27-Second Lateral Movement, AI Attacks Surge by 89%: Jensen Huang on Cybersecurity

27 seconds—that’s the fastest time it has ever taken for cybercriminals to breach a company’s perimeter and move laterally into the next system.

At a recent cybersecurity industry summit, NVIDIA CEO Jensen Huang cited industry threat data to point out that global AI-driven cyberattacks have surged by 89% in a single year, and these attacks have become fully automated. When hackers launch intrusions at machine speed using algorithmic pipelines, any defense system built on “human reaction times (minutes or hours)” is no longer a defense in real-world scenarios—it has become nothing more than an “after-the-fact autopsy.”

This quietly unfolding turning point in cybersecurity reveals a fundamental restructuring of the logic underlying offensive and defensive operations in cyberspace.

I. 27-Second Record Break: The Attack Pipeline Is Now Completely “Automated”
In traditional cyberattacks, “breakout time”—the time it takes for an attacker to move laterally from an initially compromised device to other systems on the internal network—typically takes several hours or even days. Hackers must manually scan the internal network topology, probe for privilege vulnerabilities, export hashes, and map out their next steps.

But AI has changed everything. Attack scripts and AI agents have been given the ability to make autonomous decisions:

Internal Network Topology Sniffing in Milliseconds: The moment an onboard or client-side script takes control of a terminal, it can use a preconfigured small neural network to automatically identify the internal network structure, permission levels, and the locations of critical data assets.

Attack Rhythm: Dimensional Reduction Strikes: Industry statistics show that the average time for lateral movement in the global cybercrime industry has been reduced to 29 minutes, with extreme cases taking as little as 27 seconds. Within this window of just a few dozen seconds, attackers have already gained core control before an enterprise’s security operations center (SOC) team even has time to receive an alert or send a message via carrier pigeon.

II. No Viruses, Just "Legitimate Activities": Traditional Antivirus Software Is Completely Ineffective
Even more troubling is the evolution of attack methods: Today’s AI-powered cyberattacks are moving away entirely from traditional suspicious Trojans or malicious binary files.

Hackers are increasingly turning to "anti-detection" and "Living off the Land (LotL)" tactics:

Credential Theft and Legitimate Account Impersonation: Attackers no longer go to the trouble of writing malware that is easily detected by signature databases; instead, they use sophisticated phishing tactics—generated in bulk by large language models—to obtain high-value legitimate accounts, tokens, or API keys.

Weaponization of Standard System Tools: After the AI takes over a legitimate account, it calls exclusively on built-in or legitimate, whitelisted operational tools such as PowerShell, WMI, and Remote Desktop.

Extremely realistic behavior simulation: In the past, rule-based antivirus software relied on “virus signatures” or “anomalous behavior thresholds” to trigger alerts, but AI-driven attacks can actively mimic employees’ daily work rhythms, typing delays, and access habits, allowing them to covertly exfiltrate data through seemingly fully compliant routine network traffic.

III. Huang Renxun Warns: Cybersecurity Has Become a “Battle of AI Against AI”—a Fight Where Both Sides Are Harming Each Other
The widespread adoption of code automation has essentially created a double-edged sword. Huang Renxun stated bluntly that the paradigm shift in software engineering has caused the rate at which vulnerabilities emerge to increase exponentially, and that attackers and defenders are, in fact, engaged in a “battle against themselves”:

Attacker: An AI that tirelessly scans open-source components, decompiles firmware, and searches for zero-day vulnerabilities around the clock, while autonomously generating highly effective, targeted exploit scripts.

Defense Side: Another AI dynamically simulates attacks within the internal network environment, models hacker attack paths, and automatically generates real-time remediation strategies and defense rules to block threats.

Huang Renxun’s core conclusion is: “Automation driven by code will inevitably lead to an explosion of vulnerabilities; the only antidote to machine-based attacks can only be automated agents.” The old model—which relied on manual monitoring, trouble ticket submission, and multi-tiered approval processes to block IP addresses—has been thoroughly deemed a technical failure in the face of algorithm-driven, second-by-second saturation attacks.

IV. Defense Reconstruction: From “Perimeter Trust” to “Fully Automated Edge Contraction”
Faced with a 27-second attack-defense window and the reality of AI attacks surging by 89%, modern system architectures have no choice but to abandon the traditional assumption of a “hard exterior, soft interior” defense line and revert to the more ruthless principles of zero trust and physical isolation:

Micro-segmentation and Real-Time Access Revocation: Given that accounts can be compromised in a matter of seconds, communication permissions within the network must be granularized to the smallest possible level. As soon as the system detects even the slightest contextual anomaly in a credential, the intelligent defense system must have the authority to revoke access within milliseconds, without waiting for manual intervention.

Edge-Based Response: AI vs. AI—The focus of security has shifted entirely from centralized cloud-based analysis to edge devices. These devices must deploy lightweight analytical models to identify suspicious intentions at the process level—even when offline or in local mode—enabling on-the-spot mitigation within seconds.

Physical Defenses and Hardware Vaults for Core Assets: Since any networked system can be compromised in an instant, the most critical data assets, keys, and ledgers must be isolated from vulnerable public networks and stored in “digital vaults” or controlled nodes featuring hardware encryption and physical isolation, thereby severing the final link that enables hackers to move laterally.

Attacks have become fully automated; if defenses remain stuck in the era of human intervention and support tickets, it’s only a matter of time before the system falls. This silent battle, fueled by computing power and algorithms, has only just entered its truly critical phase.