Countering an Accelerating Attack Cycle
By TorchStone SVP of Protective Intelligence Scott Stewart
On October 19, 2026, my friend Chuck Randolph, the Chief Strategy Officer at 360 Privacy, wrote an interesting article that was published by SC Media discussing how AI tools are compressing the attack cycle. In the article, Chuck pointed out how AI tools are permitting less skilled threat actors to increase their capabilities.
“For years, time was on our side. The friction between intent, capability, and action gave us room to detect, understand, and intervene. That room has gotten smaller. The attack cycle hasn't disappeared, and AI hasn't rewritten how people form intent, choose targets, or cause harm. It’s taking the friction out of the process.”
He also discusses how AI tools are accelerating the confluence of physical and cyber threats to produce new hybrid threats. Actually, Chuck referred to this as a “convergence,” but as I’ve previously noted, because the coming together of the two domains results in the creation of something completely new, the phenomenon is better understood as a confluence rather than a convergence, but I digress.
Returning to the crux of Chuck’s thesis, I strongly agree with him that the pace of the attack cycle has been accelerated by AI. The advent of the internet and the emergence of data aggregators began to increase the pace of the attack cycle a couple of decades ago, the introduction of smartphones and social media continued the acceleration, and now AI is turbocharging the process. It has greatly enhanced the ability of threat actors to conduct research on potential targets.
This research can greatly aid in the target identification and target selection processes, and AI can also help threat actors in the attack planning and weapons acquisition phases of the attack cycle. Due to the ability of generative AI to create images and videos, there are also many ways threat actors can use AI tools to optimize the exploitation phase of the attack cycle.
Critically, Chuck did not make the mistake others have made when they claim that the attack cycle model has been rendered obsolete by threat actor operational models, behavior, and technology. As I have written in the past, I strongly believe the concept of the attack cycle remains relevant today, but only if it is properly understood and applied. From my perspective, those who argue the attack cycle model is no longer relevant are usually thinking of it as static and rigid mold, rather than treating it as an elastic framework to help place events and observations into context.
Now, back to Chuck’s discussion of the acceleration of the attack cycle. One of the critical points he makes in his piece is that this acceleration is reducing the time executive protection and protective intelligence teams have to detect emerging threats and proactively respond to them.
The acceleration of the attack cycle and the corresponding reduction of the time security teams have to detect attack cycle behaviors means we now have less margin for error. If we miss, or dismiss, an important attack cycle-related indicator or behavior, we may not get a second chance to detect and prevent a pending attack. This reality should induce a sense of urgency and help us recognize the need to adjust security and protective intelligence operations to compensate for this time crunch.
Countering the Time Crunch
Perhaps the most elemental step toward countering the accelerating attack cycle is recognizing that the threat exists. Denial of the threat, “it can’t happen to me,” “it can’t happen here,” or “it’s never happened before,” can prove deadly, as can complacency. In an environment in which the margin for error is shrinking, vigilance is needed. Not everyone needs a large, 24/7 executive protection detail, but all prominent individuals need some program in place to monitor for threat signals and watch for attack cycle-related activities.
At a minimum, security teams, principals, and their families and staff members must practice solid situational awareness and remain vigilant, especially in the case of principals who do not receive 24/7 executive protection coverage. Principals and their families and staff must also be trained in what to look for, and how to report their observations.
I hate beating old (and unpopular) horses, but operational security has also become more important than ever in the AI age, and details of the principal’s schedule and daily routine must be carefully guarded. AI is making it easier for threat actors to connect the dots that allow them to know where the principal will be and when. A good prompt in an AI program could conduct a pattern of life analysis on a potential target and determine where they will be next in a matter of seconds.
Because of this, it is critically important that people don’t connect the dots for threat actors by sloppy social media postings or careless information security practices. People need to think before they post or share information with a third party. Safeguarding the home addresses and other personally identifiable information (PII) of potential targets is also necessary.
Closely connected to operational security is the need to resist keeping a predictable schedule. People are creatures of habit, and change can be uncomfortable, but potential targets must take steps to vary their daily routine so they become less predictable and present a harder target for an attack.
Unpredictability becomes even more powerful when it is combined with solid residential security, office security, and travel security measures.
Watching for Indicators
As Fred Burton and I outlined in our 2025 book, The Protective Intelligence Advantage, protective intelligence practitioners have known how to look for signs of threat actors who are “hunters and not howlers” for decades now. Protective intelligence programs have been designed specifically to identify signs and behaviors that indicate attack cycle preparation by a threat actor who has not identified themselves by making a threat.
These same protective intelligence tools remain effective in spotting an accelerated attack cycle, because these behaviors remain the same. AI is a powerful tool for conducting research, but it simply cannot replace the physical surveillance required to conduct a targeted attack. Threat actors must still conduct surveillance, and they are still vulnerable while doing so, but only if someone is looking for them.
Detecting preoperational surveillance remains one of the keys to proactively spotting an attack cycle in progress, and Protective Intelligence Countersurveillance (PICS) teams remain a powerful tool. And don’t @ me for using the term “countersurveillance”: I mean precisely that. It’s not enough to just detect surveillance. If surveillance is being conducted against the principal, steps must be taken to identify the actor and disrupt their attack cycle. Surveillance must be countered.
Sometimes the surveillance may turn out to be innocuous or even directed at someone else. I have worked countersurveillance details where we identified someone conducting surveillance on a corporate office building in an effort to serve legal papers on an employee. We also detected law enforcement surveillance on another employee who was suspected of selling drugs, and a PI who had been hired to conduct surveillance on an employee whose spouse suspected they were having an affair. Not all surveillance is necessarily hostile, but it should all be identified and investigated.
Even in cases in which a suspicious person can’t be definitively proven to be conducting hostile surveillance in furtherance of an attack, merely approaching and interviewing them puts them on notice that they have been identified and recorded. Unless they are fixated on the principal, this could serve to divert them to another target if they were indeed up to no good.
Obviously, sightings of suspicious individuals and vehicles should be recorded in incident reports and databased for future reference. Individual observations may not seem significant on their own, but when reviewed alongside other incidents, they can reveal patterns of surveillance, repeated interest in a principal, or efforts to gather information about routines, residences, or security measures.
There are also a number of other techniques that can be employed to manipulate hostile surveillance and force those conducting it to show their hand. These can either be employed by security teams, or by the target of the surveillance acting alone.
None of the techniques and tools I’ve discussed so far are new, but I want to turn my attention now to something that is: AI. The very thing that is supercharging the attack cycle can also be used by security teams as a tool to better identify threats and attack cycle behaviors.
First, AI tools can digest huge quantities of information far more quickly than humans can. As social media apps allow people to produce far more content, it becomes increasingly difficult to scan it all. AI tools help solve this problem. AI-enabled camera systems can be trained to spot surveillance and other attack cycle related behavior and bring them to the attention of a human far more efficiently than a human staring at a bank of video monitors.
AI can also enable “security confluence” by bringing together information feeds from across domains and organizational silos to spot patterns and anomalies more rapidly than humans can. In this way, defensive AI tools help to nullify the advantage threat actors gain through the increasing speed of the attack cycle.
With attack cycles becoming faster during this period of increasing threats to prominent individuals, the need to employ these tools and techniques becomes more pressing than ever, and hesitation to do so could bring dire consequences.