AI detection labels need ATLAS context for agentic attack triage

At a glance

What this is: Expel argues that AI detections should be labeled with MITRE ATLAS and ATT&CK in parallel so analysts can triage AI-related activity with clearer tactic and technique context.

Why it matters: This matters because SOC and IAM teams now need shared language for prompt injection, tool misuse, and agent abuse without losing the discipline of behavior-based detection and human-led response.

👉 Read Expel's analysis of MITRE ATLAS mapping for AI detections

Context

AI security is becoming a detection engineering problem as much as a governance problem. Once assistants and agents can query tools, reach internal systems, and touch sensitive data, the key question is no longer whether AI exists in the environment, but whether teams can observe what it is doing and map that behavior to a usable control framework. Expel’s framing is relevant because it ties AI activity back to the same operational logic SOC teams already use for traditional threats.

The identity intersection is real: AI agents, assistants, and tool-connected workflows behave like non-human identities when they are granted permissions, consume prompts, and invoke actions. That creates a governance boundary that sits between AI telemetry and identity control, which is where the NHI discipline becomes important. For teams managing AI risk, the challenge is not only detection coverage, but whether those AI systems are governed as identities with defined scope, privilege, and oversight.

Key questions

Q: How should security teams handle prompt injection in AI systems?

A: Treat prompt injection as an authorisation problem, not only a content problem. Validate user input, monitor for override patterns, and block any prompt that tries to change model policy, exfiltrate data, or trigger sensitive actions. The safest design is one where untrusted prompts cannot directly reach code execution, production data, or privileged tools without policy checks.

Q: Why do AI SOC agents complicate identity governance more than traditional SOAR?

A: Because they do more than execute predefined steps. They choose what to query, which hypotheses to test, and when to pivot, which makes them decision-making consumers of identity data rather than passive workflow tools. That creates a need for access scoping, auditability, and accountability around every delegated identity touchpoint.

Q: What breaks when teams rely only on control plane logs for AI security?

A: Teams miss the reason an action happened. Control plane logs show who logged in, who changed a setting, or which tool was available, but they do not reveal the prompt content that triggered misuse. Without content plane evidence, defenders can spot activity but struggle to distinguish benign use from injected or malicious instructions.

Q: Who should own the decision when AI suggests removing or granting access?

A: The access owner, manager, or control owner should own the decision, depending on the entitlement type. AI can recommend removal, reduction, or escalation, but governance remains a human responsibility. That separation preserves accountability and prevents the organisation from confusing workflow speed with control effectiveness.

Technical breakdown

MITRE ATLAS labels for AI detections

MITRE ATLAS gives AI defenders a tactic-and-technique vocabulary similar to MITRE ATT&CK, but tailored to AI systems. The value is not the label itself, but the analyst shortcut it creates: a detection can be placed into a stage, linked to adjacent techniques, and investigated without reverse-engineering the vendor’s intent. In practice, that is especially useful for prompt injection, tool misuse, and model-targeted abuse, where one event often reflects a chain rather than a single action. ATLAS is most effective when paired with behavior-first logging, because the framework is a lens on evidence, not a substitute for telemetry.

Practical implication: map AI detections to ATLAS stages so analysts can pivot from a single alert to likely adjacent attacker behavior.

Control plane versus content plane telemetry

AI platforms usually expose control plane data such as logins, configuration changes, and tool enablement. That tells you something happened, but not necessarily what the user or agent was trying to achieve. Content plane telemetry captures prompt text and tool-use context, which is where intent becomes visible. For AI security, this distinction is critical because an instruction hidden inside uploaded content can trigger an agent into actions the user never explicitly requested. Without content-plane signals, defenders see only activity and miss the manipulation that caused it.

Practical implication: collect prompt and tool-use evidence, not just admin logs, if you want to detect injected instructions and rogue AI actions.

Why one primary technique per detection matters

A detection that tries to describe every possible explanation becomes hard to use. Expel’s rule to assign one primary technique per detection reflects a basic SOC principle: labels should describe the observed behavior, not a guessed motive. That keeps triage consistent, supports faster analyst handoff, and avoids muddying detection logic with speculative attribution. In AI environments, this is even more important because a single session may include prompt injection, excessive tool use, and data exposure. The useful label is the first observable stage that best explains the evidence, with adjacent techniques used for context, not confusion.

Practical implication: write detections around observable behavior first, then use adjacent techniques as supporting context rather than the headline.

Threat narrative

Attacker objective: The attacker wants the AI system to carry out unauthorized actions or expose sensitive information while appearing to follow normal user instructions.

1. Entry occurs when malicious or manipulated content is introduced into an AI workspace and the assistant consumes it as instructions rather than as inert text.
2. Escalation follows when the injected instruction drives the agent to misuse connected tools or reach beyond the user’s intended query.
3. Impact occurs when the agent reveals sensitive material, performs unintended actions, or propagates attacker influence through internal systems.

NHI Mgmt Group analysis

AI detection now needs an identity lens, not just an alerting lens. Once assistants and agents are wired into internal tools, they start behaving like governed systems with permissions, scope, and operational consequences. That makes AI telemetry inseparable from identity governance, especially where prompt injection or tool misuse can turn a model into an unwitting executor. Practitioners should treat AI-connected systems as identity-bearing workloads with visible boundaries.

