The AI era radically transforms Breach and Attack Simulation

The average time to develop an exploit from a known vulnerability has dropped to about ten hours, as highlighted by the [Zero Day Clock](https://zerodayclock.com). This unprecedented acceleration, made possible by frontier AI models, has rendered the traditional human approach to attack simulation obsolete.

Rapid Response

  • The time between vulnerability disclosure and exploit creation has dropped to about 10 hours
  • Over 130 new CVEs are published daily
  • Less than 0.5% of disclosed vulnerabilities are actually patched
  • AI models are radically changing the dynamics between offenders and defenders
    • Over 130 new Common Vulnerabilities and Exposures (CVE) are published every day, according to data from the [Forum of Incident Response and Security Teams](https://www.first.org/blog/20251229-Vulnerability-Forecast-Review). This constant flow of vulnerabilities, combined with the slowness of patches, creates a perfect environment for attackers exploiting AI models similar to those used by defenses. The [Picus Blue Report 2026](https://helpnet.short.gy/vX8ixv), which aggregates 338 million attack simulations performed in the first half of 2026, reveals that only 69% of attacks are prevented by current controls. This means that about one-third of attacks manage to bypass defenses. The report highlights two main causes for detection rule failures: performance issues (49%) and gaps in log collection (41%). The latter are particularly dangerous because they generate no alarms, making it impossible to detect suspicious behavior.

    The limitations of traditional BAS

    The current approach to Breach and Attack Simulation (BAS) has three structural limitations that have become critical in the era of high-speed attacks: 1. Dependency on scheduling: Tests are performed at fixed intervals, leaving a period of vulnerability between one simulation and another 2. Inability to respond to new CVEs: Manually verifying coverage for each new vulnerability takes four to six hours per CVE 3. Resource-intensive post-test process: Translating results into operational rules is still a manual process The Blue Report data shows that the ten least prevented vulnerabilities in 2026 are found in everyday software such as browsers, archiving utilities, and operating system components, with blocking rates below 25%.

    The agentic solution

    The agentic approach to BAS represents a significant breakthrough. This system closes the simulation, validation, correction, and verification loop, automating critical processes:
  • Automatic threat building: The AI Threat Builder creates playable simulations in a few minutes
  • Automatic and safe simulations: Tests are performed against production controls without risks
  • Vendor-specific corrections: Each gap identified generates a correction specific to the security system used

    • Innovation in threat translation

    Picus's method for threat processing represents a further step forward. The system analyzes threat intelligence sources in various formats (CISA alerts, blogs, PDFs, CVE IDs, threat group names) and creates simulations mapped to ATT&CK in about nine minutes. This ability to simulate exploitation behavior without needing operational exploits allows testing KEV (Known Exploited Vulnerabilities) the same morning they are published. Each relevant vulnerability is classified as blocked, detected, or with hidden residual risk, with compensation rules ready for use when the patch is not yet available.

    The five pillars of BAS in the AI era

    To distinguish a modern BAS system from a traditional one, five key characteristics: 1. Signal-based execution: Tests are initiated by changes in systems, not by a calendar 2. Immediate testing for new CVEs: Vulnerabilities can be tested without needing operational exploits 3. Comprehensive failure diagnosis: Every missed detection is analyzed in detail 4. Vendor-specific corrections: Solutions are ready for immediate implementation 5. Scalability without additional costs: The system does not require an increase in personnel These elements transform BAS from a periodic process into a continuous and adaptive defense system, crucial for addressing the threats of the AI era.

    The market for BAS solutions in the AI era

    The global Breach and Attack Simulation market is estimated at $1.2 billion in 2026, with an annual growth rate of 42% expected until 2030. This boom is driven by the urgent need to address high-speed threats, as demonstrated by the 300% increase in investments in cyber insurance solutions over the last two years. Companies adopting advanced BAS are experiencing a 60% reduction in incident response times, according to Gartner data.

    Implications for companies and security professionals

    For cybersecurity managers, the adoption of agentic BAS solutions represents a strategic turning point. Companies implementing these systems can drastically reduce operational costs related to vulnerability management, with an average savings of 40% in NIS2 and DORA compliance costs. Furthermore, the automation of simulation and correction processes allows human resources to be allocated to higher-value activities, such as risk management and security strategy.

    The importance of continuous training

    With the evolution of threats and defense technologies, continuous training of security professionals has become crucial. ISO 27001 certifications and skills in zero trust architecture are now fundamental requirements for security teams. Companies are investing in upskilling programs for their employees, with a 25% increase in training budgets in 2026.

    The future of BAS: forecasts and trends

    The widespread adoption of advanced AI models in the cybersecurity sector is radically transforming the threat landscape. It is predicted that by 2030, 70% of companies will use agentic BAS solutions to manage vulnerabilities in real time. This transition will require a significant cultural shift, moving from a reactive to a proactive mindset in security management.

    Future challenges

    Despite technological advancements, significant challenges remain. Managing false positives and the need to maintain a balance between automation and human control are critical areas for improvement. Additionally, integrating BAS solutions with other security systems, such as SIEMs and corporate DLP, will require further developments to ensure optimal interoperability.

    Conclusions

    The AI era is redefining how organizations address cyber threats. The adoption of agentic BAS solutions is a fundamental step toward more robust and adaptive cybersecurity. For security professionals, the ability to manage these advanced technologies will be crucial to protecting companies in an ever-evolving threat landscape.

    Frequently Asked Questions

    What is the average cost of implementing an agentic BAS solution?

    The average cost of implementing an agentic BAS solution ranges between €50,000 and €200,000 per year, depending on the size of the organization and specific security needs.

    How much time is needed to train a team to manage an advanced BAS system?

    Training a team to manage an advanced BAS system typically requires between 40 and 80 hours of coursework, depending on the initial level of competence and the complexity of the system.

    What are the main advantages of an agentic BAS system compared to a traditional one?

    The main advantages of an agentic BAS system include the automation of simulation and correction processes, the reduction of incident response times, and the ability to manage vulnerabilities in real time.

    Editorial Note and Disclaimer

    The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

    GoYou does not constitute a journalistic publication or an editorial product under Law No. 62/2001 and does not provide real-time information.

    The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.

    In the Crypto sector, every investment involves risks: readers are invited to always inform themselves independently before making any decision.