Minutes, not days: The new math of cyber survival

The new threat trend: AI

• IBM’s latest threat intelligence shows an 84% increase in phishing campaigns delivering infostealers per week, turning phishing into a shadow vector for identity-based attacks, even as classic phishing success rates fall. These infostealers harvest credentials at scale, making follow-on account takeover and lateral movement cheaper and harder to spot.
• At the same time, the global average cost of a data breach is around $4.4 million, with improvements in detection and containment driving a modest year-over-year decrease.

The simplest entry-point remains through email. According to Hornetsecurity, malware email attacks increased by 131% in 2025, phishing attempts increased by approximately 21%, and email scams increased by approximately 35%. More than three-quarters of CISOs now consider AI-generated phishing a serious emerging threat and many organizations have already invested in AI-driven protection. Building a truly resilient infrastructure requires operationalizing the critical lessons learned from previous attacks.

Informing defense through past exploits

Building a truly resilient infrastructure requires operationalizing the critical lessons learned from previous attacks. Let's take the Target 2013 breach. How could a mature EDR have helped avoid this breach?

• Step 1: The cyberattacker logging in the vendor portal

  The cyberattacker stole the username and password from Target's HVAC vendor and logged into Target's vendor portal, which had excessive access rights to sensitive internal data. The cyberattacker logged into Target's vendor portal during odd hours with an unknown IP address or geographic location, then went directly to the point-of-sale (POS) management server to get additional access. If Target had an advanced EDR technology in place, they could have set alarms to alert them of the unusual activity—requiring additional verification or suspending the access session.

• Step 2: A slow walk through the network

  After gaining access to Target's vendor portal, the cyberattacker began to move through the vendor's network towards the Target payment network, mapping and searching for the best way to access the Target POS management servers.A mature EDR system could have monitored endpoint telemetry, revealing that the vendor's session was actively calling administrative tools and other probing utilities, scanning across subnets, and mapping file shares and servers linked to the HVAC vendor. This visibility would have enabled IT security analysts to isolate the vendor’s activity from the POS servers before the vendor successfully breached Target’s payment data.

• Step 3: The very moment malware reached POS

  After some testing, they unleashed a BlackPOS-like RAM-scraping malware, which is a malicious software that secretly watches a point-of-sale system’s memory to steal payment card details while transactions are being processed. It was released , on dozens of POS infrastructures via software distribution tools offered by Target. A potentially elevated alert on an EDR on any given POS could have been recognized as a high priority anomaly. It involved a new, low-frequency binary file being dropped on highly restricted checkout stations. The file installed hooks and persistence connections with financial app processes, which could have automatically blocked and lockdown for analysis with a EDR in place.

• Step 4: Memory scraping exposed

  Near peak shopping season, on a cold December night the malware surreptitiously monitored payment app memory for card track information, exfiltrating it from RAM with every swipe. A behavior-based EDR solution on these endpoints would have recognized an untrusted process with repeated accesses to memory belonging to another process and parsing very structured cards. This rarely occurs on legitimate POS-terminals, and would have terminated the process, marked its hash as malware, and looked for similar behavior across an enterprise.

• Step 5: Creating the internal warehouse of stolen cards

  Accordingly, The attackers were not directly dumping credit card data online but were instead holding it on internal infrastructures, aggregating millions of records before exfiltration. In this case, EDR and basic analytics might have put it all together: POS machines mysteriously transmitting highly sensitive-looking data chunks to a non-payment internal server, servers proliferating compression and encryption tools, followed by preparation for outgoing transfers. This would be an easy candidate for automatic isolation and privilege lockdown on the server.

• Step 6: Alerts that need a louder voice

  Investigations show that security tools did generate alerts about malware and exfiltration routes, but those were not actioned in time. A well-run EDR program doesn't just detect; it enforces. High-confidence behaviors like memory scraping on POS, mass data staging or suspicious outbound transfers from critical servers should trigger automated playbooks to cut network access, roll back changes, and force real-time human review-shrinking a 40-million-card catastrophe into a contained incident window. The Target breach taught the industry that visibility is useless without the speed of automated response, a gap that traditional tools can no longer bridge.

The Target breach proved that visibility without rapid response is ineffective.

Why AI-powered EDR is non-negotiable

To prevent history from repeating itself, AI-powered EDR has become non-negotiable. By leveraging ML and behavioral analytics, these systems detect, correlate, and neutralize threats in real time, performing the split-second decision-making that human teams often miss.

The industry is already pivoting to this new standard:

• At least 89% of organizations apply AI in some way to learn to know threats.
• 85% apply AI to detect threats and approximately 70%-71% apply AI to respond to threats and recover the incident.

These numbers prove the industry is shifting, but they don't tell you if it's working. To distinguish between a tool that just sits there and one that actually protects you, you need to look at the scoreboard.

KPI table: The benchmark for defensive excellence

Modern CISOs rely on KPIs that reflect both security outcomes and operational efficiency.

An AI-powered EDR today is not just a detection engine. It is a highly cohesive stack that encompasses the whole incident life cycle of signal collection to recovery and lessons learnt

Why talk about fictional events when we can dissect previous attacks.

A number of well-documented incidents demonstrate what might have been accomplished by effective, earlier or stronger EDR, which could have lessened the severity of impact, even if it could not prevent all of it.

• Ransomware distributed by unmanaged endpoints

  In a case study of the FOG ransomware, there is evidence of lateral movement within internal systems that were not under the protection of EDR solutions. According to the case study analysis, the fact that there were blind spots in end-point visibility and inconsistent deployment of the agents provided the attacker with Opportunities to identify these blind spots and expand on them. The entire system would have been under EDR if deployment on all servers and workstations was mandatory.

• Long-dwelling alien encounters and sparse surveillance

  The SingHealth attack analysis discusses how the attackers operated in the network for a whole year before they exfiltrated the millions of patient data files. According to the analysis, there were attack stages where the attackers accessed patient data through credentials, moved laterally, and staged data that could have been halted through improved endpoint logging and behavioral analysis. A mature endpoint response and detection solution would have highlighted the suspicious behavior of the attackers around the privileged credentials and database access well before the data was exfiltrated.

• Living off the land attacks

  Living off the land attacks typically involve 84% of incidents classified as high severity. State-aligned actors have continued to exploit legitimate tools—such as PowerShell—by misusing native binaries, with no additional malicious software required. “Traditional antivirus products weren’t effective here,” writes the researcher, “because the attacks leveraged trusted binaries rather than relying on obvious malware.” EDR solutions that focus on the analytics of behavior, the identification via the Parent-Child Process Tree and Script Block Logging are, by definition, optimized for the prevention of attacks that rely on LOTL.

Visibility is useless without speed

If the Target breach taught us anything, it’s that seeing a threat is meaningless if you can’t stop it in time.

Today, with attackers using AI to move faster than ever, the window to react has shrunk from days to minutes.

• Legacy tools leave you blind to 84% of living off the land attacks.
• Partial coverage leaves the door open for ransomware like FOG.
• Slow response turns a minor incident into a headline-grabbing catastrophe.

The question is no longer if you will be targeted, but how fast can you respond. Don't wait for the next case study to prove the value of EDR. Secure your infrastructure today.