Presented by Rubrik
The speed at which enterprise cybersecurity must operate is being fundamentally challenged. Advanced AI models are now facilitating autonomous cyberattacks that can progress from initial breach to full system compromise in as little as 27 seconds. This rapid pace outstrips the capabilities of human-managed security workflows to detect, escalate, and respond effectively.
Consequently, security teams must realize that there is no longer a buffer for human intervention between a breach and resulting damage.
In the AI age, enterprises must focus on cyber resilience. This involves consistently identifying clean recovery states, understanding critical data and identity dependencies, and automating restoration processes to ensure operations can recover within hours rather than days.
“Processes or human-in-the-loop interventions can’t operate at the speed of these attacks,” states Dev Rishi, GM of AI at Rubrik. “If attacks occur in 27 seconds, my recovery must be just as swift.”
Traditional detection and prevention are failing against AI-driven attacks
For decades, enterprise security has relied on rules-based logic, including static access controls, known signature detection, and deterministic behavioral policies, designed for deterministic software. AI agents, however, are non-deterministic, capable of achieving objectives through multiple paths, and can bypass static defenses by finding alternative routes.
The core issue is that traditional security logic checks identity, permissions, and access on an individual basis without assessing if a sequence of permitted actions across applications constitutes a data leak, destructive operation, or attack.
“A system that understands context is essential,” Rishi emphasizes. “AI must assess agent actions and identify potential risks of external data leaks.”
How AI agents are blurring the line between internal and external cyber threats
Historically, enterprise security has clearly differentiated between external and internal threats. External threats are often rapid and multifaceted, while internal threats were limited by a single human’s capabilities before detection. This distinction is eroding as AI agents operate within enterprise environments.
These agents access multiple systems and move faster than any human. Mistakes by agents, whether due to hallucinations, misinterpretations, or unintended data transfers, can mimic malicious insider attacks. Additionally, if external attackers compromise an internal agent, they access all connected applications.
“Regardless of whether an agent is a threat due to error or malicious compromise, organizations need runtime guardrails to consistently enforce policies across agents,” Rishi explains. “An AI-native guardian layer can semantically monitor agent behavior, understand intent, and block or terminate misbehaving agents at machine speed, triggering immediate recovery.”
Preparing for a world of inevitable compromise
Advanced AI models, capable of autonomously discovering and exploiting zero-day vulnerabilities, are altering the dynamics of cyberattacks.
As a result, enterprises are increasingly adopting Mythos readiness. They operate under the assumption that attacks are inevitable and invest in resilience and rapid recovery as strategically as prevention. This shift transforms recovery from a post-incident activity into a continuously validated capability.
“Quick recovery from attacks is becoming a key security element,” Rishi notes. “It’s the insurance policy organizations must prioritize.”
Why AI-powered cyber resilience depends on small models
True cyber resilience requires real-time intelligent enforcement to intercept threats and automated recovery to restore operations immediately. While backups are fundamental, organizations need workflows to monitor systems at machine speed and quickly identify the latest clean state during attacks.
Real-time enforcement using AI presents technical and economic challenges. Large models monitoring every action introduce latency and high computing costs. A guardian AI system that slows operations or matches system costs is impractical for broad use.
“It needs to be a fast, small, and affordable AI model,” Rishi asserts. “No one wants a solution that doubles cost or latency.”
This is why small language models (SLMs) are vital for real-time enforcement. Rubrik’s strategy, bolstered by acquiring Predibase, focuses on small models optimized for speed and efficiency. Unlike large models, SLMs can evaluate agent behavior at machine speed and low cost, serving as real-time checkpoints.
This efficient enforcement layer enables seamless recovery. When an agent performs a harmful action—like deleting a database or exfiltrating data—the small model detects it, stops the damage, identifies the last clean snapshot, and initiates recovery in one automated workflow.
The shift from incident response to architectural resilience
With the advent of Mythos and similar AI systems, organizations are rethinking security strategies. As AI narrows the time between attack and impact, resilience and recovery become architectural rather than operational concerns.
Rubrik believes security systems must extend beyond detection. As AI agents gain autonomy, observability, identity context, and recovery should function as a cohesive resilience layer. The objective is not only to detect issues but to minimize the time between detection and restoration.
“The same frontier capabilities posing threats, like those in models such as Mythos, can also be leveraged to combat them,” Rishi concludes. “Adapting to the AI era means bridging the gap between detection and system restoration, mitigating the cost of that gap.”
Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.
