Category: Artificial Intelligence

AI Is Entering the Physical World: Cybersecurity Must Change Now

AI Is Entering the Physical World: Cybersecurity Must Change Now
Image generated by ChatGPT, 2026

Part 2 of “AI Is entering the physical world”

Considering everything covered in part 1 of this article, it’s time to explore the importance and relevance of the adversarial mindset.

The Adversarial Mindset Must Extend to Perceived Reality

Security teams cannot limit questions to something like:

Does the AI accurately understand the environment?

Instead, they should ask:

How could I make the AI misunderstand the environment while leaving it confident that its understanding remains accurate?

That shift produces very different security exercises.

For example, the following questions start to gain power:

  • Can conflicting sensor states exist?
  • Can temporal relationships between events be manipulated?
  • Can a legitimate device report technically valid but physically impossible values?
  • Can one AI agent be made to trust information supplied by another compromised agent?
  • Can some AI technology be fooled into selecting a dangerous action that still appears rational?
  • Can several individually low-risk inputs be influenced such that their combined effect changes some system’s interpretation of reality?

This goes far beyond vulnerability scanning.

It requires an understanding of the target environment and the making of educated (adversary informed) attacking assumptions.

Identity Becomes Even More Important in the Physical World

Interestingly, physical AI also amplifies the importance of identity. This is important given that many of the older OT protocols have no notion of a user or identity. Think about that, in many cases older ecosystems would allow network traffic carrying commands that could create physical impact. Yet, no authenticated user was part of the equation. We must do better now.

Every participant in a physical environment needs an identity or an attributable source of authority. That includes people, sensors, robots, cameras, controllers, applications, models, workloads, autonomous agents, and external systems.

The AI must know more than what information arrived.

It needs context about where that information came from, which identity produced it, and whether the organization should trust that source.

Likewise, when some AI technology decides to act, the receiving system needs to understand the authority behind that action.

Organizations should preserve a hierarchical chain such as:

  • Human owner
  • AI system
  • Model decision
  • Agent identity
  • Delegated authority
  • Physical command
  • Machine action

When anything within that chain breaks, accountability breaks with it.

More importantly, security loses the ability to determine whether something with legitimate authority produced some physical action.

In IT, a compromised identity can expose information or disrupt systems.

In physical AI, a compromised identity may eventually move something.

Cybersecurity Must Now Protect State, Not Just Systems

As physical AI develops, cybersecurity architecture will need to focus increasingly on state. Some of the types of questions that need answers as they relate to state are:

  • What is true right now?
  • Which entities exist at the moment?
  • What are these entities doing?
  • Which relationships connect them?
  • What actions have already occurred?
  • Which future states remain plausible?
  • What authority exists to change the current state?

And critically:

How confident are we that the data describing current state is trustworthy?

Traditional alerts often examine individual events.

Physical AI security will need to understand sequences, relationships, causality, and physical context.

Some examples are:

  • A temperature reading of 190 degrees may be safe in one operating state and extremely dangerous in another.
  • A valve opening may be normal after one event and malicious after another.
  • A robot entering an area may present little risk until a person enters the same physical space.

In the physical domain, context determines risk.

Therefore, security platforms will need stronger temporal models, dynamic graphs, event streams, behavioral baselines, identity relationships, process awareness, and state prediction.

The goal cannot remain simply detecting what has already happened.

We need to understand what is happening, why it is happening, and what is likely to happen next.

This represents another important shift for cybersecurity.

Historically, security operations have been overwhelmingly reactive. An event occurs, a signal appears, an alert fires, and analysts investigate. The entire incident response industry exists because of this reactive model.

Physical AI will demand more predictive security.

If some AI technology controlling or influencing an environment can reason about what happens next, defenders must develop comparable capabilities to identify dangerous future states before systems can reach them.

The objective becomes more than detecting malicious activity.

It becomes preventing the environment from reaching an unsafe state.

Six Security Principles for Physical AI

This is not television, and it will be a bit before humanoid robots begin to appear throughout the enterprise. Cybersecurity leaders do not need to wait for that day before they start preparing. That preparation can begin now and here are six relevant suggestions:

1. Protect the Data That Defines Reality

Identify the data that physical AI systems use to understand their environment.

