NO TIME TO LOSE! Outpacing Cyber Threats in the Age of AI

Fred Streefland, Global CISO EMEA

Outpacing Cyber Threats in the Age of AI | 2

Abstract The accelerating pace of cyber threats, amplified by artificial intelligence (AI), is fundamentally changing how organizations must approach cyber security. Traditional defensive security models are no longer sufficient when attackers can exploit vulnerabilities in minutes rather than months. This paper revisits the OODA loop—Observe, Orient, Decide, Act—originally developed in military aviation, and applies it to modern cyber security challenges. Drawing on operational experience from both military intelligence and cyber security leadership, this paper argues that adaptability and speed of decision-making now determine success or failure in cyber defense. By framing exposure management and AI security through the OODA loop, the paper demonstrates how organizations and Chief Information Security Officers (CISOs) can regain control, achieve visibility, and outpace AI‑driven adversaries.

Introduction Cyber security has always been a contest between attackers and defenders, but the balance has shifted dramatically in recent years. Digital transformation, cloud adoption, remote work, and now large‑scale AI adoption have expanded attack surfaces beyond what traditional security architectures were designed to protect. At the same time, threat actors are leveraging AI to automate reconnaissance, accelerate exploit development, and scale social engineering campaigns at unprecedented speed.

In this environment, static defenses and slow response cycles leave organizations permanently behind the curve. The defining factor for survival is no longer raw strength or technological sophistication, but adaptability. As Charles Darwin observed, survival favors those most capable of adjusting to change. This principle applies directly to cyber security today.

This paper explores how the OODA loop—Observe, Orient, Decide, Act—offers a practical framework for cyber security professionals to operate faster than adversaries. Originally conceptualized by U.S. Air Force Colonel John Boyd during the Korean War, the OODA loop explains how victory is achieved by compressing decision cycles. When applied to AI‑driven cyber threats, the OODA loop provides a structured way to regain speed, clarity, and control.

From Fighter Jets to Cyber Defense: The Origins of the OODA Loop The OODA loop emerged from aerial combat analysis during the Korean War, where U.S. pilots flying F‑86 Sabres struggled against North Korean MiG‑15s despite comparable aircraft capabilities. Colonel John Boyd concluded that technical parity was not the issue. The decisive factor was

the decision cycle—how quickly a pilot could observe the situation, orient themselves, decide on an action, and execute it.

Outpacing Cyber Threats in the Age of AI | 3

Observe

Implicit

Guidance

& Control

Unfolding

Circumstances

Feed

ForwardObservations

Outside

Information

Unfolding

Interaction

with

Environment

Orient

Cultural

Traditions

Analyses &

SynthesisGenetic

Heritage

Previous

ExperienceNew

Information

Feedback

Feedback

Feed

Forward

Decide

Implicit

Guidance

& Control

Decision

(Hypothesis)

Feed

Forward

Act

Action

(Test)

Unfolding

Interaction

with

Environment

Figure 1: OODA-Loop

Boyd demonstrated that pilots who completed this cycle faster consistently won dogfights. His ability to shoot down enemy aircraft in approximately forty seconds earned him the nickname John

“40seconds” Boyd. More importantly, his insight established that speed of cognition and action, rather than superior hardware, determines outcomes in contested environments.

Translated into cyber security terms, attackers and defenders operate within their own OODA loops. When attackers can exploit vulnerabilities faster than defenders can detect, analyze, and respond, breaches become inevitable. Compressing the defender’s OODA loop is therefore essential.

Defining the OODA Loop for Cyber security The classical OODA loop consists of four stages:

1. Observe – Collect data about the environment

2. Orient – Analyze and contextualize information

3. Decide – Select an appropriate response

4. Act – Execute actions and assess outcomes

In cyber security, these stages map directly to operational processes:

Outpacing Cyber Threats in the Age of AI | 4

Observe:  Gathering threat intelligence, telemetry, logs, vulnerability data, and signals across the entire attack surface.

Orient: Filtering, enriching, and analyzing data using context, historical knowledge, and risk prioritization.

Decide: Determining remediation priorities, policy enforcement actions, or preventive controls.

Act: Blocking, patching, isolating, or mitigating threats, followed by continuous feedback.

The critical insight is not the existence of these steps—most security teams already perform them— but the speed and integration with which they are executed.

The Modern CISO’s Challenge In today’s digital and interconnected world, organizations are highly complex systems. Networks span on‑premises environments, cloud services, SaaS platforms, endpoints, and increasingly AI workloads. Consequently, the role of the CISO has evolved.

