Topic starter
06/09/2026 6:20 pm
TL;DR: AI is accelerating both offensive activity and defensive detection in application security, with the source article arguing that behavioural data, control-flow signatures, and runtime signals can help distinguish bots, abuse, and suspicious application execution patterns. Arxan Technologies frames this as an application hardening problem where defenders need richer telemetry and AI-assisted analysis to keep pace with increasingly automated attackers.
Editorial analysis by NHI Mgmt Group, based on content published by Arxan Technologies: “AI-Powered Hacking Part Two, the ABCs: ‘AI. Based. Defense.’”.
Key questions
Q: How should security teams detect and block bad bots without locking out real users?
A: Start by combining multiple signals instead of relying on a single control like IP reputation or CAPTCHA alone.
Q: Why do control-flow anomalies matter in application security?
A: They matter because many legitimate application journeys follow a stable sequence of checks and actions.
Q: What are the signs that application telemetry is too weak for AI detection?
A: Common signs include sparse session data, limited device context, inconsistent logging across channels, and alerting that depends on one signal at a time.
Practitioner guidance
- Instrument behavioural telemetry across high-value journeys Capture mouse movement, timing, device state, and session patterns for workflows where bot abuse or account takeover would matter most.
- Baseline normal execution flow for critical functions Map the expected order of guards, validations, and sensitive operations so deviations can be scored as suspicious rather than ignored as noise.
- Correlate runtime signals with identity risk Connect application telemetry to authentication and fraud signals so a suspicious session can be evaluated in context rather than in isolation.
Bottom line: AI-powered defence is most useful when it can compare real user behaviour against automated execution patterns in runtime data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 6:21 pm
AI-assisted detection is becoming a control layer for application abuse, not just a security analytics add-on. When bots can imitate user activity closely, the value shifts to runtime discrimination across behaviour, device state, and execution path. That matters because application security and fraud prevention are converging around the same evidence set. Practitioners should treat telemetry quality as a governance issue, not only a detection issue.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How do IAM and application security teams share responsibility for bot risk?
A: IAM handles assurance of who or what is authenticating, while application security handles whether the runtime behaviour matches a legitimate use case. Bot risk sits between those domains, so shared policy is essential. Teams should agree on which signals trigger step-up checks, where to block automation, and when to escalate suspicious sessions for investigation.
👉 Read our full editorial: AI-powered application defense is reshaping threat detection