Establish provenance, integrity controls, behavioral baselines, cross-source validation, and clear ownership. This data needs to be protected as it will be the basis of important truths.

Furthermore, treat manipulation of physical-state data as a high-consequence security event.

We have spent decades protecting sensitive data from exposure. Physical AI requires equal attention to protecting data from malicious alteration.

2. Understand Semantics, Not Just Traffic

Do not stop at network visibility as that is simply not enough.

Understand what commands and values actually mean to consuming physical processes.

This was central to the data-centric approach I advocated in OT security years ago, and it becomes even more important when AI consumes that information to understand some environment.

Allowed communication and safe action are not synonymous.

3. Bind Identity to Physical Authority

Every human and non-human actor capable of influencing the physical environment needs an attributable identity, constrained authority, and accountable owner. We have to do better than the OT protocols of the past where no identity was bound to commands and changes flowing via network communications.

Organizations must know who or what caused every consequential action.

They also need to continuously evaluate whether that identity remains trustworthy.

4. Model the Blast Radius Before Granting Autonomy

Before giving an AI system authority to act, determine what happens if it makes the wrong decision. This requires proper testing, consideration of edge cases, and careful attention to the design and enforcement of boundaries.

Ask how far one incorrect action can propagate through interconnected machines, systems, and physical processes.

Then constrain autonomy accordingly.

The greater the physical consequence, the smaller the acceptable gap between authority and accountability.

5. Use Simulation as a Security Tool

Digital twins and simulated environments should do more than optimize operations or train models.

Security teams can use them to test adversarial scenarios, evaluate “what-if” conditions, attempt to predict attack paths, and observe potential physical consequences without endangering production environments.

However, teams must also secure the simulation itself.

If the digital twin becomes an input into training, planning, or decision-making, poisoned simulation data can eventually influence downstream real-world behavior.

6. Design for Safe Failure

Every physical AI system needs an independently enforceable path to a safe state.

Security teams should be able to dynamically revoke authority, isolate compromised components, reject untrusted data, switch to manual control, and stop physical action.

Most importantly, do not assume that the AI responsible for normal operation should also control its own emergency containment.

Leadership needs to Understand the Physical AI Transition

Boards and executive teams do not need to become experts in AI technologies or the designing of world-class architectures.

However, they do need to understand what happens when AI crosses the boundary between recommendation and action as that can have a direct impact on business operations.

Here are a few questions leadership should start asking:

  • Where can AI already influence physical processes in our organization?
  • Which AI systems can issue commands that trigger physical action?
  • Which data sources clearly define their understanding of physical state?
  • Can we establish the integrity and provenance of that data?
  • Can data manipulation create unsafe environments?
  • Which human and machine identities possess authority over systems that have physical capabilities?
  • Have we tested how the systems respond to intentionally manipulated environments?
  • What physical consequences could follow an incorrect decision?
  • Can we quickly force the environment into a safe state when trust disappears?

These are not robotics questions.

They are enterprise-risk and governance questions.

We Have Seen Part of This Future Before

World models and physical AI introduce powerful new technology.

Yet one of their central security problems brings me directly back to the OT environments we worked to protect at Bayshore Networks.

In 2020, I argued that protecting industrial environments required us to understand more than who communicated with whom.

We had to understand the actual values moving through industrial protocols.

Then we had to understand what would happen in the physical world when a PLC, controller, drive, or other system acted upon those values.

That progression was:

Data → Context → Command → Physical Consequence

World models extend that to:

Data → Perceived Reality → Predicted Future → Decision → Physical Consequence

That additional intelligence does not eliminate the old security problem.

It magnifies it.

World models will increasingly use huge volumes of data to construct representations of reality, predict future states, and select actions.

Therefore, cybersecurity must protect much more than the model.

We must protect the integrity of the world the model believes it inhabits.

That requires trusted data, attributable identities, semantic understanding, adversarial testing, state awareness, predictive security, and tight control over physical authority.

The GenAI era taught organizations that machines can create.

The agentic AI era is teaching us that machines can act.

World models and physical AI will force us to confront the next question:

What happens when machines can understand enough of the physical world to predict it, and possess enough authority to change it?

Cybersecurity leaders should start considering that question now.

Because AI is entering the physical world.

