AJ Nurcombe, senior solutions architect at Horizon3.ai, opened his Scot-Secure West keynote by owning a familiar failure: “I was the first and I was the last line of defence and I was frankly the human firewall. And to be honest and to be frank, I failed.”

It’s a bold opening gambit, speaking to a packed room of cybersecurity professionals, that feels refreshing. That admission – blunt, personal, and surprisingly common (but probably not as transparently dissemenated as it should be) across his audience of InfoSec, IT and C-suite leaders – set the tone for a talk that moved from the visceral anxiety of a real breach to hard metrics drawn from Horizon3.ai’s AI-driven offensive testing of production environments.

Nurcombe’s argument is straightforward: the way organisations measure security is broken.

Static, scheduled pentests and traditional red teams give a comforting snapshot that is stale almost immediately. In a world where adversaries are automated, opportunistic, and fast, defensive teams must adopt offensive techniques that run continuously and think like attackers.

Below, we’ll take a look at Nurcombe’s key points from the conference, the technical anatomy he laid out, and the war stories he used to prove the case.

Outdated by design: the false comfort of one-off tests

Nurcombe framed the problem at the human level.

The breach he described came while he “looked at the alert queue until frankly, my eyes bled.” Years of false positives and misconfigured tooling conditioned him to expect noise – and that conditioning blinded him to the one alert that mattered.

He invoked the psychology of perceptual bias: past trauma shapes what defenders see and do not see. In fact, he pleaded a compelling case around how some forms Jungian psychology can help understand attackers’ objectives (we’ll get to that later).

He distilled the operational failures into three blunt observations:

• Outdated by Design: Traditional pentests provide a one-time snapshot – often stale by the time the final report is in hand

• Limited Scope: Static, point-in-time tests can’t keep pace with constantly shifting attack surfaces and evolving threats

• Reactive, Not Preventive: Too many organisations are learning about their weaknesses after a breach, rather than continuously exposing and fixing exploitable attack paths

The upshot: organisations are frequently told “you’re secure” on the basis of paperwork and scheduled scans. Nurcombe rejects that reassurance.

“Don’t tell me that I’m secure. Show me that I’m secure,” he told the room a demand for deterministic, proof-based evidence rather than policy statements or tick-box compliance.

Perceptual blindness and the attacker’s vantage

One of the talk’s most effective moments was a simple psychological demonstration.

Nurcombe described the monkey business illusion – you count passes between white- and black-clad players and most people miss a person in a gorilla suit who walks through the scene. He used it as a metaphor for defenders who are so focused on what they already expect – misconfigured sensors, known false positives, internal assumptions – that they miss the obvious, anomalous actor inside the environment.

His prescription: “take the attacker’s perspective.” That means both psychological profiling of adversary behaviour and tooling that replicates attacker decision-making. Nurcombe argued threat actors have personality types – borrowing from the “dark triad” – and that mapping these behaviours can inform realistic adversary emulation:

• Narcissistic actors boast, publish proof-of-concepts and claim ownership of exploits.

• Machiavellian operators favour manipulation — social engineering and credential abuse.

• Psychopathic actors (the outliers) seek disruption: DDoS and destructive attacks.

Understanding these drivers helps defenders prioritise likely TTPs and shape simulated campaigns that mimic real attackers.

From recon to compromise: an AI engine that emulates attackers

Nurcombe described Horizon3.ai’s technical approach: a reconnaissance engine fed by simple open-source inputs (company names and external domains), and an attack engine driven by a Markov decision process – “next best informed choices” rather than hard-coded sequences.

He explicitly referenced the analogy to IBM Deep Blue: not a huge rulebook of moves but an engine that selects next best actions toward an objective.

Crucially, the product is designed to run in production and requires minimal setup. Nurcombe was candid about risk: “the statement I made before, nothing in IT or security is 100% safe. The goal of the product is to be designed to work in production environments… there are some modules that do cause some adverse effects, although mild. Based on your risk appetite as an organisation, you have the ability then to configure accordingly.”

