TL;DR: Traditional threat intelligence sees only the last 5% of an attack, while Silent Push says its Context Graph surfaces adversary staging infrastructure an average of 104 days before weaponisation. The operational shift is from after-the-fact alerting to earlier infrastructure visibility, where identity and automation controls must consume deterministic signals, not noisy indicators.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Silent Push's blog post: Most threat intelligence arrives too late, and its Context Graph can surface adversary infrastructure during the preparation phase before an attack launches.
Why it matters: This matters because security teams need earlier, more deterministic signals to drive SIEM, SOAR, and blocking decisions before adversary infrastructure is weaponised, including the automation identities that act on those signals.
By the numbers:
- Traditional threat intelligence usually sees only the last portion, about 5%, of an attack.
- Silent Push says it surfaces adversary staging infrastructure 104 days before it is weaponised on average.
Context
Threat intelligence often arrives after a campaign is already in motion, which leaves defenders reacting to infrastructure that has moved from preparation to exploitation. The governance gap is not a shortage of alerts, but a shortage of reliable pre-attack signal that can be operationalised inside SOC workflows and identity-aware automation.
Threat hunting and infrastructure analysis become more valuable when they are aimed at the preparation phase rather than the incident tail. In this article, the core problem is how to distinguish ordinary internet noise from adversary staging activity early enough to change blocking and triage decisions.
For identity and automation programmes, the practical question is whether SIEM, SOAR, and AI-assisted workflows are consuming deterministic evidence or merely amplifying unverified indicators. That distinction is especially important when agentic workflows and automation identities are allowed to act on security data.
Key questions
Q: What breaks when security teams rely only on static IOCs for cloud threat hunting?
A: Static IOCs age quickly and miss changing attacker behavior. When teams depend on them alone, they overlook evolving campaigns, related TTPs, and the broader context that shows how an intrusion unfolds. That leads to narrow detections, slower investigation, and missed opportunities to identify exposed assets before an attacker reaches them.
Q: Why do pre-attack infrastructure signals reduce SOC noise?
A: Because they let teams prioritise clusters that are being actively built instead of chasing every alert with the same urgency. When DNS changes, hosting patterns, certificates, and registration behaviour line up, the signal is stronger than a flat indicator. That reduces enrichment churn and improves the quality of escalations.
Q: What do security teams get wrong about detection-led security in AI attacks?
A: They often assume detection can still assemble enough context before the attacker finishes. In machine-speed intrusions, the problem is not visibility alone, but timing. If identity controls do not intervene during the request itself, alerts arrive after the meaningful access has already happened.
Q: How should teams use infrastructure intelligence alongside existing monitoring tools?
A: Use it as an enrichment and prioritisation layer, not a replacement for telemetry. The goal is to connect verified infrastructure clusters to SIEM, SOAR, and blocking decisions so defenders can act earlier, while still keeping retrospective hunting and incident review intact.
Technical breakdown
How pre-attack infrastructure staging becomes visible
Adversaries rarely jump straight from idea to exploitation. They register domains, configure servers, change hosting, and age infrastructure before a phishing page, C2 node, or lure is used. Those steps create observable patterns across DNS resolution changes, WHOIS records, SSL certificates, host scans, and ASN placement. When those signals are correlated over time, they reveal staging behaviour rather than just a point-in-time indicator. That is the difference between a static blocklist and an infrastructure graph that tracks preparation as a process.
Practical implication: Build detections around infrastructure change patterns, not just known-bad indicators.
Why indicators of future attack and IOCs are complementary
IOC data describes what was already used in an attack, while indicators of future attack describe infrastructure that is still being built. That means the two support different decisions: retrospective hunting versus pre-emptive blocking. If a team treats them as substitutes, it loses one side of the timeline. The useful model is layered correlation, where verified future-oriented infrastructure feeds enrich, prioritise, and contextualise the older IOC view without replacing it.
Practical implication: Use both forward-looking and retrospective intelligence in the same workflow so analysts can block earlier and investigate later.
Why deterministic data matters for AI-assisted security
AI-assisted workflows fail when they are fed noisy, probabilistic, or poorly sourced intelligence. Deterministic data gives the system stable facts to reason over, such as whether an IP resolves to a domain, whether a certificate matches a known pattern, or whether infrastructure clusters share operational traits. That is what makes AI useful for investigation and pivoting instead of guesswork. In practice, the quality of the underlying evidence determines whether automation reduces analyst load or simply scales false positives. See the SOAR and Security Automation Guide.
Practical implication: Feed automation and AI workflows only with verifiable signals that can support repeatable decisions.
Threat narrative
Attacker objective: The attacker’s objective is to create usable infrastructure that can support a campaign before defenders can detect or block it.
- Entry is delayed until adversaries have built and aged infrastructure that can support phishing or command-and-control activity.
- Credential or access abuse is not the primary theme here; the decisive step is infrastructure preparation that makes later delivery and callback reliable.
- Escalation occurs when the staged environment is weaponised and the attacker can pivot from preparation to active campaign execution.
- Impact is measured in faster, less visible campaigns that arrive after defenders have already lost the pre-attack window.
Breaches seen in the wild
- Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Pre-attack infrastructure intelligence is now a governance problem, not just a detection problem. Security teams have long accepted that IOCs describe the past, but this article shows that the bigger issue is whether control planes can consume signals early enough to change action. If intelligence arrives after the campaign has started, governance has already failed at the point of decision.
Context graphing creates a new control concept: infrastructure provenance. The useful question is no longer only whether an indicator is bad, but how it was built, aged, hosted, and changed over time. That is a stronger basis for triage than reputation alone, and it gives defenders a defensible way to prioritise activity before it turns into impact.
Deterministic threat data is the difference between automation and delegated guesswork. AI-assisted security workflows need facts they can verify, especially when SOAR or agentic systems are allowed to trigger responses. If the signal is probabilistic and unproven, the automation inherits that uncertainty. The practitioner implication is to treat evidence quality as an access-control issue for machines, not just a tuning issue.
stolen-token infrastructure pivots prove why preparation-stage visibility matters. When compromise appears after infrastructure has already been staged, defenders are forced into cleanup. That pattern is familiar across breach investigations: the window to prevent execution closes before most teams see the trail. The practitioner conclusion is to hunt for the staging process itself, not only the resulting compromise.
The market is shifting toward preemptive detection, but the real test is integration discipline. A tool that finds earlier infrastructure only matters if SIEM, SOAR, and blocking workflows can act on it without adding noise. The governance question is whether teams can operationalise forward-looking intelligence without creating another unmanaged feed.
From our research library:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
- Read next: Threat Hunting Guide
What this signals
Infrastructure provenance is becoming a practical control surface. If defenders can see how hostile infrastructure is assembled, aged, and repositioned, they can intervene before the delivery phase instead of only after compromise. That is especially important where automation identities or AI-assisted workflows are trusted to act on intelligence without human review.
Security automation needs evidence quality gates. As more teams use SOAR and AI-assisted triage, the control question shifts from speed to trustworthiness. When the evidence layer is deterministic, the response layer can be faster without becoming reckless; when it is not, automation simply scales uncertainty.
Pre-attack visibility changes the role of threat hunting. The hunt is no longer just a retrospective search for what was missed. It becomes an ongoing programme for finding the staging clusters that will matter next, which means telemetry, enrichment, and response must be designed as one loop.
For practitioners
- Integrate pre-attack indicators into SIEM correlation Map infrastructure staging signals into correlation rules so analysts can prioritise clusters that are being actively built rather than waiting for callback-based alerts.
- Feed verified clusters into SOAR response paths Use only deterministic infrastructure evidence to trigger playbooks, and restrict automated actions to verdicts that can be explained and audited.
- Separate forward-looking intelligence from IOC-only processes Keep blocklists, retro hunting, and pre-attack monitoring as distinct workflows so teams do not lose early warning when they focus on cleanup.
- Treat automation inputs as governed evidence Require provenance, repeatability, and traceable source data before allowing agents or scripts to consume threat intelligence in production workflows.
Key takeaways
- The core problem is not the absence of threat data, but the fact that much of it arrives after adversary infrastructure has already been used.
- The article claims a measurable lead time, including an average 104-day window before staged infrastructure is weaponised.
- Teams get more value when they connect pre-attack infrastructure intelligence to SIEM, SOAR, and blocking workflows that can act on verified signals.
Related NHI Mgmt Group resources: Threat Hunting Guide · SIEM Guide · SOAR and Security Automation Guide · Slack GitHub breach 2022
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001;TA0007;TA0008;TA0011 — Initial Access; Discovery; Lateral Movement; Command and Control | The article centres on adversary infrastructure preparation and movement toward campaign execution. |
| Recommendation — Map staging infrastructure and callback patterns to ATT&CK and hunt for pre-exploitation behaviour in your telemetry. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | The piece is about turning infrastructure signals into earlier detection and monitoring decisions. |
| Recommendation — Extend DE.CM-01 monitoring to include infrastructure-change signals, not only incident-time alerts. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | The workflow relies on continuous monitoring, enrichment, and blocking based on hostile infrastructure patterns. |
| Recommendation — Use CIS-13 to correlate DNS, host, and certificate telemetry into operational blocking decisions. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Analysts need reviewable, explainable evidence before automation acts on threat intelligence. |
| SI-4 — System Monitoring | The article is fundamentally about monitoring hostile infrastructure as it changes over time. | |
| Recommendation — Apply AU-6 to review and validate threat-intelligence evidence before automated response consumes it. Use SI-4 to monitor for infrastructure changes that indicate adversary staging activity. | ||
Key terms
- Indicator Of Future Attack: An indicator of future attack is infrastructure, behaviour, or content that suggests an adversary is preparing a campaign before compromise is visible. It shifts detection from after the breach to before execution, which is critical for preemptive defense and AI-assisted triage.
- Passive DNS: Passive DNS is historical DNS observation data used to understand how domains and subdomains have resolved over time. Security teams use it to uncover assets that may not appear in current scans or certificate logs. That makes it valuable for identifying hidden, legacy, or previously exposed infrastructure.
- Deterministic Threat Data: Deterministic threat data is evidence that can be verified rather than inferred, such as a domain resolution, certificate match, or known infrastructure relationship. It matters because automation and AI systems perform better when they receive facts that can be checked, repeated, and explained.
- Infrastructure Staging: Infrastructure staging is the preparatory work an attacker performs before a campaign is launched, including domain registration, server setup, hosting changes, and configuration adjustments. It is often observable if teams look for change patterns rather than waiting for malicious traffic to appear.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect identity controls to the broader security workflows that depend on them.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org