And once cyber risk becomes physical risk, we no longer get to treat a corrupted view of reality as merely a bad AI output.

AI Is Entering the Physical World: Cybersecurity Must Change Now

AI Is Entering the Physical World: Cybersecurity Must Change Now
Image generated by ChatGPT, 2026

Part 1 of “AI Is entering the physical world”

For the last several years, most organizations have experienced Artificial Intelligence through a screen. Come to think of it, so have many of the recently self-appointed AI experts. I consider most of these people users, not experts. Things are changing on levels these folks are not prepared for. AI Is entering the physical world. Why cybersecurity must change now.

Typical “AI” usage at the moment equates to Generative AI (GenAI). This means someone types a prompt and an engine generates content. The engine can write code, analyze a document, create an image, summarize data, or recommend an action.

That model of AI is already changing.

The next major evolution will push AI beyond understanding language and digital information. AI systems will increasingly model environments, predict how those environments may change, reason about physical objects, and take actions in the real world.

World models, embodied AI, robotics, autonomous systems, digital twins, and increasingly capable agentic ecosystems are moving us in that direction.

Consequently, cybersecurity leaders need to understand that this transition changes the security problem dramatically.

Potential Physical Impact

When AI exists primarily inside a digital environment, a bad decision may generate incorrect information, expose data, execute malicious code, or compromise a business process.

When AI can perceive and act upon the physical world, a bad decision can move a machine.

It can alter a manufacturing process or the behavior of a robot. It can influence an autonomous vehicle or manipulate an industrial control process.

Ultimately, it can create physical consequences.

That is why cybersecurity must change. Now.

Traditional cybersecurity primarily protects systems, identities, networks, applications, and information. Physical AI adds something fundamentally different. In most cases, foreign. Cybersecurity must now protect an AI system’s perception of physical reality, the data used to construct that reality, the authority to act upon it, and the resulting physical state.

An attacker may no longer need to compromise the AI model itself.

Manipulating the world the model sees may be enough.

That shifts cybersecurity beyond protecting systems and information. We must increasingly protect state, perception, prediction, authority, and physical consequence.

Physical AI changes cybersecurity because we must protect not only the AI, but the integrity of the world the AI believes it inhabits.

World Models Change What AI Understands

Large Language Models (LLMs) became powerful by learning relationships across enormous amounts of data.

World models pursue a different capability.

At a high level, a world model develops a representation of an environment and uses that representation to reason about how the environment may change over time.

Instead of merely asking, “What should come next in this sequence?” as LLMs do, world model based systems begins answering questions such as:

  • What exists in this environment?
  • How are these objects related?
  • What state are they currently in?
  • What happens if something moves or changes?
  • What will the environment probably look like next?
  • How will my actions affect this environment?
  • What action is necessary to reach a desired state?

This capability matters enormously for robotics and autonomous systems.

For example, a robot operating in a warehouse cannot simply identify a forklift. It needs to understand where the forklift is, is it currently being operated, how quickly it is moving, where it will probably go next, and what obstacles surround it.

Likewise, an industrial AI system cannot simply recognize that a valve exists. It may need to understand the valve’s current state, its relationship to pressure elsewhere in the process, what normally happens after the valve changes state, and which physical consequences could follow.

In other words, the AI must build and continuously update a representation of reality.

That representation becomes extraordinarily valuable.

It also becomes an extraordinarily attractive target.

Why Cybersecurity Must Change When AI Becomes Physical

Cybersecurity traditionally focuses on protecting identities, systems, applications, networks, APIs, and data.

Physical AI forces us to extend that thinking.

We now have to protect the system’s understanding of reality.

If an attacker manipulates the information an AI system uses to construct that reality, the attacker may never need to compromise the model itself. That is a dynamic the security industry has yet to contend with.

Consider an autonomous system that continuously processes sensor readings, environmental conditions, machine states, visual information, historical behavior, operator commands, and other telemetry.

The AI uses those inputs to determine what exists, what is happening, what will probably happen next, and what action it should take.

Now change one of those inputs.

Then change several.

Make the changes subtle enough that no individual result looks catastrophic.

An attacker can gradually create a false version of reality inside that target system. If the approach is slow and low the end result can be rather complex.

Along that journey, AI systems could make completely rational decisions based on completely corrupted context.

