In 2025, the average eCrime breakout time, the gap between an attacker’s first foothold and their first move to a second system, fell to 29 minutes. That’s according to CrowdStrike’s 2026 Global Threat Report, and it’s a 65 percent jump in speed over the year before. The fastest breakout the report recorded took 27 seconds. In one intrusion, the attacker was pulling data out four minutes after getting in.
If your incident response plan assumes there’s time for an alert to land, a ticket to open, and a human to route it to the right playbook, that plan was already tight in 2024. In 2025 it became optimistic. For a growing number of intrusions, it’s fictional.
That plan is what most enterprise security programs bought when they invested in SOAR.
What SOAR Was Actually Built to Do
Security Orchestration, Automation, and Response platforms do exactly what the name says: they connect your tools, automate the repetitive steps, and manage an incident from alert to resolution. A phishing alert comes in, matches a known pattern, the platform detonates the link in a sandbox, checks the verdict, and closes the ticket or escalates it. That’s the model, and for a long time it was the right one. Most of what a SOC deals with repeats: the same phishing kits, the same commodity malware families, and the same credential-stuffing patterns. Writing a playbook once and running it thousands of times was, and still is, a legitimate way to buy back analyst time.
The category isn’t going away, and the execution layer underneath it isn’t going away either. Something still has to isolate the host, revoke the session, and block the domain, with an audit trail and a rollback path. Even the vendors calling SOAR obsolete agree on that part.
The Playbook Problem
The part that’s actually breaking down is the authoring model: the idea that your team can pre-write a playbook for every incident type it can imagine, then maintain that library forever as your tools, APIs, and threat landscape all keep changing. Gartner has been blunt about the cost of that maintenance burden, describing SOAR as requiring the same ongoing coding and operational upkeep as any other software development practice, and noting that justifying the expense remains a real obstacle for buyers.
The structural issue is simpler than the vendor debate makes it sound: a playbook only fires when the incident in front of it matches a pattern someone already wrote down. Anything outside that pattern doesn’t get automated. It waits for a human, or it doesn’t get flagged at all until someone notices manually. That gap used to be tolerable, because most attackers were slow enough that a human had time to catch what the automation missed.
A team that detects an intrusion at minute 20 and takes 15 minutes to escalate has already lost, if the attacker is done in 29.
That tolerance is gone. When the average breakout is under half an hour and the fastest on record is 27 seconds, the time budget for “a human will catch what didn’t match the playbook” has effectively disappeared.
The Attacker Side Already Moved
The same CrowdStrike report found an 89 percent year-over-year increase in attacks by AI-enabled adversaries, and that 82 percent of all detections in 2025 were malware-free, up from 51 percent in 2020. Those two numbers together describe exactly the kind of incident a static playbook is worst at catching: no file to fingerprint, and behavior that adapts rather than repeats.
The named cases in the report make the point concrete. Russia-linked FANCY BEAR deployed an LLM-enabled malware family, tracked as LAMEHUG, to automate reconnaissance and document collection instead of running the same scripted steps every time. The financially motivated group PUNK SPIDER used AI-generated scripts to speed up credential dumping and to erase forensic evidence, meaning the cleanup step itself was generated fresh rather than pulled from a fixed toolkit. North Korea-linked FAMOUS CHOLLIMA used AI-generated personas to scale insider operations, a tactic that doesn’t produce a file, a hash, or a signature at all.
None of that is rare anymore. It’s a documented, named pattern across multiple threat actors in a single year. A playbook branch written for “known ransomware family X” or “this specific phishing kit” has no equivalent branch for an attacker who writes new reconnaissance code, drafts a new lure, and clears logs differently each time it runs.
Our own IR team has worked incidents with exactly this shape, where the entry point is AI-assisted and the payload is destructive in ways no signature anticipated. We covered the first of these cases in New Attack Vector: AI-Induced Destruction, and the broader forensic framework we now use to tell an AI-driven incident apart from a human attacker in The AI Incident Response Framework. Both cases share the same root problem this post is about: a fixed rule set has no branch for behavior that wasn’t anticipated when the rule was written.
Even the Playbook Vendors Are Saying It
This isn’t us picking a fight with a category we don’t even sell into. It’s the position the SOAR vendors themselves have moved to. When CrowdStrike launched its own agentic orchestration layer this year, the company’s president said openly that security operations can no longer keep pace with AI-accelerated attackers using static, rule-based automation alone. That’s a SOAR vendor arguing against the limits of the model it built its business on, which is a stronger signal than anything a challenger could say.
Gartner’s own Hype Cycle for Security Operations tells a similar story from the analyst side. AI SOC agents jumped from the Innovation Trigger to the Peak of Inflated Expectations in a single year, even though market penetration is still only 1 to 5 percent. That combination, fast narrative movement and low real adoption, is exactly the gap CISOs should expect to see questioned in any board presentation.
Worth saying plainly, because this audience doesn’t need another vendor overselling a category: Gartner has also warned about “agent washing,” the rebranding of existing chatbots, RPA tools, and assistants as agentic without any real autonomous capability behind them, and estimates that only around 130 of the thousands of vendors making agentic AI claims are genuine. Gartner separately forecasts that more than 40 percent of agentic AI projects will be shelved by the end of 2027 over cost, unclear value, or missing risk controls. The shift away from static playbooks is real. Not every product claiming to replace them is.
What Actually Has to Replace the Playbook
The requirement underneath all of this is straightforward to state and hard to build: a system that reasons over live evidence at the moment of the incident, instead of matching that evidence against a library of patterns written months earlier. That’s a different engineering problem than orchestration, and it’s why the vendors moving fastest here are rebuilding the reasoning layer, not just adding a chatbot on top of the old one.
There’s a second distinction CISOs should hold onto, separate from the software question entirely: a system that can reason its way to a verdict is not the same thing as a team that can act on that verdict during a live breach. An investigation engine that tells you what happened is useful. It doesn’t triage your call at 2 a.m., contain a host, or sit on a war room bridge with your legal and comms teams while the clock is still running.
That pairing, a reasoning layer built from real casework and a human incident response team who acts on what it finds, is the model we rebuilt Rapid-IR around. We wrote about why in Why We Reforged Rapid-IR From the Ground Up: Deep Breach Focus is our proprietary AI, trained on our own incident casework rather than general internet-scraped patterns, and it feeds directly into the IR team behind the 20-minute guaranteed response. The platform doesn’t replace the team. It removes the 29 minutes of dead time between detection and a person with context actually starting to work the case.
The Question to Bring to Your Next Renewal
Before you renew a SOAR contract, or sign a retainer built around break-glass response, it’s worth asking two questions directly: what happens when the attacker’s behavior doesn’t match any playbook you’ve written, and how long does it take a human with real context to get involved once it doesn’t. If the honest answer to either question is measured in hours, the plan was built for a slower attacker than the one CrowdStrike is now describing.
We’ll go deeper on where the line actually sits between a fast human attacker and a genuinely autonomous one in a companion piece.
Related posts
Check your readiness: GenAI Readiness Assessment
Talk to us:
