Related Big Read: The task decomposition: why agentic AI breaks many of controls organisations you think you have in place
Related assets: Human and machine speed: the growing trust gap; Shadow agents as shadow workforce risk
When attackers and defenders can both operate faster than traditional testing cycles, governance must define which actions can move at machine speed and which must wait.
AI is no longer only assisting cyber operations at the margin.
In the 15 November 2025 edition, the stronger signal was operational: AI was beginning to carry meaningful work inside attack chains. Malware research, state-sponsored abuse of coding agents, scaled phishing, and automated reconnaissance all pointed to the same threshold shift. Human labour was becoming less necessary for parts of the offensive process.
That does not mean defenders should automate everything in response.
It means they need a clearer governance model for how to act at speed.
The threshold question
Most security governance was built for human-speed work.
An alert is generated. A queue forms. An analyst reviews. Escalation happens. Approval is requested. A change window is negotiated. A containment decision is made.
That process path is still appropriate for many decisions.
It is not appropriate for all of them.
If an attack chain can form in minutes, some defensive actions need to be pre-authorised, bounded, observable, and reversible. The decision has to move earlier: not “shall we act now?” but “under which conditions can the system already be allowed to act?”
What good machine-speed governance requires
Machine-speed governance is not trust in automation.
It is constraint around automation.
The organisation must separate assistance from execution. It must define runtime boundaries. It must monitor behaviour, not only signatures. It must train staff to understand AI-enabled workflows. And it must preserve human decision points where delay is still a safety feature.
The bigger question is not whether speed is good or bad.
It is where speed is worth the risk of delegation.
Use this checklist to decide where defensive speed is justified. Work through the five areas before allowing an AI-enabled workflow or automated security action to execute without explicit human approval.
High-level checklist: machine-speed governance
Agentic separation
Separate systems that support human judgement from systems that can execute work.
Runtime constraint
Bound automated actions by environment, authority, and reversibility.
Detection model
Monitor behaviour and intent, not only static indicators.
Workforce readiness
Treat AI fluency as part of operational security readiness.
Governance to enforcement
Turn AI governance language into access, duration, and execution controls.
The executive test
Ask security leadership to name three defensive actions:
- One action that should remain human-approved.
- One action that can be automated within a narrow boundary.
- One action that should never be delegated to an AI-enabled workflow.
If that distinction does not exist, the organisation is not governing machine speed.
It is merely reacting to it.