The model did not necessarily fail.

Its understanding of the world failed.

That distinction will become one of the defining problems in physical AI security.

I Wrote About This Problem Before World Models Entered the Conversation

This problem feels new to many because technology has changed and those people have likely not dealt with these types of environments.

But, to some of us the underlying security principle is not new at all.

In January 2020, while I was one of the original members and CTO at Bayshore Networks, I published an article in Network Security titled “Operational Technology Security – A Data Perspective.” (https://www.sciencedirect.com/science/article/abs/pii/S1353485820300088)

The central argument was straightforward: OT cybersecurity was concentrating too heavily on network-level visibility while overlooking something far more consequential – the actual values inside the data.

Knowing the following mattered:

  • That one IP address communicated with another.
  • Which network protocol was used.
  • That a particular workstation communicated with a Programmable Logic Controller (PLC).

However, none of those facts necessarily told us what happened to the physical process.

For that, we had to understand the data itself. We needed to understand the command, the register, the setpoint value.

Most importantly, we needed to understand what changing certain values would mean in the physical domain.

That was the data-centric security problem in OT. To an extent that is still a problem today.

An attacker did not necessarily need to break the network connection. The connection could remain completely legitimate.

An authenticated engineering workstation could communicate with an approved controller over an expected industrial protocol.

Yet if the attacker changed the right value inside that legitimate communication, the physical result could become dangerous.

In OT, the packet can be legitimate while the value inside it is hostile.

That concept drove much of the thinking behind the technology we built at Bayshore Networks.

We pushed inspection beyond basic network metadata and deeper into industrial protocols, transactions, commands, and values. We wanted security controls to understand what the industrial communication meant, not simply observe that the communication occurred.

Why?

Because data was not simply information.

Data could become physical action.

World Models Extend the Data-Centric OT Problem

This is where my earlier OT work and today’s world-model discussion converge.

The problem I described in 2020 focused on protecting data values because industrial systems could act upon those values with potential physical impact.

World models take that concept significantly further.

A physical AI system does not simply receive a single value and execute a command. Increasingly, it will consume enormous amounts of data to construct an internal representation of its environment.

It will correlate inputs, infer relationships, estimate current state, and predict future state.

Then it may select an action based on that representation.

Therefore, take the old OT question: what does this data value mean to the physical process? This now becomes an even more consequential AI security question: what reality is this data causing the AI to believe?

That is the intellectual bridge between data-centric OT security and physical AI security.

In the OT environments we protected years ago, manipulating a register or setpoint could change a physical process.

In a world-model-driven environment, manipulating enough trusted data could change the AI’s model of the entire process.

At that point AI itself may determine which action should follow.

This gives the adversary an entirely new level of leverage.

Data Becomes Part of the Physical Control Surface

Security leaders need to stop thinking about data solely as something they must prevent attackers from stealing.

In physical AI environments, adversaries may gain more value by changing data than by stealing it.

Consider the information that could feed a physical AI system:

  • Camera and video streams.
  • Temperature and pressure measurements.
  • Location and proximity data.
  • Motor position and velocity.
  • Machine state.
  • Human presence and movement.
  • Production telemetry.
  • Historical operating patterns.
  • Digital-twin state.
  • Maintenance information.
  • Identity and authorization context.
  • Commands from machines or other AI agents.

If some AI technology uses those inputs to determine current state, predict future states, and choose actions, the integrity of those data points becomes part of the physical control surface.

As a result, security teams must ask something much more sophisticated than:

Can this system access the sensor?

They must ask:

Should the system trust what that sensor is telling it right now?

That requires context. As such, questions such as these become very relevant:

  • Is this the expected device?
  • Has the configuration been modified?
  • Does value X make sense within the current operating state?
  • Did an authorized identity make some change?
  • Does the sequence of events match expected process behavior?
  • Could the data be syntactically valid but operationally impossible?

This is precisely where the lessons from my OT past become invaluable.

Seeing the communication is not enough.

Understanding the data is not enough.

Security must understand the data in the context of the physical process, and now in the context of some AI’s evolving model of that process.

A Hostile World Does Not Require a Compromised Model

Much of the current AI security conversation concentrates on attacking models.

