The attack lifecycle you planned for last year no longer exists. What used to take adversaries days now happens in minutes. Your defensive posture needs to reflect that compression. This checklist helps you assess whether your organization can defend at AI speed, not just against AI-enhanced threats.
What This Checklist Covers
This assessment focuses on three critical domains: your ability to detect and respond at machine speed, your identity controls in an agent-rich environment, and your strategic investment in AI-driven defense capabilities. Each item requires a binary yes/no answer. If you can't answer "yes" with documentation to prove it, treat it as "no."
The checklist draws from Microsoft's October 2026 Digital Defense Report findings on compressed attack timelines and the shift toward phishing and public-facing application exploitation as primary access vectors.
Prerequisites
Before starting this assessment, you need:
- Current inventory of all AI agents and service accounts with privileged access
- Documentation of your Mean Time to Detect and Mean Time to Respond for the past 90 days
- Access to your authentication logs and MFA enrollment data
- List of all public-facing applications and their last vulnerability assessment dates
- Your security tooling budget allocation for the current fiscal year
If you don't have these artifacts ready, that's your first signal.
Readiness Assessment
1. Phishing-Resistant MFA Deployment
Have you deployed phishing-resistant multi-factor authentication (FIDO2, WebAuthn, or certificate-based) for 100% of privileged accounts and at least 80% of standard users?
Good looks like: Zero SMS-based or TOTP codes for admin access. Your authentication logs show FIDO2 or platform authenticator use across your user base, and you've disabled legacy authentication protocols organization-wide.
2. AI Agent Identity Governance
Do you maintain a complete, auditable inventory of every AI agent identity, including what data it can access, what systems it can modify, and which service accounts it can impersonate?
Good looks like: A living document or database that your identity team updates within 24 hours of any new agent deployment. Each agent has documented least-privilege justification and an expiration review date.
3. Automated Credential Discovery Detection
Can your security stack detect and alert on rapid credential enumeration or discovery activity within 5 minutes of onset?
Good looks like: You've tested this with authorized red team exercises in the past quarter. Your SIEM or Endpoint Detection and Response generates alerts when an account queries Active Directory for privileged group membership or attempts multiple failed authentication events across services in rapid succession.
4. Lateral Movement Monitoring
Do you have automated detection for unusual service-to-service authentication patterns that could indicate an attacker inheriting agent trust relationships?
Good looks like: Your monitoring flags when a service account that normally authenticates to three systems suddenly authenticates to fifteen, or when authentication patterns shift from business hours to 3 AM. You've documented baseline behavior for your top 50 service accounts.
5. Public-Facing Application Vulnerability Management
Have you assessed every internet-exposed application for vulnerabilities in the past 30 days, and do you have a process to patch or mitigate critical findings within 72 hours?
Good looks like: Automated scanning that runs weekly at minimum. Your vulnerability management system shows zero critical or high-severity findings older than one week on public-facing assets. You maintain a prioritized remediation queue with SLA tracking.
6. AI-Enhanced Threat Intelligence Integration
Does your security operations center consume AI-processed threat intelligence that correlates attack patterns across your telemetry sources in near real-time?
Good looks like: Your SOC doesn't just receive threat feeds; you've deployed tools that use machine learning to correlate indicators across endpoint, network, identity, and cloud logs. Analysts can query "show me behavior similar to credential discovery patterns" and get actionable results in under 60 seconds.
7. Tiered Administration Enforcement
Have you implemented strict administrative tier boundaries that prevent workstation-level credentials from accessing server or cloud control planes?
Good looks like: Your domain admins cannot log into standard workstations. Cloud infrastructure admins use separate, monitored accounts that can't access email or browse the web. You've tested this with penetration testing and confirmed that compromising a tier-2 asset doesn't grant tier-0 access.
8. Email Security with AI Content Analysis
Do you deploy email security that uses natural language processing to detect AI-generated phishing content, not just pattern matching on known indicators?
Good looks like: Your email gateway analyzes message coherence, sender behavior anomalies, and linguistic patterns that suggest machine generation. You've seen a measurable drop in phishing emails reaching user inboxes since deployment, and your security team reviews flagged messages to tune the model.
9. Data Exfiltration Speed Limits
Can you detect and automatically throttle unusual data transfer volumes or velocities that suggest bulk exfiltration?
Good looks like: Your data loss prevention or cloud access security broker has baseline transfer rates for each user and service account. When a user who normally downloads 50MB per day suddenly pulls 5GB, the system alerts your SOC and optionally requires step-up authentication to continue.
10. Privileged Access Enforcement with Just-In-Time Elevation
Do your privileged users request and receive time-limited, audited elevation rather than holding standing administrative access?
Good looks like: No one has permanent Domain Admin or Global Administrator rights. Elevation requests generate tickets, require approval for high-risk operations, and automatically expire after 4-8 hours. Your audit logs show who approved each elevation and what actions the elevated account performed.
11. AI Defense Budget Allocation
Have you allocated at least 15% of your security tooling budget to AI-driven detection, response, or threat intelligence capabilities in the current fiscal year?
Good looks like: Line items in your budget for machine learning-based SIEM analytics, AI-enhanced Endpoint Detection and Response, or automated investigation and response platforms. You're not just buying tools with "AI" in the marketing; you've validated that they reduce analyst time-to-decision or automate response actions you currently do manually.
12. Incident Response Playbook for AI-Accelerated Attacks
Have you updated your Incident Response Plan to include procedures for attacks that move from initial access to data exfiltration in under one hour?
Good looks like: Your runbooks assume you'll have minutes, not days, to contain lateral movement. You've pre-authorized automated containment actions (network segmentation, account disablement) that don't require three levels of approval. Your on-call rotation has tested these procedures in tabletop exercises within the past six months.
Common Mistakes
Treating AI defense as a vendor purchase rather than a capability build. You can't buy your way to AI-speed defense. The tools matter, but they're worthless without the telemetry, baselines, and process integration to use them effectively.
Focusing on detection while ignoring response automation. If your Mean Time to Detect drops from 4 hours to 4 minutes but your Mean Time to Respond stays at 6 hours, you haven't solved the problem. Attackers who move in minutes will still win.
Securing human identities while ignoring agent identities. With phishing attacks rising from 7% to 23% of incidents year-over-year, it's tempting to focus entirely on user security awareness. But the fastest path to damage is often through a compromised service account with broad access and no MFA.
Next Steps
Count your "yes" answers. If you scored below 8, you're defending at human speed against machine-speed attacks. That's not a sustainable posture.
Prioritize items 1, 2, and 5 first. Phishing-resistant MFA, agent identity governance, and public-facing application security address the most common access vectors in the current threat landscape.
Then focus on items 3, 4, and 9 to compress your detection and response timelines. You need visibility into rapid credential discovery, lateral movement, and data exfiltration before you can disrupt them.
Schedule a quarterly review of this checklist. The attack techniques that take minutes today will take seconds next year. Your defensive capabilities need to compress on the same timeline.
