AI changes attacker behavior as defensive channels narrow

At a glance

What this is: This is an analysis of how AI is changing attacker tradecraft and why that makes defensive detection harder.

Why it matters: It matters because SOC, IAM, and security engineering teams will increasingly face adversary behaviour that blends into normal user activity, raising the bar for context-aware detection, identity signals, and response prioritisation.

By the numbers:

• 79% of the detections they generated in a recent reporting period came from non-malware-based attacks, up from the low 40s the year prior.

👉 Read LimaCharlie's analysis of how AI is changing attacker tradecraft

Context

AI changes attacker behaviour by narrowing some traditional attack paths while leaving adversaries room to adapt into more legitimate-looking activity. The result is not fewer attacks, but a harder detection problem for SOC teams, because malicious actions increasingly resemble normal user behaviour.

That shift matters for identity and access governance as well. When attacks blend into ordinary usage patterns, identity signals, privilege context, session history, and access anomalies become more important than simple signature or rule matching. In practice, this is a detection-and-governance problem as much as a tooling problem.

Key questions

Q: How should security teams detect attacks that look like normal user activity?

A: Teams should combine identity context, session analysis, and behavioural baselines instead of relying on static signatures alone. The goal is to identify when access, timing, and action sequences diverge from what is normal for that user, workload, or service identity. This works best when SOC and IAM teams share telemetry and investigate anomalies together.

Q: Why do static detections fail when attackers adapt their tradecraft?

A: Static detections fail because they are built for stable patterns, while adaptive attackers vary tools, timing, and execution paths. Every exception added to a brittle rule increases the space an adversary can use. Teams need detections that are context-rich from the start, not logic that depends on constant manual tuning.

Q: How can organisations tell whether automated triage is actually helping?

A: Look at how quickly the team separates false positives from confirmed identity abuse, how much analyst time is reclaimed, and whether response consistency improves across repeat cases. If automation only creates another queue, it is not reducing operational burden. The useful signal is faster containment with less manual handling.

Q: Who is accountable when attackers exploit behaviour that blends into normal operations?

A: Accountability sits with both detection engineering and control owners. SOC teams own the alert logic, while identity and access teams own the telemetry needed to interpret who or what should have been acting. When behaviour-based attacks succeed, the root issue is usually a governance gap between access context and detection design.

Technical breakdown

Why AI pushes attackers toward behavioural abuse

When defenders improve malware detection, vulnerability discovery, and routine triage, attackers lose easy paths and look for channels that still work at scale. Behavioural abuse means the adversary uses legitimate tools, normal protocols, and user-like timing patterns instead of obviously malicious payloads. That makes the attack blend into expected traffic and activity. The more a defender relies on static rules, the easier it is for an attacker to stay inside the rule set while still achieving persistence, data access, or exfiltration.

Practical implication: teams should treat legitimate-looking behaviour as a primary detection surface, not a secondary exception.

Why static detections break under adaptive pressure

Static detections work best when the attack pattern is stable and the signal is distinct. They fail when adversaries can vary sequence, timing, identity context, or infrastructure while keeping intent intact. The article’s central point is that every exception added to a brittle rule creates space for evasion. Better detection engineering starts with richer context, fewer ad hoc exceptions, and alert logic that understands what is normal for a given user, workload, or identity. In identity-heavy environments, that means access behaviour matters as much as event content.

Practical implication: reduce rule tuning debt and anchor detections to contextual baselines for users, workloads, and service identities.

Why LLMs belong late in the triage pipeline

LLMs can help classify ambiguous alerts, but they are not the right first-line processor for most security events. Classical filters and deterministic logic are cheaper and more reliable for the bulk of routine alerts. The article argues that LLMs should operate at the end of a tiered pipeline, where they add judgment only after simpler controls have already removed obvious noise. That architecture lowers cost, reduces analyst overload, and preserves the model for cases that genuinely need contextual interpretation.

Practical implication: use LLMs for ambiguous, high-context cases only after deterministic filtering and enrichment have done the first pass.

Threat narrative

Attacker objective: The objective is to maintain access and carry out malicious activity without triggering the defender’s traditional detection layers.

1. Entry begins when attackers avoid obviously malicious payloads and instead use legitimate-looking activity channels that are harder for static rules to flag.
2. Escalation occurs as they adapt their methods into behavioural patterns that resemble normal users, allowing them to stay inside existing detection thresholds.
3. Impact follows when the organisation misses the adversary because the activity blends into routine operations, delaying investigation and response.

NHI Mgmt Group analysis

Behavioural attack pressure is now a governance problem, not just a detection problem. When adversaries can hide inside normal-looking activity, security teams need more than signature tuning. Identity context, session behaviour, and privilege patterns become the governing signals that separate routine use from hostile use. That elevates IAM and SOC integration from a nice-to-have to a core control relationship. Practitioner conclusion: detection programmes must be built around identity-aware behavioural context.

