The Cat and Mouse Between Good and Bad

Every good story about crime and security has the same shape. The bad guys are clever and ruthless, but the good guys have more: more money, more people, more courage, more faith in what they are doing, more friends to call. Eventually, the institution outlasts the outlaw.

Cybersecurity worked that way too, mostly. Attackers needed only one success, but serious attacks required rare skills, patient teams and months of work. Those were scarce, and the defenders, with their budgets, their vendors and their information-sharing networks, could usually stay a step ahead. Last week, it became clear that AI has changed the arithmetic. The bad guys now have the same tools as the good guys. And they have something defenders never have enough of: time.

The Week the Future Arrived

01 · Record · Reuters · Microsoft · Axios · Fortune · 19 to 23 October 2026

Three stories in three days

Monday, 19 October. Snorre Fagerland, a researcher at the security firm NorForge, published a report that Reuters had reviewed before publication. One attacker, using off-the-shelf AI agents built on an open-source tool, had tried to break into more than 1,200 websites since late September, and succeeded at more than 100 companies. Reuters identified some of them, including Deere, SharkNinja and Cummins. Deere said it had remediated and saw no sign that sensitive information was accessed; SharkNinja said a standalone support site was hit and contained; Cummins said it was investigating a report about a vendor-run website. NorForge estimated the whole campaign cost about $5,000 in AI usage: roughly $50 per successful break-in. “The development in this field is astounding,” Fagerland said.

Wednesday, 21 October. Microsoft said a Chinese state-aligned group it tracks as Storm-0940 had compromised the IT services firm ConnectWise and targeted hundreds of organisations worldwide, across sectors from defence and energy to law firms and think tanks. Microsoft said the group used an open-source framework able to run any AI model and carry out tasks autonomously. Most of the targeting failed, but at many organisations the group quickly gained access that could survive clean-up. China’s embassy in Washington denied involvement.

The same day, governments in the US, Japan and elsewhere urged companies to patch two critical flaws in PHP, the open-source language behind nearly 70% of websites. The flaws had existed for decades. Researchers found them partly with help from an OpenAI model. Some sites, including parts of Wikipedia, went offline until they could patch. Cloudflare’s chief executive, Matthew Prince, said his company saw thousands of attempts to exploit the flaws in the ten hours before the announcement, and millions soon after.

On Wednesday, Fortune put the three together. Experts told it attackers are shifting from running attacks themselves to supervising AI agents that act on their own. Varun Chandrasekaran of the University of Illinois said such agents can run continuously at a “fraction of the cost of human attackers”, which “fundamentally changes the economics of exploitation”.

An attack that once needed a skilled team and a month now needs a credit card and a weekend.

What AI Did to the Good Guys’ Advantages

It helps to be precise about what the defenders used to have, and what AI has done to each advantage. This is a Kintoro framework, built on the evidence below.

• Money. Defenders still outspend attackers by far, but the attacker’s cost per attempt has collapsed. About $50 per successful break-in, against an average breach cost of $4.44 million worldwide and $10.22 million in the US, according to IBM. The economics now reward volume.
• Intelligence and ingenuity. Skill used to be the attacker’s bottleneck. In November 2025, Anthropic reported what it called the first documented large-scale cyberattack “executed without substantial human intervention”, a campaign it attributed with high confidence to a Chinese state-sponsored group, in which AI did an estimated 80 to 90% of the work. “The barriers to performing sophisticated cyberattacks have dropped substantially,” it said.
• Collaboration. Defenders have long shared threat intelligence through industry groups and governments. Attackers now get a kind of collaboration for free: open-source agent tools, published for legitimate testing, that anyone can repurpose. The author of the tool used in the 100-company campaign said it “was not designed for attacks”.
• Guts and faith. These still belong to people, and they still matter. But an AI agent does not get tired, scared or bored. It does not need courage to try the 1,200th website.
• Time. This is the advantage that has flipped. Attackers’ agents work around the clock. Defenders still work in business hours, patch cycles and change windows.

