Why traditional indicators are losing their value in threat detection
Security teams have spent decades relying on indicators such as malware hashes, suspicious IP addresses, and domains to pinpoint and block cyber threats. These artifacts, while convenient to track and share, have always been easy for attackers to modify. Tools powered by generative AI accelerate this process, enabling adversaries to generate new variants and change their digital footprints faster than defenders can update blocklists or share intelligence. As a result, the shelf life of these indicators continues to shrink, and defenders who depend solely on such signals risk missing the true danger.
Why counting attack techniques does not reveal attacker risk
Counting the number of techniques an attacker uses during a campaign can offer limited insight. In real-world environments, legitimate administrators often use the same methods as threat actors—for example, accessing accounts, leveraging remote services, or staging data. It’s the sequence, timing, and context of these activities that distinguish an attack from routine operations. Simply put, the mere presence of a certain technique, or the number of techniques involved, does not correlate with the attacker's sophistication or threat level. Instead, defenders should focus on the way techniques are combined and executed over time.
How AI is pushing attackers deeper into automation and orchestration
AI-driven tools aren’t just helping attackers craft new phishing emails or malware—they are reshaping the very flow of attacks. Modern adversaries increasingly automate not just the generation of payloads, but also post-access activities such as account discovery, lateral movement, and privilege escalation. The speed at which chained actions occur is becoming an important clue: what previously might have unfolded over hours during human-led breaches may now take minutes, thanks to AI and automation. This means defenders should emphasize the behavioral patterns and timing of suspicious chains rather than just isolated activities.
What defenders must change in their detection strategy
The attack landscape is shifting in ways that existing frameworks and detection models can't always capture. While frameworks like MITRE ATT&CK detail the individual techniques used during attacks, they often fall short when it comes to tracking how those behaviors are orchestrated by AI. As attackers rely more on automation, defenders must correlate signals across user identities, endpoints, networks, and cloud platforms—in other words, piece together the full behavioral chain. Achieving this requires better data integration and real-time analysis capabilities, rather than just collecting more telemetry.
Key takeaway: Prioritize behavioral patterns over isolated indicators
While AI makes it easier for attackers to mask their actions and change surface-level artifacts, their fundamental objectives—gaining access, escalating privileges, moving laterally, and stealing data—remain unchanged. Security teams should invest in solutions and processes that analyze how these goals are achieved over time, considering context, sequence, and speed. This shift will improve the ability to detect the most dangerous and well-orchestrated attacks—many of which may otherwise appear entirely ordinary at first glance.