Because many detection programmes key off volume, speed, or obvious malicious output. An agent that throttles requests, uses legitimate credentials, and spreads actions across time can look like ordinary background activity. That means security teams need telemetry and controls that focus on request context, not just rate or end-state output.
Why slow attacks slip past normal monitoring
Slow, deliberate AI-driven attacks often stay below the thresholds that many monitoring stacks use to detect abuse. If an agent behaves like a careful human operator, reuses valid access, and avoids bursts of activity, simple anomaly rules can miss it. The challenge is not just scale, it is that the behaviour blends into ordinary workflow patterns.
That is especially true when defenders rely on rate-based alerts, volume spikes, or obviously malicious payloads. A patient attacker can distribute actions across accounts, systems, and time windows, so no single event looks severe enough to page the team.
When request context is poor, telemetry can tell you that something happened but not whether it was routine automation, a legitimate user journey, or a coordinated abuse path. That is why context such as identity, tool choice, sequence, and target sensitivity matters more than raw counts alone.
What makes the activity look normal
The key evasion tactic is similarity to acceptable business behaviour. The agent throttles requests, stays within ordinary business hours or plausible service patterns, and uses legitimate credentials rather than noisy exploit chains.
That pattern reduces signal in systems tuned for spikes, failed logins, malware indicators, or obvious exfiltration. It also makes the activity harder to distinguish from background automation, especially where many legitimate jobs already use API calls, scheduled tasks, or scripted access. For broader visibility into how this kind of behaviour maps to attack paths, AI Security Maturity Model is a useful way to think about whether your programme can see beyond simple alerts.
The other reason it blends in is sequencing. Small actions can be harmless in isolation, but the order of those actions can reveal reconnaissance, privilege testing, or gradual data access. Monitoring that only watches end-state output tends to miss the path that led there.
What defenders need to watch instead
Detection has to shift from volume to behaviour, especially across identity, session, and tool context. Correlating who acted, what they touched, which permissions were used, and how the sequence changed over time is more informative than a single request count.
Security teams should also treat long-lived access paths as a special risk, because slow attacks thrive where access is already trusted. If the activity uses valid credentials or service identities, AI Agent Observability, Audit and Incident Response Guide becomes relevant for building the attribution and audit trail needed to separate routine action from abuse. A second useful lens is how exposed credentials and delegated access enable this style of intrusion, which is why the LLM Provider API Key Security and LLMjacking Guide helps frame the credential side of the problem.
Telemetry should therefore capture request metadata, identity lineage, sequence timing, and unusual combinations of resource, tool, and privilege use. If your monitoring cannot answer those questions, an AI-driven attack can remain low and slow for a long time.
Risk and Threat Considerations
Slow attacks are dangerous because they turn ordinary access into a covert persistence channel. The attacker does not need to trigger obvious alarms if each action stays plausible and the full compromise only becomes visible after many small steps.
Failure mechanism: Defenders miss the chain because the monitoring model rewards bursts, errors, or malformed output, while the attacker uses valid access, low-rate actions, and ordinary-looking context to avoid threshold-based detection.
Impact: The result can be prolonged data access, delayed containment, wider privilege use, and a much larger investigation window once the pattern is finally recognised.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | Valid credentials let slow attacks blend into normal access patterns. |
| Recommendation — Hunt for abuse of valid accounts when activity looks routine but context shifts. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Behavioural monitoring is needed when volume-based alerts miss low-and-slow abuse. |
| DE.AE-03 — Anomalous Activity Is Understood | The question hinges on distinguishing ordinary automation from suspicious context. | |
| Recommendation — Tune monitoring to detect anomalous sequences, not only spikes or failures. Define and alert on context patterns that make low-rate activity suspicious. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Audit analysis must correlate request context to spot gradual abuse. |
| IA-5 — Authenticator Management | Legitimate credentials are the access path that makes these attacks look normal. | |
| Recommendation — Correlate audit records across identity, timing, and target to expose slow abuse. Reduce the value of stolen or long-lived authenticators through tighter lifecycle control. | ||
Practitioner Guidance
What to verify: Confirm that your detections can correlate identity, session, target, and time-series context, not just request counts or blocked events. If a control cannot explain why one sequence of valid actions is suspicious while another is normal, it is too coarse for this threat.
Decision rule: If an actor uses legitimate credentials and low-rate activity, prioritise behavioural correlation and blast-radius review before you wait for a high-volume alert. If the only evidence you have is a low count of requests, treat that as an alerting gap, not reassurance.
Practitioner takeaway: Slow AI-driven attacks win by staying inside the shape of normal work, so the defensive objective is to monitor context, sequence, and privilege use closely enough to spot abuse before it becomes statistically obvious.