A CISO is not a “digital firefighter” reacting to endless security alerts. Fundamentally, the CISO is a risk manager, responsible for enabling the business to operate securely. To achieve this, three principles are essential:

1. Understanding the business – Without business context, risks cannot be properly evaluated.

2. Full visibility – Organizations cannot protect what they cannot see.

3. In Control – CISOs need to become ‘in control’ to gain digital sovereignty.

These principles are increasingly difficult to uphold due to additional challenges: regulatory compliance (such as NIS2, DORA, ISO 27001, and the EU AI Act), rapid AI adoption across organizations and the AI-powered adversaries.

AI as a Force Multiplier—for Attackers and Defenders AI adoption within organizations is nearly universal, whether formally sanctioned or quietly used by employees. While AI delivers immense productivity gains, it also introduces new risks and significantly expands the attack surface. AI systems, large language models (LLMs), and autonomous agents become new entry points for attackers.

Threat actors have already embraced AI. Activities that once required months—such as crafting exploits—now take hours or even minutes. AI enhances phishing campaigns, malware development, and reconnaissance at scale. Real‑world incidents already demonstrate AI applications being compromised by AI‑driven attacks. This reality makes one conclusion unavoidable: security strategies built for yesterday’s threats cannot defend against AI‑powered adversaries.

Outpacing Cyber Threats in the Age of AI | 5

Reinventing Security Through Adaptability To outpace AI‑driven threats, organizations must adapt in three fundamental ways.

1. Reassessing the Security Stack

Many security architectures consist of disconnected point products not designed to address AI‑centric attack vectors. AI attacks may target LLMs directly, manipulate prompts, exploit model behavior, or abuse agent workflows. This requires reassessing whether existing controls adequately protect modern environments.

2. Secure AI Adoption by Design

AI adoption must be deliberate and secure. AI applications and agents should be tested rigorously before deployment and built according to secure‑by‑design principles. Uncontrolled AI adoption increases risk rather than resilience.

3. Using AI as a Defensive Advantage

AI must also serve the defender. Used correctly, AI enables automation, accelerated threat intelligence, faster remediation, and proactive prevention. When incorporated into the OODA loop, AI becomes a force multiplier that shortens decision cycles.

Applying the OODA Loop in Practice Check Point’s security approach consists of four pillars: Hybrid Mesh, Workspace Security, Exposure Management and AI Security. In this final part of the document, we will apply the OODA Loop to Exposure Management and Agentic AI Security, because both domains can be plotted perfectly.

Exposure Management

Effective exposure management follows the OODA loop precisely:

Observe: Collect data across the entire attack surface using cyber threat intelligence.

Orient: Analyze vulnerabilities and prioritize them based on real‑world risk rather than raw quantity.

Decide: Determine remediation priorities and recommend safe mitigation paths.

Act: Eliminate exposures, take down malicious infrastructure, or guide remediation actions.

Crucially, this process must operate continuously and at speed. AI‑driven analysis enables organizations to act faster than adversaries rather than drowning in unmanaged vulnerability lists.

Outpacing Cyber Threats in the Age of AI | 6

Securing Agentic AI

The rise of agentic AI introduces additional complexity. Organizations may deploy internally developed agents, acquire third‑party AI solutions, or allow organic use through business units. Applying the OODA loop to AI security involves:

Observe: Discover all AI agents in use, including “shadow AI.”

Orient: Analyze inputs, behaviors, data interactions, and anomalies.

Decide: Enforce policy guardrails aligned with business risk.

Act: Block malicious or unsafe actions in real time.

Here again, speed and visibility are decisive.

Conclusion Cyber security is no longer a static defensive exercise. In a world where AI accelerates both innovation and attack capabilities, success is determined by adaptability and speed. The OODA loop provides a proven framework for outpacing adversaries by compressing decision cycles.

Organizations and CISOs that achieve full visibility, contextual understanding, and rapid action regain control even as attack surfaces expand. Those who hesitate or rely on outdated models risk falling behind attackers who move faster every day. As in aerial combat, victory belongs not to the strongest or most technologically advanced, but to those who adapt fastest.

References 1. Boyd, J.: A Discourse on Winning and Losing, unpublished briefing materials, U.S. Air Force.

2. Darwin, C.: On the Origin of Species, John Murray, London, 1859.

3. NIST: Cyber security Framework, National Institute of Standards and Technology.

4. European Union: AI Act, proposed regulation.

Worldwide Headquarters 
 5 Shlomo Kaplan Street, Tel Aviv 6789159, Israel  |  Tel: +972-3-753-4599

U.S. Headquarters
 100 Oracle Parkway, Suite 800, Redwood City, CA 94065  |  Tel: 1-800-429-4391

www.checkpoint.com