Exaforce says machine-speed attacks exfiltrate data in minutes as human SOCs lag

Exaforce reports attackers reach data in 15 minutes, while Unit 42 says AI agents compressed an enterprise intrusion into under 10 hours from the usual two weeks.

On June 19, an attacker used a stolen GitHub Desktop OAuth token that had sat in a Mac keychain for 95 days to pull 76 repositories in roughly 15 seconds through residential proxies across more than two dozen European cities. GitHub issued no alert because nothing monitors token usage. Exaforce spotted the abuse within five minutes and finished triage within 10 minutes, but by then data had left 472 of the 638 repositories.

OAuth tokens beginning with gho_ never expire, and GitHub removes them only after a year. They do not appear on the SSO page, showing up solely through the CLI. Turning off a developer in the identity provider does not kill the token, and without SCIM GitHub continues to accept tokens until someone revokes them or deletes the user.

Unit 42 issued a report on machine-speed intrusions. The intrusion opened with a breach of a public API, then deployed sub-agents to collect hard-coded tokens and service passwords from code repositories. The intruder obtained primary administrative credentials, root access, CI/CD pipelines, cloud access keys, and converted AI endpoints into post-compromise infrastructure. Unit 42 says the attack relied on coordination rather than new exploitation, as agents moved through ordinary exposures faster.

Poisoned npm packages move faster still. Worms such as Shai-Hulud scan a machine for GitHub and cloud tokens the moment a tainted package installs, before any code reaches a repository. That timing means repository scanning cannot show whether a compromised package hit the organization.

ClickFix illustrates how AI-related lures slip past perimeter controls. In one case, someone looking for Claude Code installation instructions ran a single-line command from a shared Claude conversation that loaded a macOS stealer. The malware imitated a System Preferences password prompt, then gathered the keychain, browser cookies, saved passwords, and cloud credentials. Executing the command allowed the user to evade e-mail filtering and download controls.

Figuring out the damage demands a review of every token and credential created by the affected user.

Identity providers miss most vishing intrusions because victims approve genuine MFA prompts, making attacker logins appear legitimate. Attackers also strike the same company through multiple employees, frequently reusing the same servers and domains. In Exaforce vishing cases this year, intruders registered an MFA device and, 2.5 to 7 minutes after push approval, launched a bulk download script. One incident involved 140,000 exfiltrated files, with attackers demanding a ransom for the leaked data.

Most calls copy a Scattered Spider help-desk script that sends workers to look-alike sign-in pages like contoso.add-passkey[.]com. The oskeysetup[.]com phishing kit is custom-built, so detections built for Evilginx do not catch it. The fake sign-in pages either relay logins through an adversary-in-the-middle proxy or walk victims through device-code sign-in. Exaforce points to a new MFA method from unrecognized hardware and an unknown network as the earliest reliable sign of a vishing hijack.

Microsoft’s July case shows how identity risk scoring can fail after MFA passes. Microsoft flagged an intruder’s initial sign-in as risky, cleared it after MFA, then observed the stolen token replayed from two countries within one second. Exaforce caught that takeover by matching Okta and Microsoft sign-ins against the user’s history, including a first-ever U.S. sign-in on Linux through a new home internet provider.

Data can keep flowing after response starts. In Exaforce vishing cases, exfiltration lasted 44 minutes to 3 hours after IdP session revocation, and attacker mail rules once survived a password reset. Revoking an Okta session or password does not cancel tokens already issued by Microsoft 365, Google Workspace, or GitHub, and AWS or Snowflake SSO sessions remain active. Okta Universal Logout covers Google Workspace and Slack, yet it does not reach GitHub, Snowflake, or AI model providers, so a compromised session lets an intruder use every application the user signs into.

Exaforce suggests scoring response actions according to friction, allowing low-friction moves such as session revocation, MFA removal, and key deactivation to trigger on high-confidence findings. More disruptive actions should require human sign-off, preferably from the user and their manager. These include password resets, disablement, deletions, and changes to production dependencies.

