AI Attacks Now Steal Your Data in 72 Minutes: The SMB Response Playbook That Keeps You Ahead

TL;DR

  • New research from Palo Alto Networks confirms AI-powered attacks now move from initial access to data theft in as little as 72 minutes — four times faster than a year ago [1].
  • The majority of successful breaches (90%) exploit misconfigurations and security gaps, not exotic zero-days [1] — meaning most are preventable.
  • 65% of attacks start with stolen credentials or social engineering, not malware [1] — fixing identity is the highest-value investment a small business can make.
  • This guide gives you the three concrete actions that close the gaps attackers are actually using.

Speed used to be on your side. An attacker got in, then spent days or weeks moving around your systems before stealing anything. Your team had time to notice something was wrong. That window is closing fast.​‌‌​​​​‌‍​‌‌​‌​​‌‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​‌​​‍​‌‌‌​‌​​‍​‌‌​​​​‌‍​‌‌​​​‌‌‍​‌‌​‌​‌‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​​‌‌​‌‌‌‍​​‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌​‌‌​‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​‌‌‌​‌​‌‍​‌‌‌​‌​​‍​‌‌​​‌​‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​‍​​‌​‌‌​‌‍​‌‌‌​​‌​‍​‌‌​​‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​​​​‍​‌‌​‌‌‌‌‍​‌‌​‌‌‌​‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌‌​​​​‍​‌‌​‌‌​​‍​‌‌​​​​‌‍​‌‌‌‌​​‌‍​‌‌​​​‌​‍​‌‌​‌‌‌‌‍​‌‌​‌‌‌‌‍​‌‌​‌​‌‌‍​​‌​‌‌​‌‍​​‌‌​​‌​‍​​‌‌​​​​‍​​‌‌​​‌​‍​​‌‌​‌‌​

According to Palo Alto Networks' 2026 Global Incident Response Report — based on analysis of more than 750 major incidents across more than 50 countries — the fastest attacks now move from initial access to complete data exfiltration in just 72 minutes [1]. That's down from nearly five hours in 2024 [1][2]. The acceleration is being driven by AI: threat actors are using automation to compress every phase of an intrusion, from reconnaissance to lateral movement to data theft.

This isn't just an enterprise problem. The same tools, techniques, and automation that let attackers breach a Fortune 500 company faster are being used against regional law firms, healthcare practices, accounting firms, and retail businesses. If your business holds customer data, financial records, or operational systems, you're a target — and attackers now have a much tighter clock.​‌‌​​​​‌‍​‌‌​‌​​‌‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​‌​​‍​‌‌‌​‌​​‍​‌‌​​​​‌‍​‌‌​​​‌‌‍​‌‌​‌​‌‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​​‌‌​‌‌‌‍​​‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌​‌‌​‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​‌‌‌​‌​‌‍​‌‌‌​‌​​‍​‌‌​​‌​‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​‍​​‌​‌‌​‌‍​‌‌‌​​‌​‍​‌‌​​‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​​​​‍​‌‌​‌‌‌‌‍​‌‌​‌‌‌​‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌‌​​​​‍​‌‌​‌‌​​‍​‌‌​​​​‌‍​‌‌‌‌​​‌‍​‌‌​​​‌​‍​‌‌​‌‌‌‌‍​‌‌​‌‌‌‌‍​‌‌​‌​‌‌‍​​‌​‌‌​‌‍​​‌‌​​‌​‍​​‌‌​​​​‍​​‌‌​​‌​‍​​‌‌​‌‌​

Here's what the research actually shows, and what you can do about it.

Why Are AI-Powered Attacks So Much Faster?

The speed increase isn't magic — it's automation doing what automation does best: eliminating human bottlenecks. Attackers used to manually probe systems, test credentials, and map networks. AI agents now do that work in parallel, at machine speed.

The Unit 42 report found that 87% of attacks unfolded across two or more attack surfaces simultaneously — endpoints, cloud environments, SaaS applications, and identity systems, all targeted at once [1]. In some incidents, activity occurred across as many as 10 different fronts at the same time. That's not something a human attacker does. That's automated.

For your business, this means the old model of "we'll notice if something looks weird" gets harder to rely on. By t

he time unusual activity shows up in logs, an automated attacker may already be in, pivoted, and exfiltrating.