We discuss prompt injection, jailbreaks, model theft, adversarial inputs, training-data poisoning, and manipulated outputs.

Obviously, those threats remain important.

However, physical AI creates another powerful adversarial strategy:

Do not attack the intelligence. Attack the world that the intelligence sees.

An adversary could target:

  • Perception – change what sensors, cameras, or other inputs report.
  • State – alter the data describing the current condition of a machine or environment.
  • History – corrupt the historical context the system uses to recognize normal behavior.
  • Identity – impersonate a trusted operator, sensor, machine, or workload.
  • Relationships – manipulate the system’s understanding of how physical entities depend upon one another.
  • Prediction – distort enough contextual information to influence the system’s expected future state.
  • Action – abuse the mechanism that translates AI decisions into physical commands.

This attack model should concern cybersecurity leaders because the attacker can work around the intelligence rather than directly against it.

Imagine an AI system correctly concluding:

Given everything I currently know about this environment, action X represents the safest response.

Now imagine that an adversary manipulated what the system knows.

The reasoning may remain sound, but the action can still become dangerous.

See part 2 of this write-up here.

AI Is Undeniably Weaponized Now. The Human Is the Adversary.

AI Is Undeniably Weaponized Now. The Human Is the Adversary.

Artificial Intelligence (AI) is undeniably weaponized now. But the human is still the adversary. AI changes the speed, scale, sophistication, and autonomy of cyberattacks, while in most AI-enabled attacks a human still defines the objective, determines the desired outcome, directs or delegates activity to the technology, and benefits from success.

AI has changed cybersecurity at extraordinary speed. Attackers now use AI as both a force multiplier and a capability multiplier. They can accelerate reconnaissance, generate and refine malware, build highly targeted phishing campaigns, impersonate executives, analyze enormous volumes of stolen data, discover relationships between data points, identify exploitable weaknesses, and increasingly execute sequences of actions through autonomous agents.

Yet those capabilities do not eliminate the human element. AI may execute the action. An agent may navigate the application. A model may create the campaign material. But behind most malicious AI activity, a human still defines the objective, decides what outcome matters, and benefits when the operation succeeds. Last I checked there wasn’t some AI technology cashing out some Bitcoin from a ransom and partying on a yacht.

Consequently, understanding The Adversarial Mindset matters more today than in the past.

Does AI Eliminate Human Intent From Cyberattacks?

No, AI does not eliminate human intent from cyberattacks. It can dramatically change how an attack is executed while a human adversary still defines the objective the technology is pursuing.

Too often, it feels like we talk about AI-powered attacks as though AI itself has suddenly become the adversary.

That framing can be misleading.

Consider the difference between traditional Generative AI (GenAI) and Agentic AI.

With traditional GenAI, the relationship remains relatively obvious. A human asks a model to do things such as identifying vulnerabilities, improving code, analyzing data, translating messages, performing research, or solving some other element of an operation.

The system provides the power. The human provides the objective.

Agentic AI creates more distance between those two elements.

Instead of asking AI to perform one task, a human can increasingly define an objective and allow an agent to determine how to accomplish it. The agent can browse websites, invoke tools, query data, make decisions, evaluate responses, select subsequent actions, and continue working toward a defined goal.

In other words, the human moves farther away from each individual action.

However, distance from execution does not automatically remove intent.

That distinction matters enormously for cybersecurity.

An attacker does not need to personally enumerate every endpoint, craft every request, write every line of malicious code, or send every social-engineering message to remain the adversary behind an operation.

AI gives that nefarious actor both abstraction and leverage.

Agentic AI gives that same human a certain level of delegation.

Neither automatically removes the human from the equation.

Who Is Acting When an AI Agent Accesses a Computer?

When an AI agent accesses a computer on a user’s behalf, the human user can remain the party performing the access. In the Ninth Circuit’s August 2026 Perplexity decision, the court treated the AI assistant as a tool and the human user as the party accessing Amazon’s systems for purposes of the federal Computer Fraud and Abuse Act (CFAA).

The dispute involved Perplexity’s Comet browser and its AI Assistant. Users could direct the Assistant to perform tasks on Amazon.com. Amazon argued that Perplexity’s technology accessed Amazon’s systems without authorization and sought relief under the CFAA, and its California counterpart (the Comprehensive Computer Data Access and Fraud Act – CDAFA).