Teams should prepare revocation actions ahead of time, beginning with Google Workspace, Office 365, AWS, GCP, Snowflake, GitHub, Anthropic, and OpenAI. Exaforce supplies the API calls and permissions needed to revoke sessions and tokens across Okta, Microsoft Entra ID, Google Workspace, GitHub, Snowflake, AWS, and Anthropic. Preparation is essential because one response failed mid-incident with a 403 error from missing permissions.

Unit 42 recommends short-lived credentials, inventories of AI endpoints, automated containment, and hunts for patterns such as bursts of API requests and parallel authentications. The guidance mirrors Unit 42’s finding that attackers relied on coordination rather than new exploitation, moving through ordinary exposures faster.

The vendors disagree on how much response to automate. Exaforce prefers low-friction autonomous response without requiring human approval, while ETCISO argues that full autonomy is wrong because people must keep judgment and accountability. ETCISO says the automatic reaction to automate everything is wrong because many security decisions need human context. Deciding whether an anomaly is malicious, whether a system can go offline, whether an alert matters to the business, and whether a response causes more harm than the attack requires judgment.

The speed gap has roots in a 2022 McKinsey warning that AI, machine learning, and automation could squeeze an entire attack lifecycle from weeks into days or hours, and McKinsey described cybercrime then as a commercialized ecosystem with organization, investment, and research capacity. The World Economic Forum’s 2026 position is that AI strengthens defense only when embedded in sound governance, continuous monitoring, and human oversight. The attack surface is growing across endpoints, identities, cloud workloads, and IoT even as attackers speed up. Defenders face a backlog of vulnerabilities, identities, cloud workloads, endpoints, SaaS applications, third-party connections, alerts, and business priorities, while attackers operate at machine speed using automation and AI; under the proposed operating model, technology handles scale and routine containment while people keep judgment, ambiguity, and accountability.

The entry-point picture is shifting. Verizon’s 2026 DBIR calls exploitation of software vulnerabilities the top entry point at 31 percent, surpassing stolen credentials for the first time. IBM’s 2026 X-Force research shows a 44 percent year-on-year increase in attacks that start with public-facing application exploitation, and IBM found that attackers can exploit 56 percent of disclosed 2026 vulnerabilities without authentication. Verizon says AI speeds up exploitation of known vulnerabilities from months toward hours, and many intrusions start with basic weaknesses, so AI security adds to fundamentals such as asset visibility, patch governance, exposure management, secure configuration, and identity controls.

Defensive spending keeps climbing. McKinsey recorded roughly $200 billion in cybersecurity outlays for 2024 against $140 billion in 2020, with about 65 percent of budgets going to third-party products and services. The customer conversation should shift away from a catalogue of tools toward cyber-readiness and operating speed.

Exaforce sells an Agentic SOC platform with optional managed detection and response, and detection engineering, alert triage, investigations, threat hunting, and response all fall to its Exabots. The platform runs more than 800 AI/ML anomaly detections across Cloud, SaaS, Identity, Endpoint, and AI services, and its agents carry out more than 100 dynamic response actions. Exaforce collected $125 million in Series B funding at a $725 million valuation, a year after a $75 million Series A, bringing total funding to $200 million. Commercial availability began in the fourth quarter of 2025, following two years of testing, and the platform now serves 20 customers, including Replit and Guardant Health, and expects 40 to 50 customers by year’s end; the company claims its AI platform reduces manual security work by as much as 90 percent.

Artemis came out of stealth with $70 million in combined seed and Series A funding from Felicis, six months after its founding. Artemis processes billions of events per hour in production for technology and financial services customers.

NTT DATA broadened its Palo Alto Networks partnership to include AI for security and security for AI. Palo Alto Networks posted $3 billion in quarterly revenue, up 31 percent, and Next-Generation Security ARR of $8.13 billion, up 60 percent, in its Q3 FY26 8-K. In May, Okta chief executive Todd McKinnon said 91 percent of enterprises deploy AI agents while only 22 percent can identify them. CrowdStrike’s George Kurtz said AIDR annual recurring revenue grew more than 250 percent sequentially from a small base and could exceed EDR.

Abhijit Dubey, global CEO of NTT DATA, via CNBC, said, “when you have attacks that are operating on machine speed, you cannot have defense. That is human speed.” Shachar Hirshberg, co-founder and CEO of Artemis, said, “We built Artemis as an AI-native defense system from the ground up.”