The First Cyber Attack Nobody Drove [2026]
In 2025, researchers documented a cyber campaign that ran roughly 80–90% without a human directing it. Reconnaissance, exploitation, lateral movement — executed by software making its own decisions about what to try next. A person set the objective. The machine ran the operation.
That is the moment the profession changed, and most career advice in security has not caught up to it. The advice still assumes the adversary is a person who types faster than you. The adversary is increasingly a system that does not type at all.
So the field did the obvious thing: it deployed machines on defense too. Which leaves one question that determines what your career in this field is worth — when both sides automate, what is left for the humans? The answer is specific, it is well documented, and it is not evenly distributed across the org chart.
The Scoreboard, Told Honestly
Vendor marketing frames this as a balanced arms race. The data does not. Attackers automated first, and the numbers currently favor them:
| The Receipt | What It Means |
|---|---|
| ~340% rise in AI-assisted intrusion attempts versus two years prior | The cost of attempting an attack collapsed. Volume is now effectively free. |
| Roughly 38% of credential-harvesting campaigns globally involve adversarial AI tooling | The bad-grammar tell is gone. So is the generic-greeting tell. |
| 74 days average time to remediate a known high or critical vulnerability | Attackers moved to machine speed. Remediation did not. |
| ~45% of vulnerabilities at large companies are never remediated at all | The backlog is not a queue. It is a permanent condition. |
| Three of four organizations say they cannot defend at the speed AI-powered attacks operate | Nearly everyone is behind. Including, statistically, wherever you work. |
And underneath all of it sits the asymmetry that no technology has ever fixed: an attacker needs one weakness; a defender needs every one of them. Give both sides the same force multiplier and the side that only needs to be right once gains more from it. That is not pessimism. It is arithmetic, and it is why this field keeps hiring.
Both Sides Automated the Exact Same Thing
Here is the pattern almost nobody points out, and it is the whole career lesson.
Look at what AI actually took over on offense: scanning, enumeration, credential stuffing, phishing composition, payload variation. High-volume, well-understood procedures with known steps.
Now look at what AI took over on defense: alert triage, log correlation, enrichment, first-pass investigation, routine containment. High-volume, well-understood procedures with known steps.
Same category of work, opposite jerseys. Machines did not take over “attacking” or “defending.” They took over the documented part of both. And that gives you a career test far more reliable than any threat forecast: it is not about which side of security you are on, it is about whether your particular contribution has a procedure written down somewhere.
Which Brings Us to the SOC
Security operations centers are reorganizing around autonomous systems that triage, investigate, and remediate alerts — replacing the tiered analyst structure the industry has used for twenty years.
Say the tier-one analyst job out loud and you will hear why it went first. Watch the queue. Open the alert. Follow the runbook. Escalate if it matches the escalation criteria.
The runbook was always the specification. It was written precisely so that any qualified person could execute the role identically — consistency was the entire point, and it was a genuine operational virtue for two decades. It also happens to be the most complete job description ever produced for a technology role, which made it the easiest thing in the building to hand to a machine.
That is worth saying plainly because it is not a knock on anyone in that seat. The people who wrote those runbooks were doing excellent work by every professional standard available at the time. The standard changed underneath them.
The general rule, for security and everything else: if the whole of your job can be written down completely, that document is training data.
What Stays Human
Four things, and they are the four the money is moving toward:
Deciding what to protect. No system tells you which of eleven thousand unpatched findings actually matters to this business. That is a judgment about consequences, not a scoring algorithm.
Reasoning about an adversary who adapts to you. Detection engineering answers “have I seen this?” Threat modeling answers “what would a smart opponent do about the thing I just built?” The second question has no historical data, because the thing does not exist yet.
Designing controls before there is anything to detect. The single highest-impact finding in agent security this year was that least-privilege enforcement cut incident rates from roughly three-quarters of organizations to under a fifth. That is one architectural decision, made early, outperforming every detection tool bought afterward. Nobody automates that decision because it is made in a room, in an argument, before there is any telemetry to feed a model.
Owning the call. Somebody says shut it down, take the revenue hit, tell the regulator. Accountability does not delegate to a system, and every organization eventually learns this the expensive way.
Notice the shape: all four live at the architecture end of the profession, which is exactly where the compensation data says the field is thickening. The bottom of the security ladder is being automated. The top is being bid up. Same re-topping we documented in product management, arriving in security by a completely different road.
Where You Are Standing, and the Move From There
| If you are… | The honest read | The move |
|---|---|---|
| A tier-one SOC analyst | Your role has the most complete written specification in the building. That is the exposure. | Move toward detection engineering or IR — the work of deciding what should generate an alert, which has no runbook by definition. |
| A detection or IR engineer | Strong position, but the enrichment and correlation half of your day is going the way of triage. | Get in front of one agentic deployment before it ships. Nobody is competing with you for that meeting. |
| A GRC or audit professional | Better positioned than you think. Agent environments are drowning in control questions nobody can answer. | Add real technical depth on identity and permissions. Control thinking plus technical fluency is a genuinely scarce combination. |
| An infrastructure or cloud engineer | You already run the controls that matter most here — identity, segmentation, secrets. | Learn to write a threat model. It is the single artifact separating you from the architect band. |
| Outside security entirely | The talent gap is roughly 4.8 million positions. The door is open; the ladder’s bottom rung is not where it used to be. | Enter through the adjacency you already have — infrastructure, audit, data, operations — rather than through an entry-level analyst seat that is being automated. |
For twenty years, cybersecurity sold itself as the recession-proof career. Highest growth rate, lowest unemployment, millions of unfilled seats. All still true — and all of it is now describing a field with a hole in the middle of it.
The unfilled seats are real. They are just not where the entry-level advice keeps pointing. There are 4.8 million open positions and a shrinking number of them are “watch this queue and follow this document,” because that job now has a very capable non-human applicant who works nights and never escalates incorrectly.
Which is fine, if you know it. The work that is left is the work that was always the good part — deciding what matters, arguing for the control before the incident, and being the person who says stop. Machines took the runbook. Nobody has automated the argument.
Sources
CrowdStrike 2026 Global Threat Report · Anthropic threat intelligence reporting on largely autonomous intrusion campaigns, 2025 · Edgescan Vulnerability Statistics Report, 2025 · Teleport research on least-privilege enforcement for AI agents · Darktrace / Cloud Security Alliance, State of AI Cybersecurity 2026 (1,500+ security leaders) · Cisco, State of AI Security 2026 · industry workforce gap estimates, 2026 · U.S. Bureau of Labor Statistics, Occupational Outlook Handbook (information security analysts).