Related: How AI-Powered Phishing Is Changing the Game for SMBs

Where Are Attackers Actually Getting In?

The research here is valuable because it tells you exactly where to focus. According to the Unit 42 data [1]:

  • 65% of initial access came from identity-based techniques — social engineering, phishing, and credential theft.
  • 22% came from unpatched vulnerabilities — exploiting known security flaws that hadn't been patched.
  • 48% of incidents involved the browser as an attack surface — credential theft through phishing sites, malicious extensions, and session hijacking.
  • Third-party SaaS applications were involved in 23% of incidents, with attacks abusing OAuth tokens and API keys to move between connected systems [1].

Critically, 90% of data breaches were linked to misconfigurations or security gaps — not sophisticated zero-days [1]. Attackers are not primarily winning with exotic tools. They're winning because businesses leave doors open.

According to the 2025 Verizon Data Breach Investigations Report, 81% of hacking-related breaches involve compromised or weak credentials [3]. The pattern is consistent across every major threat report: your passwords and your configurations matter more than your perimeter.

The Three-Fix Playbook for SMBs

You don't need a security operations centre to respond to this. You need to close the three gaps attackers are actually walking through.

Fix 1: Treat Identity as Your Primary Security Layer

If 65% of attacks start with identity compromise, identity is where your investment pays off most. That means:

  • Multi-factor authentication (MFA) on everything — email, accounting software, cloud services, admin portals. NIST SP 800-63B makes MFA a foundational identity control [4].
  • Password manager adoption — unique credentials per service, enforced across your team.
  • Privileged access review — quarterly audit of who has admin rights and whether they still need them. Remove access when people leave or change roles.
  • Phishing-resistant MFA where possible (hardware keys or passkeys rather than SMS codes, which can be intercepted).

Identity controls are the single highest-ROI security investment for a small business because they directly address how most attacks begin [5].

Fix 2: Fix Your Configurations Before Attackers Find Them

With 90% of breaches linked to misconfigurations [1], a configuration audit is one of the most practical things you can do right now. Common misconfigurations that attackers exploit:

  • Publicly exposed remote access services (RDP, VPNs) with weak authentication.
  • Cloud storage buckets or databases with open public access.
  • Excessive permissions — service accounts or user accounts with far more access than they need.
  • Default credentials on network devices, routers, or software.

The Australian Signals Directorate's Essential Eight framework provides a clear baseline for SMB configuration hardening, including application control, restricting admin privileges, and patching [6]. Working through the Essential Eight Maturity Level 1 controls eliminates the most commonly exploited misconfigurations.

Related: Stop Patching Everything: The 1% Rule That Keeps SMBs Secure

Fix 3: Shrink Your Response Window

You can't outpace an automated attacker with manual processes. The answer isn't paranoia — it's setting up lightweight automated detection that flags the most dangerous signals automatically.

Practical steps for an SMB:

  • Enable login alerts on all critical accounts — be notified immediately when someone logs in from an unusual location or device.
  • Centralise your logs — even a simple SIEM (security information and event management) tool gives you one place to look when something feels off. CrowdStrike's 2025 Global Threat Report found that organisations with centralised visibility detect breaches significantly faster [7].
  • Set up automated backup verification — if ransomware hits, your recovery speed depends entirely on whether your backups are intact and current.
  • Have an incident response plan — a one-page document that tells your team what to do in the first hour of a suspected breach. The IBM 2025 Cost of a Data Breach Report found organisations with an IR plan save an average of $1.49 million per breach [8].

The goal isn't to respond at the same speed as the attacker — it's to detect the breach fast enough to limit what they take.

What Zero Trust Actually Means for a Small Business

The Unit 42 report recommends zero trust architecture as a key control for the modern threat environment [1]. This sounds enterprise-scale, but the core principle is straightforward: don't assume anything or anyone inside your network is automatically trusted.

For an SMB, zero trust translates to:

  • MFA for every login, even internal systems.
  • Least-privilege access — staff only have access to what they need for their role.
  • Segmented networks — your point-of-sale system shouldn't be on the same network as your admin workstations.
  • Continuous verification — regular access reviews, not just a one-time setup.

NIST's Zero Trust Architecture guidance (SP 800-207) provides a solid reference framework applicable to organisations of any size [9].

