demands new methodologies, since command chains vary case by case even within the same malware family.
The bottom line for DFIR teams: evidence collection now has to move at the speed of the attack itself — or it arrives too late to prevent anything, serving only as a post-mortem reconstruction of what already happened.
← Back to overview