Behavior-first labeling is the right answer to a noisy AI threat surface. The article’s one-primary-technique rule is more than a product design choice. It reflects a wider detection principle: if defenders cannot describe the observed behavior cleanly, they cannot triage it consistently or scale response. For AI security programmes, the discipline is to label what happened, then map likely follow-on techniques without overfitting the alert to presumed attacker intent.

Content-plane visibility is becoming the decisive control gap in AI governance. Many organisations can see who logged in or which tool was enabled, but not what the prompt tried to do once inside the session. That is the governance gap exploitation depends on, because prompt injection lives in the content layer while impact emerges in the action layer. Teams should expect the next phase of AI security tooling to centre on this visibility gap rather than on broader AI awareness messaging.

ATLAS will matter most where AI security and SOC operations converge. MITRE ATLAS gives defenders a common reference point for AI-specific tradecraft, but its real value is operational consistency. It helps security teams compare coverage, baseline detections, and explain gaps without inventing a parallel language for every model or assistant. Practitioners should expect ATLAS to become the bridge between AI governance teams and SOC analysts who need a practical way to talk about AI attack stages.

Agentic AI governance is becoming an NHI problem in practice. When an assistant has tools, permissions, and autonomous execution paths, the control question is no longer only model safety. It becomes who or what is allowed to act, under what scope, and with what evidence trail. That is classic non-human identity territory, and teams that fail to govern AI systems as identities will keep discovering risk only after tool execution has already occurred.

What this signals

AI security programmes are moving toward a merged control model where detection engineering, identity governance, and agent oversight have to work together. The practical signal for readers is that agent-connected systems should be reviewed as access-bearing workloads, not as passive software features, and baseline governance should include ownership, scope, and telemetry expectations. For a broader framework context, see the MITRE ATT&CK Enterprise Matrix and the MITRE ATLAS adversarial AI threat matrix.

Agent telemetry debt: the more AI tools are connected to internal systems without content-plane visibility, the more organisations accumulate a blind spot that looks like normal use until it becomes data exposure or unauthorized action. That gap is especially dangerous in identity-heavy environments where permissions are already fragmented. Teams should treat AI tool access as an NHI lifecycle issue and align it with the NHI Lifecycle Management Guide.

For practitioners

• Map AI detections to a primary technique Assign one primary MITRE ATLAS or ATT&CK technique to each AI-related detection, then attach adjacent techniques as supporting context. This keeps triage fast and prevents alerts from turning into narrative summaries instead of evidence.
• Collect prompt and tool-use telemetry Instrument both control plane and content plane signals so analysts can see prompt text, tool invocation, and the relationship between user intent and agent action. Admin logs alone will not show indirect prompt injection.
• Treat AI assistants as governed identities Inventory assistants and agents that can reach internal systems, assign owners, and define access scope, approval paths, and logging expectations. If an AI system can act, it needs identity-style governance, not just a platform setting.
• Baseline AI coverage against ATLAS tactics Use MITRE ATLAS to identify which tactics your detections cover and where visibility stops at the edge of the AI environment. That baseline should feed gap analysis for prompt injection, tool misuse, and content-driven exfiltration.

Key takeaways

• AI detections are becoming more useful when they carry both AI-specific and traditional attack labels, because analysts need tactic context, not just alert volume.
• Content-plane telemetry is the difference between seeing activity and understanding intent, which is why prompt-level visibility matters for AI governance.
• As agents gain tool access and execute actions, they inherit non-human identity risk and must be governed with ownership, scope, and response discipline.

Key terms

• Content Plane Telemetry: Content plane telemetry captures the substance moving through an AI interaction, including prompt text, instructions, and tool-use context. It matters because control logs can show that an action occurred, but content-plane data is often what reveals whether the action was induced, manipulated, or malicious.
• Telemetry Control Plane: The telemetry control plane is the layer that decides what security data is collected, transformed, enriched, and routed before it reaches downstream tools. It is where log governance happens, because the organisation can still shape quality, volume, and destination before paying ingestion and storage costs.
• MITRE ATLAS: MITRE ATLAS is a taxonomy of adversarial techniques used against AI systems. It gives defenders a shared vocabulary for describing attack methods, but it does not define the monitoring surfaces, telemetry, or operational controls needed to detect those methods in practice.
• Tool Misuse: Tool misuse occurs when an agent uses an allowed integration in a way that exceeds its intended task, scope, or risk tolerance. The problem is often not access alone but the combination of valid credentials, broad permissions, and unbounded action sequencing.

What's in the full article

Expel's full analysis covers the operational detail this post intentionally leaves at the framework level:

• How Workbench maps AI-related detections to MITRE ATLAS and ATT&CK in practice
• What the control plane and content plane signals look like in the detection pipeline
• Why some ATLAS tactics are structurally invisible from SOC telemetry alone
• How early-access Claude signals are being incorporated into detection workflows

👉 The full Expel post covers the detection examples, ATLAS coverage details, and AI telemetry workflow in more depth.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management for practitioners managing agentic systems and service access. It is suitable for teams that need to connect identity control to broader security operations.