Topic starter
09/06/2026 11:20 pm
TL;DR: AI has compressed the lifetime of phishing infrastructure and kit reuse, while 89% of phishing domains now disappear within two days and only 6.5% survive past 15 days, according to Push Security; the practical result is that blocklists and tool signatures are losing durability faster than defenders can refresh them. Technique-level detection, backed by browser visibility and faster research cycles, is now the only layer that remains structurally resilient.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “The Pyramid of Pain in the AI era: Why technique-level detection matters more than ever”.
By the numbers:
- 89% of phishing domains are active for fewer than two days, with just 6.5% surviving past 15 days.
- Push Security says it is tracking 18+ kits with device code phishing capabilities.
- Push Security reports a 37.5x increase in device code phishing detections this year alone.
Key questions
Q: Where does indicator-based phishing detection fail in practice?
A: It fails when the attacker can replace the indicator faster than the defender can distribute a block or update a signature.
Q: Why do browser-based attacks need browser-level visibility?
A: Because the decisive behaviour happens inside the session, not on the network edge.
Q: What are the signs that kit-signature hunting is falling behind?
A: You will see more one-off variants, faster domain turnover, and weaker reuse of the same code or hosting patterns.
Practitioner guidance
- Prioritise technique-based detection engineering Build detections around how an attack behaves in-session, including page flow, prompt behaviour, redirect choreography, and token-handling sequence.
- Expand browser-level telemetry coverage Instrument the browser layer so your team can observe DOM activity, user interaction sequence, and malicious page logic that network tools do not expose.
- Shorten research-to-detection cycles Treat new abuse patterns as time-sensitive detection content and push high-confidence behavioural rules quickly, before commoditisation spreads them across variants and reskins.
Bottom line: Indicator-based detection loses value when infrastructure lifetimes are measured in hours or days rather than weeks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
10/06/2026 1:38 am
Technique-level detection is now the only durable control plane for browser-based identity attacks. When infrastructure can be generated and discarded at machine speed, indicator-based detection loses structural value before it reaches operational maturity. The field needs to stop treating domains and hashes as the primary defence surface and start treating attacker behaviour as the control target. Practitioners should therefore re-centre detection strategy on techniques that survive infrastructure churn.
A few things that frame the scale:
- 89% of phishing domains are active for fewer than two days, with just 6.5% surviving past 15 days, according to The 52 NHI breaches Report.
- In our research, 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, with 38% having no or low visibility and 47% only partial visibility.
A question worth separating out:
Q: How can organisations measure whether technique-level detection is working?
A: They should measure how quickly novel abuse patterns move from first observation to production detection, and whether those detections still hold after infrastructure rotation. If coverage drops when the attacker changes domains or frontend code, the programme is still indicator-led rather than technique-led.
👉 Read our full editorial: Technique-level detection is overtaking indicator-based threat hunting
11/06/2026 12:42 am
Technique-level detection is now the only durable control plane for browser-based identity attacks. When infrastructure can be generated and discarded at machine speed, indicator-based detection loses structural value before it reaches operational maturity. The field needs to stop treating domains and hashes as the primary defence surface and start treating attacker behaviour as the control target. Practitioners should therefore re-centre detection strategy on techniques that survive infrastructure churn.
A few things that frame the scale:
- 89% of phishing domains are active for fewer than two days, with just 6.5% surviving past 15 days, according to The 52 NHI breaches Report.
- In our research, 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, with 38% having no or low visibility and 47% only partial visibility.
A question worth separating out:
Q: How can organisations measure whether technique-level detection is working?
A: They should measure how quickly novel abuse patterns move from first observation to production detection, and whether those detections still hold after infrastructure rotation. If coverage drops when the attacker changes domains or frontend code, the programme is still indicator-led rather than technique-led.
👉 Read our full editorial: Technique-level detection is overtaking indicator-based threat hunting
12/06/2026 2:16 am
Technique-level detection is replacing indicator hunting because the unit of attack has changed. AI compression has reduced the practical lifespan of domains, kits, and other disposable artefacts. When infrastructure can be generated and replaced in minutes, the control that survives is the one that keys off attacker behaviour rather than attacker packaging. Practitioners should assume the stable object is now the technique, not the indicator.
A question worth separating out:
Q: How should defenders balance indicators and technique-level detection?
A: Use indicators for enrichment, investigation, and clustering, but make technique-level behaviour the primary hunting model. That gives you a control that survives rehosting, rebranding, and kit fragmentation while still allowing indicators to support response and attribution.
👉 Read our full editorial: Technique-level detection is overtaking indicator-based threat hunting
This post was modified 1 day ago by NHI Mgmt Group