AI Arms Race in Incident Response

2026 IBM report reveals 247-day mean detection time, $2M cost reduction from AI/automation adoption. Practical steps: rewrite verification procedures, run deepfake tabletop exercises. NIS2 deadlines add regulatory urgency. Challenges assumption that current IR plans are adequate. Directly impacts network/endpoint security and incident response domain. New: Swimlane intelligent routing reserves agentic AI for only 10% of threats, achieving 90% cost savings for a healthcare customer — a practical architecture for cost-conscious SOC modernization. New this cycle: GitLab RCE (CVE-2026-19478, CVSS 9.4) exploited in wild within 2 days of patch; watchTowr used AI to reproduce from advisory alone, demonstrating AI's role in both offense and defense.