Anatomy of an
Autonomous Kill Chain.

A kill chain used to need a person at the keyboard. That assumption is now out of date.

The classic model is nearly fifteen years old. Lockheed Martin published it in 2011: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. Seven stages, in order, driven by a human operator who moves to the next step when the last one works.

That model still teaches well. It just no longer describes what is happening. In November 2025 Anthropic disclosed a cyber espionage campaign in which AI performed an estimated 80 to 90 percent of the operation, with humans stepping in at perhaps four to six decision points across the whole campaign. Google's threat intelligence team has since documented attackers running multi agent penetration testing frameworks with persistent memory, pivoting between tools on their own.

So the useful question is no longer whether an autonomous AI red team agent can run a kill chain. It is what that chain actually looks like when nobody is driving. Here it is, stage by stage.

Five stages, and a loop instead of a line

An autonomous chain has five stages: recon, enrich, exploit, chain, report. Two of them have no clean equivalent in the 2011 model, and those two are the interesting ones.

The bigger structural difference is the loop. A human operator walks the chain once. An agent runs stages in parallel, drops back to recon when exploit fails, and re-enriches when something new appears. It is less like a line and more like water finding a crack.

One housekeeping note, because most articles still get it wrong. MITRE ATT&CK Enterprise now has 15 tactics, not 14. Version 19, released in April 2026, split Defense Evasion into Stealth (TA0005) for behavioural camouflage and Defense Impairment (TA0112) for actively breaking security tooling. The same release added techniques for adversary use of AI, including Query Public AI Services and Generate Content. MITRE now tracks attacker AI use as formal technique IDs. That tells you where this is going.

Stage 1: Recon — Map everything that answers

The agent enumerates what exists. Domains, subdomains, endpoints, parameters, headers, forms, third party scripts, exposed APIs. No exploit yet. The goal is a complete list, because anything not on the list will not be tested. This maps to Reconnaissance TA0043 in MITRE ATT&CK, and to Reconnaissance in the classic kill chain.

Stage 2: Enrich — Work out what each thing is worth

This stage has no classic equivalent, and it is why agents beat scanners. Each asset gets context. Which endpoint touches money. Which one takes a customer ID. Which login is on an old framework. A scanner treats every URL the same. An agent ranks them, so the expensive testing goes where the value is. No clean kill chain equivalent. Closest is Resource Development TA0042, but the intent is target valuation, not tooling.

Stage 3: Exploit — Prove it, do not guess it

The agent tries the actual attack in a controlled way. If it claims broken access control, it shows the record it should not have been able to read. If it claims injection, it shows the response. Proof matters because unproven findings become a backlog nobody trusts, and a backlog nobody trusts never gets fixed. Maps to Initial Access TA0001 and Execution TA0002.

Stage 4: Chain — Join the small things into one real path

This is the stage that changes the math. Three low severity findings that each get ignored can combine into full account takeover. Praetorian cut roughly 500,000 findings down to 14 endpoints that carried a genuinely exploitable chain. An agent can cheaply test the combinations. A human cannot, because the combinations grow faster than the hours.

Stage 5: Report — Hand over something a team can act on

The output is not a list of CVEs. It is the path, the evidence, the blast radius, the fix, and the mapping to MITRE ATT&CK, RBI and CERT-In. Then the loop restarts. The next code change opens the next gap, and the chain runs again. This is the defender side of the loop, and it is where autonomy pays back.

What autonomous agents are good at, and what they are not

It would be easy to oversell this, so here is the balanced view. Agents are strong on breadth, repetition and combination. They are weaker on the parts that need a human who understands your business.

XBOW submitted nearly 1,060 vulnerabilities and topped the US HackerOne leaderboard in June 2025. Anthropic's Project Glasswing reported thousands of high severity zero days found with no human steering. On the CVE-Bench benchmark, the best agent framework resolved up to 13 percent of real world web CVEs. UK AISI found a 32 step simulation estimated at 20 hours of human expert effort was completed fully in 3 of 10 attempts.

Notice the pattern. Agents are strong on breadth, repetition and combination. They are weaker on the parts that need a human who understands your business. Which is a good argument for using both, and a bad argument for running one human test a year and calling it coverage.

Speed is the reason this matters

CrowdStrike put average eCrime breakout time at 29 minutes in 2025, with the fastest observed case at 27 seconds and data exfiltration beginning within four minutes of initial access. Cobalt found that 30 percent of organisations test quarterly, and 27 percent test annually.

Set those two facts next to each other. The attack takes minutes. The test happens four times a year at best. Everything in between is an assumption.

An autonomous chain does not remove the need for skilled humans. It removes the gap. Recon runs when your app changes, not when the calendar says so. Enrich keeps the ranking current. Exploit proves rather than guesses. Chain finds the paths a queue sorted by severity will never surface. Report closes the loop, and then the loop starts again.