The Business Case: Why This Makes Financial Sense

The 2025 IBM Cost of a Data Breach Report puts the global average breach cost at $4.88 million [8]. For small businesses the numbers are lower, but so is the ability to absorb the hit. According to the National Cyber Security Alliance, 60% of small businesses close within six months of a major cyberattack [10].

That framing misses something important: security done right isn't a cost, it's what lets you grow. Businesses that can demonstrate strong security posture win contracts with larger clients, meet compliance requirements faster, and spend less time managing incidents. The investment in identity hygiene, configuration reviews, and basic detection tools pays for itself — and then some.

lilMONSTER works with small businesses to build exactly these capabilities: right-sized, practical, and built to grow with your business. Not enterprise security theatre, not bare minimum compliance checkbox. Real protection that makes operational sense.

Related: Why lil.business for Cybersecurity

FAQ

According to Palo Alto Networks' Unit 42 2026 Global Incident Response Report, the fastest attacks now move from initial access to data exfiltration in just 72 minutes [1]. This is four times faster than the equivalent figure from 2024, driven by AI and automation tools used by threat actors to accelerate every phase of an intrusion.

The Unit 42 report found that 65% of initial access in 2026 came from identity-based techniques — primarily credential theft and social engineering such as phishing [1]. This aligns with Verizon's 2025 DBIR finding that 81% of hacking breaches involve compromised credentials [3]. Patching software matters, but fixing your identity security matters more.

Based on industry research, the three highest-impact controls for SMBs are: (1) multi-factor authentication across all systems, (2) configuration reviews to eliminate exposed services and excessive permissions, and (3) basic automated detection and alerting. These address the most common attack entry points without requiring enterprise-scale tools or budgets.

Zero trust for an SMB means applying three practical principles: every login requires MFA; every user has only the access they need; and access is reviewed regularly rather than set and forgotten. You don't need dedicated infrastructure — you need consistent policy applied across your existing tools.

Common indicators include: unexpected login alerts from unfamiliar locations, staff reporting unusual account behaviour, systems running slower than normal, unexpected files or encrypted data, and unusual outbound network traffic. The best approach is to have log centralisation and alerting set up before an incident, so you're notified automatically rather than discovering a breach after the fact.

References

[1] Palo Alto Networks Unit 42, "2026 Global Incident Response Report," Palo Alto Networks, Feb. 2026. [Online]. Available: https://unit42.paloaltonetworks.com/

[2] SecurityBrief Australia, "AI-fuelled cyber attacks now steal data in 72 minutes," SecurityBrief AU, Feb. 2026. [Online]. Available: https://securitybrief.com.au/story/ai-fuelled-cyber-attacks-now-steal-data-in-72-minutes

[3] Verizon, "2025 Data Breach Investigations Report," Verizon Business, 2025. [Online]. Available: https://www.verizon.com/business/resources/reports/dbir/

[4] National Institute of Standards and Technology (NIST), "SP 800-63B: Digital Identity Guidelines — Authentication and Lifecycle Management," NIST, 2017 (rev. 2022). [Online]. Available: https://pages.nist.gov/800-63-3/sp800-63b.html

[5] Computerworld, "Faster Cyberattacks: AI Shrinks the Time From Breach to Impact," Computerworld, Feb. 2026. [Online]. Available: https://www.computerworld.com/podcast/4138047/faster-cyberattacks-openclaw-npm-bypass-skillsbench-human-guidance-ep-52.html

[6] Australian Signals Directorate, "Essential Eight Maturity Model," Australian Cyber Security Centre, 2025. [Online]. Available: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight

[7] CrowdStrike, "2025 Global Threat Report," CrowdStrike, 2025. [Online]. Available: https://www.crowdstrike.com/global-threat-report/

[8] IBM Security, "Cost of a Data Breach Report 2025," IBM, 2025. [Online]. Available: https://www.ibm.com/reports/data-breach

[9] National Institute of Standards and Technology (NIST), "SP 800-207: Zero Trust Architecture," NIST, Aug. 2020. [Online]. Available: https://doi.org/10.6028/NIST.SP.800-207

[10] National Cyber Security Alliance, "Small Business Cybersecurity," StaySafeOnline, 2024. [Online]. Available: https://staysafeonline.org/resources/small-business-resources/

Is your business ready to respond at machine speed? lilMONSTER builds right-sized security for growing businesses — practical, no-enterprise-budget-required. Book a free consultation today.

