Breach and attack simulation (BAS) systems are facing new challenges due to the rapid evolution of AI models, which have significantly accelerated the timeline from public disclosure of vulnerabilities to the deployment of weaponized exploits. This shift has compressed the window for defenders to respond, with weaponization now occurring in approximately ten hours, while over 130 new CVEs are disclosed daily. Compounding this issue, less than 0.5% of disclosed vulnerabilities are patched upstream, and a growing portion of production code is assembled using the same AI models that defenders are still evaluating.
Current BAS designs, often predating machine-speed adversaries, exhibit three primary limitations. First, their calendar-based triggers produce point-in-time results that quickly become outdated. Changes like firewall cleanups or EDR agent updates can silently negate previous validation, leading to performance decay. For instance, average prevention effectiveness has been observed to fluctuate significantly year-over-year, indicating that strong security posture is rented rather than owned.
Second, traditional BAS struggles to address the daily influx of new CVEs. Manually assessing the impact of a new vulnerability, such as whether a system would detect an exploit listed in the KEV (Known Exploited Vulnerabilities) catalog, can take four to six hours per CVE. This labor-intensive process means only the most critical vulnerabilities are typically evaluated, leaving many others untested. A recent report indicated that the ten least-prevented vulnerabilities, all found in common software like browsers, archive utilities, OpenSSL, and core OS components, were blocked less than 25% of the time. Automated penetration testing cannot fully close this gap, as it requires a working exploit, which is often unavailable on day one of a vulnerability's disclosure.
Third, the post-test remediation process remains heavily reliant on human effort. Findings from BAS often land in a queue with generic guidance, requiring engineers to translate them into specific signatures for NGFWs or rules for SIEMs. This manual translation problem contributes to a flat alert score, which has remained at 14%, suggesting that while detection programs are desired, the staffing required to act on their findings is insufficient. Running validation more frequently only exacerbates this backlog.
A recent analysis of 338 million attack simulations conducted in customer production environments during the first half of 2026 revealed an average prevention effectiveness of 69%, meaning roughly a third of attacks bypassed existing controls. While logging reached a four-year high at 58% of attack actions captured in SIEMs, the alert score remained unchanged at 14%. Detection rule failures primarily stemmed from performance issues (49%, doubling from the previous year) and log collection gaps (41%). Log collection gaps are particularly problematic as they lead to silent failures where attack behavior is never captured, preventing any detection rule from firing. These issues are primarily configuration and operational problems, not inherent product flaws.
To counter AI-driven threats, BAS needs to evolve into an "agentic" system, operating as a closed loop driven by autonomous agents. This model involves a signal-driven approach where specific tests are triggered by changes or new threats. When gaps are identified, vendor-specific fixes are automatically generated, deployed, and re-verified. Human oversight shifts from direct execution to decision gates within the loop.
This agentic BAS approach maintains the core cycle of simulate, validate, fix, and verify, but fundamentally alters what feeds the system, what triggers actions, and who performs them. AI Threat Builder models can autonomously construct new campaigns in minutes using internal CTI feeds and open-source intelligence. Simulations launch automatically and safely against live production controls, immediately surfacing silent failures. Fixes are automatically generated, with detections deployed to the security stack and prevention rules auto-ticketed to SecOps.
The method is behavioral, simulating exploitation without requiring a working exploit, making new KEV entries testable on the day of disclosure. This allows for comprehensive vulnerability testing, rather than rationing it to a few critical CVEs. The system aims for closure, ensuring that identified gaps are not just reported but actively closed and re-proven, with compensating rules provided for existing tools when patching is delayed. Threat group playbooks can also be run against live controls, mapping each TTP to a blocked, alerted, logged, or missed status, with associated fixes.
This advanced BAS can integrate with autonomous penetration testing and exposure validation to form a comprehensive exposure validation program. The content executed by the system is never raw model output; it is validated within a threat library. The underlying engine operates on verified frontier access under a cyber verification program, and organizations can drive these workflows through an API. This evolution ensures that defense mechanisms can match the speed and scale of AI-driven attacks, providing machine-speed response with human oversight.
