TLDR: Runtime security built around detecting activity, correlating signals and then responding assumes there is enough time to act after something malicious happens. Machine speed attacks challenge that assumption because attackers can move across multiple MITRE ATT&CK tactics in seconds, with each successful action creating the conditions for the next. The issue is not whether a sensor based solution can respond quickly. It is whether the malicious operation has already executed before that response begins. Aqua takes a different architectural approach by operating at the kernel boundary, where malicious or unauthorized operations can be evaluated and blocked before they complete.
How Fast Can an Attack Move Through the MITRE ATT&CK Framework?
The graphic below shows how this problem becomes a reality, illustrating how quickly an attacker can move across seven MITRE ATT&CK tactic groups after gaining initial access. The point is not that every attack follows this exact sequence or timing. Each successful action expands what the attacker can do next, and several parts of the attack can unfold at the same time.
Initial Access: The sequence starts when the attacker gains a foothold in the environment. However, initial access does not alone determine the eventual impact. The risk comes from how quickly that foothold can be converted into greater access, control and movement. In this example, the attacker does not remain at the entry point for long. Within seconds, the activity has already progressed into credential theft, leaving very little time to investigate the initial event before the attack begins to expand.
Credential Access and Discovery: Within twenty seconds, credentials are stolen. A little over two minutes later, additional secrets are found. Credentials and secrets can give an attacker trusted access to other systems and resources, allowing them to use existing permissions as part of the attack path. Instead of having to compromise every target independently, the attacker can use legitimate access to reach deeper into the environment.
Privilege Escalation and Defense Evasion: Within the first minute, the attacker assumes additional IAM privileges. Privilege escalation to root follows and logs are later wiped. These actions expand what the attacker can do while also making the activity harder to investigate. Greater privileges can provide access to more sensitive resources and operations, while deleting logs can reduce the evidence available to defenders.
Execution and Persistence: The sequence moves into execution and persistence almost immediately. A container breakout occurs shortly after the first minute, a backdoor is established a few minutes later and the attack eventually spreads across additional pods. These actions show how quickly an initial compromise can turn into something broader. A breakout can extend the attack beyond the original container, while persistence gives the attacker a way to maintain access even as defenders begin responding.
Lateral Movement and Command and Control: Lateral movement begins within ninety seconds. Command and control are established later as the attacker continues expanding through the environment. At this point, the blast radius is no longer limited to the original workload. The attacker has begun moving beyond the first point of compromise and establishing the communication needed to coordinate continued activity.
Collection and Exfiltration: The attacker then begins gathering and removing valuable information. In the graphic, a database is dumped, object storage is drained and model weights are eventually stolen. By this point, earlier technical actions have created a direct business risk. Credential access, greater privileges and lateral movement have given the attacker a path to sensitive data and intellectual property.
Impact: The final phase includes ransomware staging and data destruction. These actions are the visible impact of an attack sequence that began with smaller operations only minutes earlier. The broader lesson is that the attacker does not need one long period of uninterrupted access to cause damage. The attack progresses through individual actions that build on one another and can overlap as the attacker moves across the MITRE ATT&CK framework.
Why Does AI Make Response Time an Architectural Problem?
AI is making the gap between attacker speed and defender speed harder to tolerate because malicious activity can increasingly be attempted at machine speed. Attackers can work through a much larger number of potential attack paths against an application, repeatedly testing techniques until something succeeds. The concern is not limited to whether AI creates a completely new exploit. It is that automation can increase the speed and volume at which potential paths are attempted.
That changes what a fast security response means. A response measured in seconds may represent a major improvement over one measured in hours, but meaningful malicious operations can still occur during those seconds. Security leaders therefore need to evaluate when the security decision happens in relation to execution, rather than relying only on how quickly an alert is generated or a response begins.
Why Do Current Approaches Leave Attackers Time to Act?
A detect, correlate and respond architecture begins with observation. The sensor sees activity, the platform determines what that activity means and a response follows. The limitation is that the security decision comes after execution.
If a credential has already been read, killing the process cannot make that credential “unread”. If a container breakout has completed, detecting it quickly cannot reverse the breakout. If lateral movement has already succeeded, containing the original workload does not remove access that may now exist elsewhere. Making this loop faster can reduce the attacker’s operating window, but it does not eliminate the architectural gap between execution and control.
Why Must Runtime Protection Operate at the Kernel Boundary?
The kernel boundary is where a workload asks the operating system to operate. That makes it a critical point for runtime security because the attempted action can be evaluated before it completes. Every stage shown in the attack sequence ultimately depends on execution. A process must run, a file has to be accessed, privileges have to change or a workload has to initiate activity that moves the attacker farther through the environment.
When enforcement happens at that point, security does not have to wait for the result of the operation to become telemetry before deciding whether it should have been allowed. This is the shift from visibility to control. Runtime is where applications execute and attacks occur, so it is also where security can control behavior in real time.
How Does Aqua Stop Malicious Actions Before They Execute?
Aqua places runtime enforcement at the kernel boundary so malicious or unauthorized operations can be evaluated before the kernel completes them.
This inline deterministic blocking model applies to behaviors such as container drift, breakout attempts, unauthorized file execution, secret access and lateral movement. Rather than detecting those actions after execution and then beginning a response, Aqua can deny the operation before it proceeds.
Container drift provides a simple example. If a new script appears inside a running container and attempts to execute, a sensor based approach may observe the script only after the kernel has allowed it to run. The platform can later terminate the process, but the script was still executing during that response window.
With Aqua enforcement enabled, the attempted execution can instead be denied at the kernel boundary, so the operation never proceeds into execution. Mapped back to the MITRE ATT&CK sequence, that distinction is significant. Rather than watching the attacker progress from one tactic to the next and trying to catch up, security has an opportunity to break the attack path at the individual operation level.
How Should Organizations Prepare for Machine Speed Attacks?
Security teams should evaluate their runtime architecture against the first seconds of an attack rather than the final containment time.
The MITRE ATT&CK sequence in the graphic makes the reason clear. Once initial access is established, an attacker can quickly begin stealing credentials, gaining greater privileges, executing new activity and moving across the environment. A security platform that must first observe each operation, correlate what happened and then initiate a response is working behind the attack.
Machine speed protection requires a different model. By operating at the kernel boundary, Aqua can evaluate malicious or unauthorized operations before they complete, giving security teams the ability to stop the attack path rather than simply respond to where the attacker has already been.
Because the security decision happens after the malicious activity has already executed. A sensor can observe what happened, correlate the activity and initiate a response, but that process still leaves a window in which the attacker can continue operating. As attacks move at machine speed, even a short delay can allow additional actions to succeed before containment begins.
The kernel boundary is where a workload asks the operating system to perform an action. That gives security an opportunity to evaluate the attempted operation before it completes. By enforcing policy at that point, Aqua can stop malicious or unauthorized activity before the action succeeds rather than reacting after execution.
MITRE ATT&CK shows how an attacker progresses through objectives such as credential access, privilege escalation, execution, persistence, lateral movement, collection and impact. Each stage depends on actions being successfully executed. Looking at an attack this way makes the limitation of post execution response easier to see because every successful operation can move the attacker farther through the attack path before the defender catches up.
Yes. Fast detection remains important for understanding what is happening inside running workloads and for supporting investigation. The issue is that visibility alone does not control risk. Security also needs the ability to act inside the workload so malicious or unauthorized behavior can be stopped at execution.
A sensor based approach observes activity and then informs a later response. Aqua combines deep runtime telemetry with real time enforcement inside the workload, allowing security decisions to happen locally and malicious or unauthorized operations to be stopped at the point of execution.