Breakout time is dead. Security debt is coming due.

Breakout time is collapsing. Bartley Richardson, CrowdStrike's chief AI officer, said the fastest observed attacker breakout has fallen to 27 seconds, and that AI agents are making the old metric obsolete. Attackers now use 50 to 100 agent swarms to enumerate environments and coordinate. CrowdStrike's claim is central: defenders used to have weeks to detect a campaign; now they have seconds, and no human review queue is built for that.

Security debt is due. CoreWeave CISO Jim Higgins put it bluntly: 50 years of security debt is now coming due. The attacks he sees are not elaborate tiered payloads. They are stolen credentials, exposed GitHub repositories, and misconfigurations, plus the long history of developer mistakes. That means the response is less about exotic AI defenses and more about identity controls and patching. This is the most actionable part of the conversation and it is also the least new.

Defenders are training agents. CrowdStrike described Safe Mind, a lab where offensive models attack tens of thousands of simulated enterprise environments, defensive models learn from their breakouts, and the cycle repeats until no path succeeds. Richardson said a generic frontier model costs about $10 per remediation step, while CrowdStrike's tuned Blue Solano model runs about three cents. That cost difference is the most concrete number in the talk, but it is a vendor claim with no independent benchmark.

The real attack surface is scaffolding. Richardson's strongest point is that the model gets the attention while the scaffolding, tooling, and sandbox around it determine security outcomes. Most "rogue agent" stories are misconfigured sandboxes or over-permissioned credentials, not autonomous rebellion. Both speakers argued that any agent action eventually becomes a process on a CPU or GPU, so endpoint and infrastructure observability remain the last line of defense.

Good advice and hype coexist. Higgins closed with "patch your shit," and Richardson pointed to open-source safety alliances and the need for an agent-breakout disclosure standard. But the panel never produced data on how well these defense models work in real production, and both companies are selling the infrastructure and tooling they describe. The 27-second figure and the per-remediation costs should be treated as marketing signals until independently verified.

What leaders should do. Treat AI security as an acceleration of known problems, not a new category. Fix credential exposure, patch debt, review agent scaffolding and sandbox configs, and require security vendors to share unit economics and real incident data before budgeting. The fundamentals are boring, but they are still where the wins are.