AI-powered cyber threats are accelerating the need for faster response

AI-powered cyber threats are changing the cybersecurity landscape, but perhaps the most important change for business leaders is not simply what attackers can do. It is how quickly they can do it.

As AI takes on more of the work involved in a cyberattack, organisations may have far less time to understand what is happening and decide how to respond. This changes the conversation around cybersecurity. Being prepared is no longer just about having the right technology in place. It is also about knowing which decisions need to be made in advance, who has the authority to act and how the business can continue if critical systems need to be isolated.

In a recent interview with Finnish business newspaper Kauppalehti, NetNordic Finland Managing Director Petri Kairinen discussed how this shift is already becoming visible in real-world cyber incidents. Summer 2026, NetNordic witnessed an automated cyberattack targeting one of its Finnish customers. People had initiated the attack, but AI carried out much of the operation.

“AI came through with tremendous speed. It did everything possible, and the cybersecurity operations centre detected it very quickly.”

The attack was contained within 15 minutes, before it caused any disruption to the customer’s business. The case illustrates how much shorter the response window can become when automation enters the equation. A traditional attacker may spend days or weeks exploring an environment, looking for vulnerabilities and moving gradually through systems. AI can perform parts of that work at a very different pace.

The most important decisions are made before an incident

When an attack progresses in minutes, there may not be enough time to escalate every decision through several layers of an organisation. This makes preparation a business and management issue, not just a cybersecurity issue.

Before an incident occurs, organisations need to understand which systems and services are essential to keeping the business running. They also need to agree on what can be isolated, when intervention is necessary and how much authority their cybersecurity team or partner should have when every minute counts.

As Kairinen explained in the Kauppalehti interview:

“Companies should identify and understand their business-critical systems and define whether the cybersecurity operations centre is allowed to shut them down in order to stop an attack.”

There is no universal answer. Disconnecting an employee’s laptop is very different from stopping a production line, isolating infrastructure that supports healthcare services or interrupting a service used by thousands of customers. The right response depends on the organisation, the criticality of its operations and the consequences of both acting and not acting.

That is why these decisions need to involve the business from the start.

A good cyber response playbook connects security with the business

Across the Nordics, businesses and public services rely heavily on interconnected digital environments. When those environments are disrupted, a technical problem can quickly become a business continuity issue.

A useful response playbook therefore needs to reflect how the organisation actually operates. Management, IT and cybersecurity teams need a shared understanding of what must be protected first, what can be isolated quickly and who has the authority to act. Just as importantly, they need to know how the organisation will continue operating and how services will be restored once the immediate threat has been contained.

Sometimes this means accepting a controlled disruption to avoid much greater damage. A device may have to be disconnected, part of a network may need to be isolated or, in a serious situation, a business-critical service may even need to be taken temporarily offline. These decisions are much easier to make under pressure when their business implications have already been discussed and agreed.

This is where cyber resilience becomes particularly important. The goal is not simply to prevent disruption at all costs, but to ensure that the organisation can respond, stay in control and recover when something unexpected happens.

Defending against AI-powered cyber threats

The same technologies behind AI-powered cyber threats can also strengthen cyber defence. Automation and AI can help cybersecurity teams detect unusual behaviour, analyse large volumes of data and respond to threats faster than manual processes alone would allow.

But more automation does not remove the need for human judgement. In many ways, it makes clear responsibilities and predefined boundaries even more important. Technology can act quickly, but the organisation first needs to decide what it is prepared to let that technology, and the people operating it, do.

And while AI is changing the speed of cybersecurity, the fundamentals remain the same. Kairinen emphasised this in his interview with Kauppalehti:

“The reassuring news is that the fundamentals of protection have not changed dramatically. Doing cybersecurity thoroughly and getting the basics right remain essential.”

Strong security hygiene, visibility across the environment, clear responsibilities, effective monitoring and tested recovery plans still matter. What is changing is how quickly all these capabilities may need to work together.

Would your organisation be ready in the first 15 minutes?

For business leaders, preparing for AI-powered cyber threats ultimately comes down to readiness. If an AI-driven attack started moving through your organisation today, would your security team know what it could isolate without waiting for further approval?

Would everyone understand which services are critical to keeping the business running? If something had to be taken offline, would you know how to restore it safely and quickly?

These are questions worth answering before an incident begins. Doing so gives cybersecurity teams the ability to act when every minute counts, while giving management greater confidence that difficult decisions are based on an agreed plan rather than being made for the first time in the middle of a crisis.

AI will continue to change both sides of cybersecurity. We cannot control every new threat or predict exactly what the next incident will look like. But we can make sure we are ready for what comes next.

---

This article builds on insights shared by Petri Kairinen, Managing Director of NetNordic Finland, in an interview with Finnish business newspaper Kauppalehti. The original interview was published in Finnish.

Read the article here

Author