Hackers Can Now Rob Your Business in 72 Minutes (And How to Make That Really Hard)

TL;DR

  • AI now lets hackers get into your business and steal your data in as little as 72 minutes — four times faster than last year.
  • Most of the time, they get in using stolen passwords, not fancy hacking tools.
  • Three things fix most of it: better passwords + two-factor login, a security check-up on your settings, and an alert system so you know fast when something's wrong.

Imagine your business is a house. Last year, a burglar would break in, then spend hours quietly walking around before grabbing anything — plenty of time for a neighbour to notice and call the police.

This year? That same burglar has a robot helper that does everything at once. One robot tests every window. Another picks the lock. A third is already loading the van. The whole job now takes 72 minutes, not five hours.

That's exactly what new research from cybersecurity company Palo Alto Networks found [1]. Their team studied over 750 real cyberattacks and discovered that hackers with AI tools can now get into a business and steal data in just 72 minutes. Last year it took about five hours. The year before, even longer.

How Are They Getting In?

Here's the part that should actually reassure you: most of the time, they're not using some super-sophisticated secret weapon. They're using your password.

Two out of three attacks started because someone clicked a dodgy link or used a weak password that got guessed or stolen [1]. The research found that stolen logins were involved in the majority of breaches — not high-tech hacking [2].

Think of it like this: a burglar doesn't need to pick your lock if you leave the key under the doormat. Most attacks work because of the digital equivalent of a key under the mat.

The other big one? Settings that weren't configured properly. Nine out of ten breaches happened because of a misconfiguration or a gap in security — not because hackers cracked some unbreakable code [1]. That's doors left unlocked, not vaults being drilled open.

So What Do I Actually Do?

Three things close the biggest gaps.

1. Two-factor login everywhere (MFA)

This is your single biggest return. Even if a hacker steals your password, two-factor login (where you also have to approve via your phone) stops them getting in. It's like having a second lock — even if they copy your key, they can't open the door without your fingerprint.

Turn it on for: your email, your accounting software, your cloud storage, your website admin. All of it.

2. Check your settings

Schedule one hour this month to go through your accounts and ask:

  • Do my staff have access to things they don't need?
  • Are any services open to the internet that shouldn't be?
  • Are any passwords still on default?

This is the digital equivalent of checking all your windows are shut before you go to sleep. Not glamorous. Extremely effective.

3. Set up alerts so you find out fast

If someone logs into your email from another country at 3am, you want to know immediately — not three weeks later. Most email and cloud services let you turn on login notifications for free. Do it now.

The faster you know something's wrong, the less damage gets done. A breach caught in 30 minutes causes far less damage than one caught after a week.

The Good News

Here's the thing: fast attacks exist because AI helps hackers automate the boring parts. But AI can also help defenders. And more importantly, most attacks still rely on the same old entry points — weak passwords and misconfigured systems.

Fix those two things, and you've closed the door on the majority of attacks. You don't need an enterprise security team. You need good habits and basic tools — set up properly.

lilMONSTER helps small businesses do exactly this: an honest look at your current setup, fix the most important gaps, and build something that grows with your business. Protecting what you've built doesn't have to be complicated.

FAQ

Q: What is the main security concern covered in this post? A:

Q: Who is affected by this? A:

Q: What should I do right now? A:

Q: Is there a workaround if I can't patch immediately? A:

Q: Where can I learn more? A:

References

[1] Palo Alto Networks Unit 42, "2026 Global Incident Response Report," Palo Alto Networks, Feb. 2026. [Online]. Available: https://unit42.paloaltonetworks.com/

[2] SecurityBrief Australia, "AI-fuelled cyber attacks now steal data in 72 minutes," SecurityBrief AU, Feb. 2026. [Online]. Available: https://securitybrief.com.au/story/ai-fuelled-cyber-attacks-now-steal-data-in-72-minutes

[3] Verizon, "2025 Data Breach Investigations Report," Verizon Business, 2025. [Online]. Available: https://www.verizon.com/business/resources/reports/dbir/

Ready to close the gaps before someone else finds them? Book a free 30-minute security check-up with lilMONSTER.

Ready to strengthen your security?

Talk to lilMONSTER. We assess your risks, build the tools, and stay with you after the engagement ends. No clipboard-and-leave consulting.

Get a Free Consultation