The Ninth Circuit rejected Amazon’s theory at the preliminary-injunction stage.

More importantly, the court focused on a remarkably significant question:

Who actually accesses the computer?

On the record before it, the court concluded that the AI Assistant functioned as a tool. The court described the Assistant as a “tool, not a person for statutory purposes.” It then concluded that the user accessed Amazon’s computers while using the Assistant to carry out specific actions.

The decision marks the first federal appellate ruling addressing whether AI agents acting on behalf of users can legally access online platforms.

That distinction carries enormous significance beyond this particular dispute.

The court did not treat the AI agent as an independent legal actor simply because it could perform actions on behalf of a user. Instead, it looked through the technology to determine who actually performed the access for purposes of the statute.

At the same time, something important surfaced by way of a limitation.

The Ninth Circuit DID NOT create a sweeping legal doctrine that makes humans universally responsible for everything an AI system does. In fact, the opinion expressly states that it does not establish a new legal regime for agentic AI. The court limited its holding to the CFAA and CDAFA “access” issue, the technology at issue, and the factual record before it. Different facts, different levels of control, different laws, or different AI architectures could produce different outcomes.

Nevertheless, from a cybersecurity perspective, a much broader lesson remains powerful: technology can sit between a human and some action without rendering the human irrelevant (or innocent by default).

Should Security Programs Defend Against AI or the Adversary?

Security programs should defend against the adversary, not AI in isolation. AI mechanisms such as prompt injection, model poisoning, tool abuse, and MCP attacks matter, but they do not explain who wants to attack you, why they are targeting you, or how they will adapt.

The industry has become obsessed with AI security. Both RSAC and BlackHat this year showcased that obsession with great fanfare.

To answer the questions of who, why, and how, you need to understand the adversary, not just the technology at hand.

For example, imagine two attackers with access to exactly the same AI model and exactly the same agentic capabilities.

One is a teenager experimenting, testing boundaries.

The other operates inside an organized cybercriminal enterprise with millions of stolen identities, infostealer logs, credential collections, years of operational experience, and a clear understanding of how to monetize access.

The AI may be identical.

The threat is not.

The adversary behind the technology creates that difference.

Should Analysts and Frameworks Define a Security Program?

No, analysts and frameworks should not define a security program or its security strategy. They can inform both, but market intelligence about technologies, vendors, categories, and industry trends is not the same as understanding the adversary targeting your organization.

An industry analyst publishes some analysis. Vendors push categories. A maturity model emerges. Boards ask where the company sits relative to peers. CISOs then purchase technologies to fill perceived gaps. Eventually, the organization builds an architecture that looks remarkably similar to the architectures of dozens of other companies that consumed the same analyst research. And along the way end up with tons of tools whose true capabilities are not fully utilized.

To be clear, industry analysts provide value.

They can deliver market intelligence, technology comparisons, vendor analysis, spending benchmarks, maturity models, and useful observations about where the industry is heading.

However, organizations make a serious mistake when they use analyst research as the foundation of a security program.

Market intelligence is not adversary intelligence.

An analyst may understand the cybersecurity industry exceptionally well while possessing little firsthand understanding of the people trying to defeat your security program.

They may understand industry sectors, products, categories, vendors, differentiators and even what other CISOs are spending on.

Yet none of those things necessarily means they understand how a real adversary thinks.

More importantly, an adversary does not care whether your program aligns with an analyst’s reference architecture.

The adversary cares whether your defenses prevent the desired outcome.

Therefore, security leaders should never stop at this question:

What does the industry say a modern security program should contain?

They must also ask:

If I were a competent, cunning, determined attacker targeting this organization, how would I defeat what we have built?

What Blind Spot Do Many CISOs Have?

The blind spot many CISOs have is a limited understanding of the real adversaries their security programs are supposed to defeat. Managing risk, compliance, architecture, technology, and incident response is not the same as understanding how a determined adversary thinks, adapts, combines weaknesses, and pursues an objective.

I am not referring to understanding ethical hackers, penetration testers, or red-teamers. These professionals absolutely add value, but they ultimately operate within constraints established by rules of engagement.

