ORLANDO – November 12, 2026 -- Only 29% of surveyed organizations conduct continuous cyber simulations, according to SimSpace's 2026 State of Agentic Cybersecurity report, even as AI shrinks the time defenders have to respond to attacks.
The figure surfaced in coverage of a September 24 event hosted by the AI Proving Grounds Consortium (AIPGC), titled "Build Trust in AI: Govern, Measure and Operationalize AI at Scale." Gartner VP Analyst Tom Powledge joined leaders from Corelight, Dreadnode and SimSpace to discuss why AI-driven attacks require a move toward preemptive security.
Gartner's Powledge says AI-driven attacks are already appearing
Powledge said AI-enabled attacks are no longer theoretical: "This is real. We are starting to see these attacks." As AI accelerates vulnerability discovery and adversary operations, he said, organizations need a more proactive, preemptive and structured program. He named continuous threat exposure management, adversarial validation and simulation as approaches that organizations should increasingly use.
SimSpace's Rivera warns attacker breakout time is approaching zero
Jason Rivera, Global Field CISO and Chief Evangelist at SimSpace, pointed to the sharp decline in attacker breakout time, the period between initial access and lateral movement. He asked what happens as that window nears zero, and described this as the origin of the "preemptive security era."
Under this model, defenders run realistic simulations of their own environments to find likely attack paths, test defenses and develop protections before an adversary strikes production systems.
Preemptive model measures resilience of critical functions, not only response speed
Preemptive security does not assume every attack can be stopped. It assumes determined adversaries may eventually gain access, and asks whether an organization has already proven that its most important systems, people, security controls and AI agents can withstand a breach. The measure of readiness shifts from how quickly a team responds to whether critical business and mission functions stay resilient when breached or degraded.
The source states that preemptive security does not replace detection, threat hunting or incident response. It adds an earlier layer focused on attack paths.
AI Proving Grounds let teams attack replicas of their own infrastructure
AI Proving Grounds are environments where organizations can attack representations of their own infrastructure without risking production systems. According to the source, teams can use them to:
- Find attack paths before adversaries exploit them.
- Validate whether AI agents, security controls and human operators perform as expected.
- Prioritize weaknesses by business and mission impact.
- Generate new defensive capabilities from realistic attack simulations.
- Continuously prove that critical systems stay resilient as threats and environments change.
AIPGC founding members are Corelight, Dropzone AI, SCYTHE, SimSpace and Sondera. The full event, which also featured Greg Bell of Corelight and Brad Palm of Dreadnode, is available on demand.