The engine enumerates services, tests for what responds, leverages credential harvesting (LLMNR/NetBIOS poisoning, NTLM hash lifting), runs exploit attempts where appropriate and chains actions until compromise or until the attack surface is exhausted.

As Nurcombe tells it, the engine behaves like an APT in production: fast, adaptive and data-driven.

War stories: the real-world payoffs of continuous offensive testing

Nurcombe illustrated the model with concrete compromises drawn from “the last couple of years” and the 150,000 production attacks Horizon3.ai has run.

He walked the audience through several anonymised case studies that highlight recurring themes: chaining trivial weaknesses into catastrophic outcomes; the gap between “patched” and “not exploitable”; and the fragility of third-party supply chains.

1. Disney-style Slack dump (communication exfiltration)
   A campaign that began with basic enumeration led to credential theft, exploitation and the extraction of internal Slack data = “1.1 terabytes of data. 10,000 plus messages internal communications.” The sequence is familiar: credential harvesting (poisoning), NTLM hash capture, hash-cracking, domain pivot, exploit (PrintNightmare), remote code execution and in-memory remote access tools. Nurcombe warns that EDRs can be bypassed: “we can actually circumvent the top four major EDR providers, on average, 36% of the time.”

2. Global shipping provider: fast domain compromise
   In a large shipping customer, the chain again started with enumeration and poisoning. Nurcombe recounts domain user compromise within about seven minutes and rapid escalation to domain admin, followed by remote access deployment and extraction of sensitive assets – a classic lateral-movement narrative turned into a high-value data haul.

3. Third-party supply chain risk (defence industrial base example)
   Small suppliers – “why go after Toyota when you can go after the cup holders” – are attractive targets because they provide access to high-value systems indirectly. Nurcombe described exfiltration of 3D CAD drawings and other sensitive data from suppliers, stressing that questionnaires and self-attestation are insufficient: active exploitation and easy to run penetration of supplier services deliver a truer picture of risk.

4. Global banking customer: patched but still exploitable
   Perhaps the starkest lesson came from a bank that believed its PrintNightmare vulnerability had been patched across seven domain controllers. Both Qualys and Rapid7 reported the hosts as patched. Yet the exploit still worked – not because the patch was missing, but because an EDR (endpoint detection and response) vendor’s blocking of registry key changes had left the exploitable condition intact. The bank ultimately rebuilt its domain controllers from scratch after losing faith in the environment. Nurcombe summed it: “Don’t trust, verify. And the only way to truly verify is with offensive cyber.”

Numbers that should make defenders sit up

Nurcombe closed with mean-average times from Horizon3.ai’s dataset – stark evidence of how fast modern attack chains can move.

He said: “Just over four minutes to Microsoft Entra user compromise; roughly 100 minutes to AWS credential compromise; about 72 minutes to initial credential compromise (with around 20% of those initial compromises yielding domain-admin level access); and domain-admin compromise typically occurring in about 13 minutes.”

Recommended reading

• API and Bot Attacks Cost Businesses £141 Billion A Year 
• NCSC Issues Advisory to Combat China-linked Cyber Threat
• NCSC Releases Cyber Incident Response Guidance for CEOs

Nurcombe’s call to action was both technical and philosophical: stop asking whether you’re “secure” as a static state and start proving it continuously. “If you aren’t running an offensive cyber program or you’re not running an AI-based attack… blue teamers and organisations can use this to truly take the attacker’s perspective, find where the exploitability lies, and actually fix what is important to you,” he said.

He did not romanticise automation: his account is frank about risk, configuration choices and the reality that no defence is perfect. But his evidence – thousands of compromises observed, repeated patterns across sectors, and mean timelines that compress attack-surface exploitation into minutes – make a difficult case impossible to ignore.