Why knowing about a threat isn't the same as stopping it
Attackers are turning fresh leaks and new bug disclosures into working break-ins faster than most defenders can read the alert.
Key points
- Stolen passwords sold on criminal marketplaces are being reused against live company accounts within hours of appearing for sale.
- Public vulnerability advisories are being turned into working attacks before many organisations finish assessing whether they are exposed.
- Attackers are using AI tools to speed up the writing of exploit code, shrinking the window defenders have to patch.
- Threat intelligence feeds warn about danger but do not, on their own, block it; the gap between knowing and acting is where breaches happen.
The pattern is familiar to anyone who watches identity attacks for a living. A batch of stolen logins turns up on a criminal marketplace. A vendor publishes an advisory about a flaw in its software. Either one can end up being used against a real company before the security team has finished reading the morning alerts.
That's the gap. Not a lack of information, but the time between knowing something is dangerous and actually doing something about it.
What is threat intelligence, in plain terms?
Threat intelligence is the feed of warnings security teams pay for: lists of leaked passwords, notes about new scams, alerts when a software flaw is being attacked in the wild. It's meant to give defenders a head start.
The problem, as The Hacker News laid out this week, is that a head start only helps if you can move. Most security programs are built around weekly patch cycles and ticket queues. Attackers aren't.
How are attackers moving so fast?
Two shifts are running at the same time. Criminals now buy ready-made access from marketplaces that operate like any other online shop, and they're using AI assistants to help write the code that turns a newly disclosed bug into a working attack. Brett Johnson, who built some of the first organised online crime networks, [showed security conferences exactly how fast this works](/ story/a-former-internet-godfather-explains-how-ai-gives-criminals-a-head-start) in our 2 September story.
A vulnerability disclosure, meaning the public notice a software maker publishes when it fixes a security hole, used to give defenders days or weeks before anyone built an exploit. That cushion is thinning. When an AI tool can draft functional attack code in an afternoon, assuming you have a quiet weekend to patch no longer holds.
On the identity side, the pattern is blunter. A password shows up in a leak. A bot tries it against a VPN portal or a cloud login page. If multi-factor authentication (MFA), the second check that asks for a code or a tap on your phone, isn't turned on, the attacker is inside. Honestly, MFA would stop a large share of these before they start. It's not a cure-all since phishing kits that steal session tokens are a real problem, but the baseline still matters.
What does the exposure-to-breach timeline actually look like?
| Stage | What happens | Typical defender response |
|---|---|---|
| Exposure | Credential leak posted, or CVE published | Alert lands in a queue |
| Weaponisation | Attacker or AI builds a working exploit | Team begins impact assessment |
| Exploitation | Attack runs against live targets | Patch or reset scheduled |
| Detection | Unusual login or process spotted | Incident response opens |
The rows used to be days or weeks apart. In a growing number of cases they're hours.
Should you worry about your own organisation?
Treat intelligence as a trigger, not a report. If a credential tied to your domain appears in a dump, force-reset the account and revoke its sessions automatically, not on Monday. If a CVE affects a product you run and it's being exploited, the patch window is measured against the attacker's clock, not your change-management calendar.
For identity specifically: turn on phishing-resistant MFA (passkeys or hardware keys, which can't be handed over by mistake), rotate refresh tokens, and shorten session lifetimes on anything sensitive. None of that is new advice. It's just advice that most environments still haven't finished acting on. Our coverage of credential theft on 10 September found identity abuse still doing most of the damage across real customer environments.
My read: the vendors selling "AI-powered threat intel" are solving the wrong half of the problem. The bottleneck isn't spotting the danger. It's the number of manual steps between the alert and the fix.
