Notifications
Clear all
Topic starter
02/08/2026 9:37 am
TL;DR: As AI improves detection engineering and vulnerability discovery, attackers are pushed toward noisier, more user-like behavior that is harder to catch with static rules, according to LimaCharlie. The practical consequence is that security teams need better context-driven detections and tiered triage, not more rule tuning.
NHIMG editorial — based on content published by LimaCharlie: When AI changes the rules, attackers adapt
By the numbers:
- 79% of the detections they generated in a recent reporting period came from non-malware-based attacks, up from the low 40s the year prior.
Questions worth separating out
Q: How should security teams detect attacks that look like normal user activity?
A: Teams should combine identity context, session analysis, and behavioural baselines instead of relying on static signatures alone.
Q: Why do static detections fail when attackers adapt their tradecraft?
A: Static detections fail because they are built for stable patterns, while adaptive attackers vary tools, timing, and execution paths.
Q: How can organisations tell whether automated triage is actually helping?
A: Look at how quickly the team separates false positives from confirmed identity abuse, how much analyst time is reclaimed, and whether response consistency improves across repeat cases.
Practitioner guidance
- Build identity-aware detections Correlate authentication events, privilege changes, session duration, and unusual access paths so alerts can distinguish routine behaviour from adversary activity.
- Remove exception-heavy rule logic Review detections that have accumulated broad exclusions, manual overrides, or repeated false-positive tuning.
- Use tiered alert triage Keep deterministic filters and enrichment in the front of the pipeline, then reserve LLM-based analysis for ambiguous alerts that require context synthesis.
What's in the full article
LimaCharlie’s full blog covers the operational detail this post intentionally leaves for the source:
- The full discussion of Josh Neil’s detection-engineering rationale, including why he argues rule tuning creates exploitable gaps.
- The detailed argument for placing LLMs at the end of a triage pipeline rather than as a first-pass alert processor.
- The surrounding commentary from Defender Fridays on how AI changes the balance between malware-based and behaviour-based threats.
- The source article’s broader context on MSSP and SOC operating models, which this post only summarises at a governance level.
👉 Read LimaCharlie's analysis of how AI is changing attacker tradecraft →
AI-driven attacker adaptation: are SOC detections keeping up?
Explore further
02/08/2026 12:32 pm
Behavioural attack pressure is now a governance problem, not just a detection problem. When adversaries can hide inside normal-looking activity, security teams need more than signature tuning. Identity context, session behaviour, and privilege patterns become the governing signals that separate routine use from hostile use. That elevates IAM and SOC integration from a nice-to-have to a core control relationship. Practitioner conclusion: detection programmes must be built around identity-aware behavioural context.
A question worth separating out:
Q: Who is accountable when attackers exploit behaviour that blends into normal operations?
A: Accountability sits with both detection engineering and control owners. SOC teams own the alert logic, while identity and access teams own the telemetry needed to interpret who or what should have been acting. When behaviour-based attacks succeed, the root issue is usually a governance gap between access context and detection design.
👉 Read our full editorial: AI changes attacker behavior as defensive channels narrow
