Cybersecurity’s Next Five Years Compress Into Two
A new intelligence assessment finds agentic AI moving through security operations faster than any vendor roadmap or analyst forecast admits.
The conservative timeline most enterprises plan against — Tier 1 SOC automation by 2028, Tier 2 by 2032, Tier 3 past 2040 — understates what the 2025 evidence base shows. The revised forecast compresses each horizon 30 to 40 percent.
Five compounding mechanisms drive the acceleration. Frontier labs apply agents to their own model development, collapsing iteration cycles from quarterly to weekly. The DARPA AI Cyber Challenge final on August 8, 2025 produced cyber reasoning systems that found 77 percent of synthetic vulnerabilities at $152 per task — a two-order-of-magnitude cost crash.
Anthropic’s GTG-1002 disclosure of November 13, 2025 documented 80 to 90 percent autonomy in a state-linked espionage campaign. All seven AIxCC systems release under an OSI-approved license. Agent-to-agent protocols produce network effects familiar from cloud and SaaS adoption.
Two functions go fully autonomous earlier than the rest of the security stack. Technical red teaming reaches operational autonomy very likely between 2027 and 2028. Threat hunting follows in 2028 to 2029. The credentials gating those roles — CEH, OSCP, GPEN, GCFA, GCIH, CySA+ — face existential rather than evolutionary pressure, with 60 to 80 percent addressable market loss through 2032. Governance credentials such as ISACA’s AAISM and CompTIA SecAI+ replace them five to seven years sooner than linear forecasting allowed.
The CIA Triad survives as pedagogy but acquires two new operational pillars. Agent integrity becomes a first-class property covering auditable trails of model versions, prompts, tool calls, and decisions. Provenance moves from Parkerian Hexad add-on to operational necessity as adversary agents impersonate defenders and synthetic media erodes authentication.
Adversary agentic capability already exceeds defender deployment, producing an offense-favored window of two to four years between 2027 and 2031. The architectural decision window closes faster than current procurement cycles assume. Organizations waiting until 2028 arrive late.
Read the full intelligence assessment for the function-by-function timeline, cone of plausibility scenarios, workforce transition gap, and cross-sector implications.