An AI agent does not get tired, scared or bored. It does not need courage to try the 1,200th website.Kintoro

The Race Against the Clock

02 · Evidence · Mandiant · Verizon · Gartner · 2025 to 2026

Exploited before the fix exists

The data on time is stark. Google’s Mandiant, which investigates thousands of breaches, reported in March 2026 that the average time to exploit a vulnerability had fallen to an estimated minus seven days: attackers routinely use flaws before a patch is even released. Exploits were the most common way into a company for the sixth year running, at 32% of intrusions. The median time for one criminal group to hand access to another fell from more than eight hours in 2022 to 22 seconds in 2025.

Defenders are moving the other way. Verizon’s 2026 Data Breach Investigations Report found exploited vulnerabilities were the way in for 31% of breaches, up from 20%, while the median time for organisations to patch rose from 32 days to 43. Third parties were involved in 48% of breaches, up from 30%. Gartner predicted in 2025 that AI agents would halve the time it takes to exploit exposed accounts by 2027.

And the volume of fixes is exploding, partly because AI is finding flaws faster than ever. In June 2026, Microsoft shipped the largest monthly security update on record, more than 200 fixes, and said its own AI system had found 16 vulnerabilities in May before any human researcher. Microsoft expects its updates to “continue trending larger”. Every flaw found by a defender’s AI is good news, but each one is also a new item on a patch list that is already too long.

The new contest is not who is smarter. It is who is faster.

The Good Guys Have the Same Tools

03 · Evidence · DARPA · IBM · OpenAI · Microsoft · 2025 to 2026

AI on the side of the defenders

Here is the part the panic misses. Every capability that helps attackers also helps defenders, and defenders were first to industrialise it. In August 2025, DARPA’s AI Cyber Challenge ended with AI systems that found 54 of 63 planted vulnerabilities in real open-source software and fixed 43 of them, in an average of 45 minutes, at about $152 per task. They also found 18 real, previously unknown flaws. All the finalist systems were released as open source, for anyone to defend with.

Last week’s PHP flaws are the same story. They were found by defenders, with AI, and fixed before they were announced. The attacks that followed were a race to exploit sites that had not yet patched, not a race the defenders lost by being slower to discover.

The business case is already measurable. IBM’s 2025 Cost of a Data Breach report found that organisations using AI and automation extensively in security saved about $1.9 million per breach and cut the breach lifecycle by 80 days. And it found the weak spot: 97% of organisations that suffered an AI-related breach lacked proper access controls on their AI systems.

Mandiant offers a sobering balance. It does not consider 2025 the year breaches were caused by AI. “The vast majority of successful intrusions still stem from fundamental human and systemic failures,” it wrote. AI makes attackers faster at finding those failures. It does not create them. That is good news: the failures are within a company’s control.

AI did not make attackers smarter than defenders. It made them as smart, and gave them all the time in the world.The central statement

Where the Good Guys Can Still Win

If the old advantages are gone, what are the new ones? I see four, as a Kintoro framework.

• Home ground. Defenders know their own systems, their own normal and their own people. An attacker’s agent has to guess. A defender’s agent can be taught what normal looks like and spot anything that is not.
• Speed with permission. Defenders can let their agents act at machine speed, inside rules people have approved. Attackers have speed too, but a defender who responds in minutes, not days, turns most cheap attacks into wasted tokens.
• Legitimate collaboration. Governments, vendors and industries can share what they see in real time. Last week’s PHP alerts went out from several governments at once. Attackers cannot coordinate in the open.
• Accountability. The good guys can still decide, and answer for, the moments that matter: cutting off a supplier, taking a site offline, paying or refusing a ransom. That judgment is slower than an agent, but it is what keeps a company trustworthy.

The pattern is the one that runs through every Kintoro feature: agents do the work, people keep the decisions. In security, it means defensive agents watch, sort and respond in seconds, inside policy, and people decide anything permanent.

How We Build It into piSentinel

04 · Kintoro · piSentinel · October 2026

Watch around the clock. Ask before anything permanent.