Static rule maintenance creates a blind spot that attackers can exploit. The article’s strongest operational point is that every exception added to a rule weakens its reliability. That is a governance debt issue as much as a tuning issue, because the organisation ends up preserving broken logic instead of redesigning it. Detection-response latency: the longer teams depend on patched rules, the more time attackers have to operate inside legitimate-looking activity. Practitioner conclusion: reduce exception-heavy logic and rebuild detections with better context.

LLMs should augment triage, not become the default analyst layer. Routing every alert through a model is expensive and unnecessary for most environments. The right pattern is tiered handling, where deterministic systems clear the obvious cases and LLMs only handle the ambiguous residue. That avoids wasting expensive reasoning on routine noise and keeps analysts focused on context-rich investigation. Practitioner conclusion: design AI-assisted SOC workflows as selective escalation paths, not universal processing layers.

The squeeze thesis explains why adversaries will keep shifting toward identity-adjacent abuse. As direct attack paths narrow, attackers seek channels that look more like ordinary access, including authenticated sessions and human-like activity patterns. That matters for IAM and NHI governance because the same blending effect can obscure stolen credentials, service account abuse, and agent-driven misuse. Practitioner conclusion: treat identity telemetry as part of the detection stack, not just the access stack.

What this signals

Behavioural detection debt: as attackers shift into more legitimate-looking activity, the weakest point in many programmes will be the gap between identity telemetry and SOC logic. Teams should expect more cases where the activity is authenticated, permitted, and still malicious, which means detection design must move closer to identity governance and session context.

For practitioners, the programme signal is clear: reduce dependency on rule churn, improve access-context enrichment, and make investigation paths sensitive to behavioural change rather than payload type. That also strengthens response when stolen credentials, service accounts, or AI-driven access patterns are involved.

The broader planning implication is that AI will not simply automate defence. It will also raise attacker sophistication, compressing the window in which obvious malicious behaviour exists. Security leaders should prepare for a world where the best indicators are subtle, cross-domain, and increasingly identity-linked.

For practitioners

• Build identity-aware detections Correlate authentication events, privilege changes, session duration, and unusual access paths so alerts can distinguish routine behaviour from adversary activity. Use identity context to score whether a user, service account, or workload is behaving normally across time and systems.
• Remove exception-heavy rule logic Review detections that have accumulated broad exclusions, manual overrides, or repeated false-positive tuning. Rework those rules around stronger baselines instead of preserving weak logic that an attacker can learn and exploit.
• Use tiered alert triage Keep deterministic filters and enrichment in the front of the pipeline, then reserve LLM-based analysis for ambiguous alerts that require context synthesis. This reduces cost while preserving human attention for cases that actually need judgment.
• Add behavioural signals to SOC playbooks Update investigation steps so analysts check access patterns, unusual command sequences, and identity reuse when an alert does not resemble malware. Behavioural anomalies should be treated as primary evidence, not as soft context.

Key takeaways

• AI is changing attacker behaviour by pushing adversaries toward legitimate-looking activity that static rules struggle to detect.
• The operational evidence points to a growing share of non-malware attacks, which makes context-aware detection more important than rule tuning.
• Security teams should treat identity signals, behavioural baselines, and tiered AI-assisted triage as core parts of modern detection design.

Key terms

• Behavioural attack: An attack that relies on actions that resemble normal user or system activity instead of obviously malicious code. These attacks are harder to detect because the signal comes from context, timing, and sequence rather than from a payload or exploit alone.
• Detection Engineering: The discipline of designing, testing, and maintaining detection logic so it remains useful against real attacker behaviour. It covers telemetry selection, rule quality, false-positive management, and the operational workflow needed to keep alerts actionable.
• Identity Telemetry: Identity telemetry is the collection of signals generated by authentication, session, and access events across human and non-human identities. It becomes useful for governance when teams can baseline normal behavior and detect drift in source, privilege, or access frequency.
• Tiered triage: A workflow that processes alerts in stages, using cheap deterministic logic first and reserving more expensive or nuanced analysis for cases that remain ambiguous. This reduces cost, lowers noise, and keeps human or AI attention focused where it is most useful.

What's in the full article

LimaCharlie’s full blog covers the operational detail this post intentionally leaves for the source:

• The full discussion of Josh Neil’s detection-engineering rationale, including why he argues rule tuning creates exploitable gaps.
• The detailed argument for placing LLMs at the end of a triage pipeline rather than as a first-pass alert processor.
• The surrounding commentary from Defender Fridays on how AI changes the balance between malware-based and behaviour-based threats.
• The source article’s broader context on MSSP and SOC operating models, which this post only summarises at a governance level.

👉 The full LimaCharlie post covers the Defender Fridays discussion, the detection-engineering argument, and the triage model in more detail.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is designed for practitioners who need to connect identity controls to real-world security operations.