Speed is the new differentiator in risk management. It’s the difference between an attacker being successful and a defender mitigating or minimizing a threat. Attackers have demonstrated their ability to identify vulnerabilities, develop exploits, and execute them at machine speed. All while requiring relatively minimal human intervention, as reported byAnthropic1 in November 2025. This puts defenders in a very difficult position of trying to keep up.
Organizational defenders also need to operate at speed. Not only speed to detect and respond swiftly to threats, but also speed to deploy proactive and preventive measures that help to mitigate or reduce the impact of attackers. But unlike attackers, organizations must follow controls and processes before they can deploy quickly. They have regulations they must comply with and stakeholders to report to. Well-intentioned controls designed to minimize risk may not keep pace with the demands of the business.
Where Organizations Get Stuck
And this is where many organizations get stuck. They want to move quickly. They desire to deploy AI-enabled tools that promise to deliver speed. But the organization’s processes aren’t set up to enable secure innovation at speed. They are still operating time-intensive processes that slow down innovation. If the goal is to operate securely at speed, then controls need to be integrated into processes rather than bolted on.
And while AI-enabled tooling can help an organization to move quickly, that alone won’t win the race against the attackers. There has to be a systemic change in how an organization operates to prioritize security and innovation together, rather than treating them as a trade-off.
The Evolution
This is why security and compliance processes need to evolve. Processes cannot be standalone, but rather need to be integrated. It starts with the people. Engineers, developers, security, and compliance professionals who work in collaboration to design secure processes. Not once a week at the check-in meeting, but continuously building towards the same goal. The same success metrics and the same end goal.
The entry point is for people to speak a common risk language and integrate it into how the business operates. They do this by gaining a clear understanding of the organization’s risk appetite and where the organization is and is not willing to accept risk. This is supported by a culture of risk awareness that cultivates a deep appreciation and understanding of the rationale for the organization’s approach to risk management.
The next step is taking the risk conversation and turning it into clearly defined requirements to guide the organization. Defining key controls to help an organization stay aligned with its risk appetite.
Organizations that scale operationalize the requirements by turning them into checks and guardrails that support the software development process. Tests and checks that are run before code is deployed. Leveraging enforcement mode to not allow code to progress that doesn’t meet the requirements. Stopping attacks before they happen by preventing vulnerable code from reaching production.
Visibility is achieved by leveraging logging and monitoring systems to provide insight into the control environment. Behavior and key controls are monitored to detect anomalous behavior. Defenders are not just looking at static signals, but rather signals in the context of behavior.
And when those signals come in, defenders need to quickly investigate, run them to ground, and determine whether further action is needed to block or minimize malicious behavior. Hopefully, stopping the attacker in their tracks.
More than a Technology Problem
AI can be woven into the journey described above, but treating organizational response as only a technology problem won’t solve an organization’s speed challenges.
A foundational shift is needed in how an organization operates. Organizations must have development and security teams working in harmony, not only to allow innovation to flourish but also to do so securely. Everyone in the organization must share the same business goals and understand the risks and the why behind the actions. Unifying together to outpace the attackers.
The Road Ahead
The road ahead in the next few years will certainly be bumpy. There will be major potholes to steer around and maybe some roads that dead-end. It will be frustrating and challenging to navigate. But that’s even more reason for leadership teams to start coming together now. Knowing what’s ahead, there’s never been a more important moment for organizational defenders to work together to achieve the goal of speed.
References:
1 Anthropic. (2025, Nov. 13). Disrupting the first reported AI-orchestrated cyber espionage campaign. Anthropic. https://www.anthropic.com/news/disrupting-AI-espionage