Machine Speed Attacks, Human Speed Decisions

Strategy · July 26, 2026 · 8 min read

Scanning for a newly disclosed vulnerability begins within hours of the disclosure, sometimes sooner, and it is performed by infrastructure that does not sleep, take holidays or need to be convinced the issue is urgent. Credential stuffing runs continuously against every login endpoint that exists. None of this requires a sophisticated adversary; it is the commodity floor.

Defensive response, meanwhile, runs at the speed of a person being paged, forming a judgement, and often obtaining an approval. The gap between those two tempos is not a staffing problem, and it does not close by adding analysts. Ten people deliberating are slower than one, not faster.

It closes by moving the decision earlier.

Decide before, not during

Every response has a decision in it: is this bad enough to act, and is this action acceptable. During an incident, that decision is made under time pressure, with partial information, by whoever is awake.

The same decision made calmly, in advance, with the relevant people in the room, produces a better answer and can then be executed in milliseconds. “If an account shows impossible travel and a token was minted from an unrecognised device, force re-authentication” is a decision. Made in advance it is a policy that a machine applies instantly. Made at 3am it is a debate.

This reframes what automation is for. It is not replacing analyst judgement with machine judgement. It is recording analyst judgement in a form that executes without waiting for the analyst.

The classes of decision differ

Not everything can be pre-decided, and pretending otherwise is how automation programmes acquire scars.

Decisions that pre-decide well are narrow, have clear triggers, and have cheaply reversible consequences. Step-up authentication on anomalous access. Quarantining an email already delivered elsewhere. Capturing volatile state from a host before it reboots. Revoking a session.

Decisions that pre-decide badly are broad, depend on context that only a person can assemble, or have consequences somebody will have to explain. Whether to take a production service offline. Whether an event constitutes a reportable breach. Whether to shut down a business process during a trading window.

The line between them is roughly the reversibility line, and it is worth drawing explicitly rather than discovering it during an incident.

Time-to-decision is the metric to reduce

Most programmes measure time to detect and time to contain. The interval that actually dominates sits between them and is rarely measured: the time from an alert arriving to a human knowing what it means.

That interval is mostly assembly work — collecting the context needed to judge. It is also the most automatable part of the whole pipeline, and automating it carries almost no risk, because gathering information cannot break anything.

An alert that arrives with the asset’s owner, its normal behaviour, the identity’s recent activity, and the reputation of everything involved already attached does not need twenty minutes of investigation before a decision. It needs two. That compression is worth more than shaving seconds off detection.

Rehearsal converts plans into reflexes

A documented process that has never been executed is a hypothesis. It will contain a step that does not work, a permission nobody has, a contact who left, or a tool that requires a login only one person holds.

Rehearsal is where those are found, and the finding is the point. The specific scenario matters less than exercising the machinery: does the page reach someone, can they get the access they need, does the isolation action actually work on that platform, does anyone know who authorises the irreversible step.

Teams that rehearse do not respond faster because they are braver. They respond faster because the friction has already been removed.

Where humans remain irreplaceable

Speed is not the only axis. Automated systems are excellent at applying a known rule to a known pattern and hopeless at recognising that the situation is not the one the rule was written for.

Novelty, ambiguity and consequence are the human domain. An incident that does not match anything, where signals conflict, or where the response itself carries serious business risk, is exactly where a person should be making the call — and they should be making it with attention that has not been consumed by four hundred alerts that meant nothing.

Which returns to the same conclusion from another direction: automation’s real contribution is not that it decides faster. It is that it clears everything mechanical out of the way so the scarce resource — human attention — is spent on the cases that need it.