I should declare an interest. At Kintoro we build piMonk, a suite of business applications for mid-market companies, and one of its apps, piSentinel, is our answer to the time problem. It is invite-only today, and it runs on the customer’s own servers, under the customer’s keys.

piSentinel’s six agents each have one job. A Manager coordinates and holds escalation. An Enforcer blocks, allows or holds an item for review. A Runner runs scans and tests. A Logger writes the audit trail. A Generator creates attack scenarios to test against, and an Enricher adds context for the person who has to decide. Within policy, the agents work alone and around the clock: watching traffic and logs, applying self-healing policies, surfacing patterns and running security tests. But permanent blocks, fixes to your systems, and what gets reported to whom all wait for a person. Every action is scored for trust, and an agent below its trust score must ask first.

That is the scenario at the top of this feature: agents that respond at 2:14, and a person who decides at 2:31. We have not completed a SOC 2 or ISO 27001 audit for piSentinel yet, and we say so on the product page. In security, honesty about what is not yet done is part of the product.

Five Checkpoints to 2030

This is how I expect the contest to develop, with each checkpoint marked as measured today, scheduled in law, forecast by analysts, or forecast by Kintoro.

1. 2026

   The cost collapses Measured

   One attacker breaches more than 100 companies for about $50 each. A state-aligned group uses an autonomous AI framework at scale. AI helps defenders find decades-old flaws in software behind most of the web. Exploitation now routinely comes before the fix.

2. 2027

   The rules arrive Scheduled · Analyst forecast

   The EU Cyber Resilience Act, whose reporting duties for actively exploited vulnerabilities began in September 2026, applies in full from 11 December 2027, making security a legal requirement for products with digital elements sold in the EU. Gartner expects AI agents to halve the time to exploit exposed accounts by 2027.

3. 2028

   Machine against machine Kintoro forecast

   My forecast: most mid-market companies run defensive agents around the clock, through a provider or their own tools. The first question after any incident becomes “how fast did our agents respond?”, not “when did someone notice?”.

4. 2029

   The patch window closes Kintoro forecast

   Patching in days becomes the norm, then in hours for critical systems. Insurers and large customers ask for evidence of response times, not just policies, as a condition of cover and contracts.

5. 2030

   Guardians everywhere Analyst forecast · Kintoro forecast

   Gartner expects guardian agents, AI that watches and can stop other AI, to take 10 to 15% of the agentic AI market. My forecast: the companies that win are the ones that let agents defend at machine speed and keep people on the decisions that cannot be undone.

The Business Conclusion

A mid-market company is exactly what a cheap, automated attacker is looking for: valuable enough to be worth $50, not big enough to have a 24-hour security team. Last week, three of the targets named were household brands, and much of the activity reached them through suppliers and service providers. The good news is that the defences that work are known, and most are within reach.

For a business leader, that becomes five moves over the next twelve months:

• Measure your patch time, and set deadlines in days for critical flaws, not weeks. Ask your IT provider for the same.
• Know your third parties. List every supplier and provider with access to your systems, what they can reach, and how quickly you could cut them off.
• Turn on phishing-resistant multi-factor sign-in everywhere, starting with remote and cloud access and administrator accounts.
• Put AI on defence, inside rules you approve: agents that watch around the clock, respond in seconds, and escalate anything permanent to a named person.
• Govern your own AI. Give every AI tool and agent access controls, a named owner and a record, so it never becomes the way in.

Then rehearse. Run a night-time drill once a quarter, and time it. The companies that will hold their ground are not the ones with the biggest budgets. They are the ones that answer fastest, and decide best.

The Good Guys, Revised

The old story said the good guys win because they have more. That story is over. The bad guys now have the same tools, and more time than any defender will ever have.

But the good guys still have things no attacker can rent by the token: home ground, legitimate allies, and the ability to make decisions they can stand behind. At Kintoro, that is how we build piMonk and piSentinel. AI agents handle the watching, the sorting and the first response, around the clock. People keep the decisions that commit the business.

The cat and mouse game is not over. The mouse now has the same tools, and more time. The answer is not more fear. It is faster defence, and better judgment.

Faster defence. Better judgment.