Overview
CrowdStrike has declared “breakout time” effectively obsolete. Breakout time is the cybersecurity industry’s longstanding measure of how long an attacker takes to move from an initially compromised endpoint to other systems on a network. VentureBeat reported on 12 November 2026 that CrowdStrike’s threat intelligence shows autonomous AI agents now complete that lateral movement in seconds rather than hours. CrowdStrike CEO George Kurtz summed up the shift: “This was human speed with better tools, and breakout time is over.”
Breakout time mattered because it gave defenders a target. If the average intruder needed close to two hours to pivot from the first machine, a security team that could detect, triage and contain an incident inside that window had a realistic chance of stopping a breach before it spread. Organisations built incident response plans, managed security service agreements and on-call rosters around that assumption. CrowdStrike’s latest findings suggest the window is now shorter than the time it takes a person to read and act on an alert.
For Australian environmental professionals and their clients, including developers, lawyers, councils and site owners, this is not a remote IT story. Consultancies, laboratories and law firms hold laboratory data, site investigation reports, due diligence files, regulator correspondence and privileged legal advice. Councils hold planning records and contaminated land information. Any organisation whose cyber incident plan relies on a staff member or outsourced provider noticing something unusual and responding within the hour is planning for a threat that, on CrowdStrike’s evidence, has already moved on.
Key details
CrowdStrike’s headline case study is an intrusion campaign across Latin America that compromised at least 15 healthcare organisations. When network firewalls blocked the offensive AI agent, it took 29 seconds to switch tactics autonomously. It then targeted a domain controller through SQL injection and dumped credential hashes within 17 minutes. A domain controller manages authentication across a Windows network, so credential hashes extracted from it can give an attacker a route to almost every account and system in the environment.
CrowdStrike reports that adversaries are using multi-agent architectures with a clear division of labour. A “Supervisor” agent acts as the planning model. It analyses feedback from the target system and selects intermediate objectives and attack paths. An “Executor” sub-agent carries out the work: it generates scripts, probes open ports and extracts Active Directory hashes. This structure lets the attack adapt to defensive responses without waiting for a human operator to assess what went wrong and decide what to try next.
The scale gap between human and machine attackers is central to CrowdStrike’s argument. Skilled human operators working at a keyboard typically issue dozens of commands per hour. Across the campaigns CrowdStrike traced, offensive agents issued roughly 1,500 commands per hour. CrowdStrike links this capability to a three-fold increase in agentic intrusions during the second half of 2026. The historical trend is equally stark. Average breakout time was 1 hour 58 minutes in 2018 and had fallen to 29 minutes by 2026. Automated intrusions are now recording lateral transitions in under 30 seconds.
Adam Meyers, Senior Vice President of Counter Adversary Operations at CrowdStrike, stressed that the techniques themselves are not new: “It’s just speed and volume. This is not using new and unseen exploits. It’s just using things that we already knew about, but it’s doing it faster, and it’s kind of connecting the dots at a volume that we’re not used to seeing.” Regulators are responding to the same pressure. In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) is enforcing Binding Operational Directive 26-04, which mandates three-day patch windows for flaws subject to automated exploitation, ahead of a 7 December 2026 deadline. As the VentureBeat report notes, the industry has not yet agreed on what metric should replace breakout time.
Australian context
Australia has no direct equivalent of CISA’s three-day patching directive for private businesses. The Australian Signals Directorate’s Essential Eight Maturity Model is the most widely used local benchmark. At Maturity Level One, patches for vulnerabilities in online services are expected within 48 hours of release where the vendor rates the vulnerability as critical or a working exploit exists, and within two weeks otherwise. Many small and medium professional services firms, including environmental consultancies and laboratories, still run monthly patch cycles managed by an external IT provider. An attacker can chain known vulnerabilities together in minutes and an automated agent can move laterally in under 30 seconds, so a 30-day patch cycle leaves known flaws open for weeks longer than an attack needs.
Australian breach reporting obligations are triggered by what an attacker accessed, not by how long the intrusion took. A 17-minute compromise can therefore create the same notification burden as one that ran for months. Businesses covered by the Privacy Act 1988 (Cth) must comply with the Notifiable Data Breaches scheme in Part IIIC. Coverage generally includes businesses with annual turnover above $3 million, plus certain smaller entities such as health service providers. A suspected eligible data breach must be assessed within 30 days. Affected individuals and the Office of the Australian Information Commissioner (OAIC) must be notified where serious harm is likely.
Other Australian frameworks also apply. Under the Cyber Security Act 2024 (Cth), businesses above the $3 million turnover threshold must report ransomware payments to the Australian Signals Directorate within 72 hours. The healthcare focus of the Latin American campaign is a reminder that health care and medical is one of the critical infrastructure sectors covered by the Security of Critical Infrastructure Act 2018 (Cth). Responsible entities for critical infrastructure assets under that Act must report cyber security incidents with a significant impact to the Australian Signals Directorate within 12 hours, and incidents with a relevant impact within 72 hours.
References and related sources
- Primary source: venturebeat.com
How iEnvi can help
iEnvi integrates technology and data-driven approaches into environmental consulting. We monitor AI and technology developments that affect how environmental professionals deliver services to clients.
This is an iEnvi Machete news summary. Prepared by iEnvi to summarise the source article for environmental professionals tracking AI, data, and technology developments that affect consulting and project delivery.
Published: 13 Nov 2026
Need advice on this topic? Speak to an iEnvi expert at info@ienvi.com.au or 1300 043 684, or contact us online.
Need advice on this issue? iEnvi provides practical, senior-led environmental consulting across contaminated land, remediation, ecology and environmental risk.
Contaminated land services Site investigation services Environmental due diligence Talk to iEnvi