Attackers are gaining the ability to operate at machine speed. Defensive AI can answer that threat, but only if it can reach the evidence.
Something unusual is happening in AI. After years of racing to make models faster and more capable, some of the people closest to frontier development are warning that progress may be moving too quickly. Anthropic CEO Dario Amodei has called for slowing the pace of capability development, while researchers and former employees across leading AI labs have raised concerns about increasingly autonomous systems and the competitive pressure to keep advancing them.
AI is already being applied to reconnaissance, exploitation, malware development and other stages of cyber operations. Recent Anthropic threat intelligence has documented the evolution of AI from an assistant performing individual tasks toward systems capable of orchestrating larger portions of an attack. That shift gives attackers the ability to automate more work, operate across more targets simultaneously and compress activities that once depended heavily on human time and expertise.
The AI industry may be debating how quickly AI should advance. Security teams have to defend against the capabilities that already exist.
The AI industry is debating how to slow AI down. Cybersecurity has to figure out how to make defense fast enough to survive what already exists.
The natural answer to machine-speed attacks is machine-speed defense. AI is already being introduced into security operations to investigate alerts, identify relationships, reconstruct activity and help analysts respond faster. But defensive AI faces a constraint that attackers do not: it needs instant access to the evidence, both real-time and historical.
An alert rarely contains the whole attack. The evidence may be distributed across months of identity events, endpoint telemetry, DNS records, network activity, cloud logs and authentication history. An event that looks insignificant today may only become meaningful when it is connected to something that happened three weeks or three months earlier.
AI is exceptionally well suited to finding those connections, but it cannot reason over evidence it cannot reach.
At enterprise scale, that evidence quickly grows into petabytes of security data. Traditional architectures make keeping all of that information immediately accessible prohibitively expensive, forcing organizations into familiar compromises: sampling data, shortening retention periods, aggregating events or moving older telemetry into storage that cannot be queried at the speed of an active incident.
Then we ask AI to reconstruct the attack from whatever remains accessible.
The result is a strange contradiction at the heart of defensive AI: we are building increasingly intelligent investigators while giving them incomplete case files and making them wait for the evidence.
For a large enterprise, making its full security history available to AI is already a petabyte-scale challenge. But defensive AI will not exist inside a single enterprise. Across enterprises, government agencies, telecommunications companies, cloud environments, managed security providers and security platforms, the same problem compounds into something much larger.
Cyber defense is heading toward an exabyte-scale data-access problem.
That scale exposes a fundamental weakness in the economics of today's security infrastructure. The industry cannot simply multiply conventional query compute by another thousand and expect defensive AI to operate effectively. If the AI is expected to investigate at machine speed, the infrastructure beneath it has to make enormous volumes of real-time and historical data accessible at machine speed too.
This changes the question security leaders should be asking. The important question is no longer simply, “How intelligent is my AI?” It is also, “How much of my environment can that AI actually see, and how quickly can it get there?”
Intelligence without access has a ceiling.
This is the infrastructure problem Craxel built Black Forest to solve.
Black Forest is designed to provide instant access to real-time and historical petabyte-scale data without the conventional compute burden associated with repeatedly searching enormous datasets. Instead of forcing organizations to decide which fraction of their security history can remain economically searchable, Black Forest is designed to keep far more of that evidence available when AI and analysts need it.
For defensive AI, that changes the equation. The model is no longer limited to reasoning over a sampled dataset, a short retention window or whatever happens to remain in the hot tier. It can work against substantially more of the history required to connect events across identities, endpoints, networks, applications and time.
This is about more than faster search. It is about removing a data-access constraint that threatens to become a limiting factor for defensive AI itself.
Models will continue to improve. Agents will become more capable. Security AI will become better at investigating, correlating and responding autonomously. But as those capabilities improve, the differentiator will not only be who has the smartest model. It will increasingly be which model has access to the most complete evidence, fast enough to act on it.
Attackers and defenders gain leverage from AI in different ways. Attackers gain leverage from automation: the ability to conduct reconnaissance, generate or modify code, examine targets and coordinate activity at a speed and scale that would previously have demanded significantly more human effort.
Defenders gain leverage from context.
An attacker only needs to discover one viable path into an organization. The defender has to identify that path, reconstruct what happened, understand which identities and systems were affected, determine how far the attacker travelled and establish whether related activity occurred elsewhere or earlier.
Doing that well requires history.
In an AI-native SOC, security telemetry therefore becomes something more than an archive retained for compliance or occasional investigation. It becomes memory for the machine. The greater the relevant history an AI can reach, the greater its ability to connect weak signals into an attack narrative and reason about the environment as a whole.
Without that memory, even highly capable AI is operating with only part of the picture.
The wider technology industry may continue debating whether AI development should slow down. Attackers are unlikely to wait for an answer. They already have access to powerful models, automation and an expanding ecosystem of AI-enabled tools.
They have begun scaling intelligence and automation.
Defense now has to scale access to the evidence.
That is what Black Forest was built for.
Black Forest gives defensive AI instant access to petabyte-scale real-time and historical data, so it can reason over the evidence instead of waiting for or working from a fraction of it.
