Autonomous Attacks Are Already Here. The Defense Has to Match Their Speed.

Autonomous attacks have arrived, necessitating a defense capable of matching the speed of these threats. The current threat landscape involves agentic attacks where code writing is also automated, leading to a rapid increase in security issues across enterprise environments. Threat detection times have drastically shortened, with the fastest breakout time recorded at 27 seconds, and average response times measured in minutes rather than months.
The proposed defense strategy for this speed demands a parallel process: Discover, Remediate, Validate, and Prevent. The risk calculation shifts from likelihood times impact to account for an attacker’s ability to chain multiple low-impact vulnerabilities. A proactive approach involves testing high-impact applications using adversarial methods, as demonstrated by Snyk’s Evo Continuous Offensive Security. Furthermore, achieving backlog zero is being pursued by some customers through remediation agents built on large language models. The focus is shifting toward prevention by integrating security context directly into the creation point via tools like Snyk Studio.

* Snyk CTO Manoj Nair discussed autonomous attacks with Anthropic’s Alon Krifcher on October 7, 2026.
* New security issues in enterprise environments have grown more than 2X quarter over quarter.
* The fastest recorded breakout time for a threat was 27 seconds according to CrowdStrike.
* Autonomous attackers can chain three low or medium vulnerabilities into a higher-impact issue.
* Snyk built Evo Continuous Offensive Security to test applications against autonomous attack methodologies.
* Some Snyk customers are achieving backlog zero using remediation agents based on Claude.
* Snyk built Snyk Studio to provide security context to code-writing agents during creation.
* Nearly 1,500 customers are currently running Snyk Studio in production.
* Snyk noted a three-to-one ratio of models to agentic components across nearly 3,000 customers using its AI bill of materials.
* The proposed metric for security progress is the ratio of new findings versus findings closed for top applications.

The narrative pivots on the asymmetry between the speed of autonomous attack execution and the pace of traditional defensive processes. The shift from time-based defense to continuous, agentic action reveals a deeper structural problem: the separation between development/creation and security enforcement. The observation that remediation is becoming less about fixing individual tickets and more about measuring throughput—specifically, how much code can be rewritten autonomously without human intervention—points toward a future where the constraint shifts from vulnerability count to agentic capability.
The focus on prevention embedded at the point of creation suggests an inevitability regarding the role of agents in the software lifecycle. If security context is baked into the agent's environment, the risk surface moves from runtime patching to initial architectural trust. The tension exists between outsourcing complex reasoning to AI partners and maintaining human control over high-stakes systems. Who bears the cost when automation succeeds or fails? And if the defense strategy relies on measuring autonomous remediation velocity rather than simple remediation volume, are we implicitly endorsing a level of agentic autonomy that requires new governance structures?
Bridge Questions: What are the long-term systemic risks associated with relying on agentic reasoning for security validation instead of human oversight? How should organizations define and measure "agentic remediation" throughput to ensure it aligns with actual risk reduction rather than mere activity? If autonomous agents become the primary defenders, what new security expertise must be prioritized in the workforce?