I am talking about a real adversary with ill intent, whose motivations may be financial, ideological, geopolitical, personal, or simply opportunistic; and who feels no obligation to respect rules, scope, policy, business hours, budgets, architecture diagrams, or organizational boundaries.

That distinction matters.

A penetration tester typically asks whether something can be compromised within an agreed scope.

An adversary asks a very different question:

How do I achieve my objective despite everything this organization has done to stop me?

That question requires a fundamentally different way of thinking.

Why Should Defenders Start With the Human Behind the Machine?

Defenders should start with the human behind the machine because AI amplifies adversarial capability without automatically replacing adversarial intent. Less sophisticated attackers can now access capabilities that once required specialists, while sophisticated adversaries can operate faster, analyze more data, uncover hidden relationships, and adapt more efficiently.

As an example, consider that AI technologies create conditions in which enormous quantities of stolen identity data can be ingested and analyzed, revealing relationships humans would otherwise miss.

It can perform actions such as:

  • transforming OSINT into targeted and strategic intelligence
  • generating individualized social-engineering content based on attackable profiles across thousands of targets
  • creating strategic campaigns rapidly
  • refining malicious code
  • analyzing defensive responses and adaptively creating alternatives

But it does so at the request of some human element. Consequently, we should stop thinking only in terms of “AI attacks.” What we increasingly face are human adversaries with machine-scale leverage.

That represents a much more consequential problem.

How Does The Adversarial Mindset Change Security Strategy?

The Adversarial Mindset changes security strategy by making the adversary, not the framework, product, analyst, or compliance requirement, the starting point. Security leaders first ask what an adversary wants, what that adversary already knows, which assumptions and relationships can be exploited, and how the attacker will adapt when defenses interfere.

Ask questions like:

  • Who would want what we possess?
  • What exactly would they want?
  • What information about our people, systems, suppliers, executives, and customers do they already possibly have?
  • Which assumptions are we making that they would immediately challenge?
  • Where do identities, relationships, privileges, and trust create nefarious opportunities?
  • How could they combine several individually minor weaknesses into one viable attack path?
  • How would they adapt after encountering resistance to their techniques?
  • How could AI make each of those steps of adaptability cheaper, faster, or more precise?

At that point, you begin designing security from the adversary backward.

That is the essence of The Adversarial Mindset.

Moreover, this approach does not require organizations to abandon frameworks, compliance obligations, analyst research, or established security architectures. Those tools still serve important purposes.

However, they should support your security strategy rather than define it.

The adversary should help define it.

Why Does AI Make The Adversarial Mindset More Important?

AI makes The Adversarial Mindset more important because it gives human adversaries greater speed, scale, precision, leverage, and increasingly autonomous execution. Security teams therefore need to understand not only what AI can do, but what a motivated adversary can now accomplish because those capabilities exist.

The cybersecurity industry will inevitably spend enormous amounts of time debating how autonomous AI will become.

That discussion absolutely matters.

Eventually, increasingly autonomous systems may force us to confront genuinely difficult questions about intent, accountability, responsibility, control, and attribution.

However, that conversation leaves gaps. Organizations cannot afford to wait for those philosophical and legal questions to reach resolution. This is especially so for larger organizations that are not exactly agile.

Today, humans are discovering what AI can do for them.

Some of those humans are defenders, others are researchers, and still others are innovators.

Realistically, some are adversaries.

The last group does not care whether your AI strategy appears in an analyst report. They do not care which security technologies occupy a leader quadrant, or how mature your program looks against some industry benchmark.

They care whether they can accomplish their objective.

The Ninth Circuit’s Perplexity decision gives us an important legal manifestation of a broader technological reality: an intelligent tool can become increasingly capable while still operating in service of human direction.

Therefore, defenders should resist the temptation to focus exclusively on the technology.

That distinction changes the questions security leaders should be asking.

“What can AI do?”

This has to start migrating towards something like:

“What can an adversary now do because AI exists?”

Those are very different questions.

Ultimately, the second question is the one our security programs need to answer. AI is undeniably weaponized now. The human is the adversary.

Note: This article discusses the cybersecurity implications of Amazon.com Services, LLC v. Perplexity AI, Inc. and does not provide legal advice. The Ninth Circuit’s August 4, 2026 decision concerned a preliminary injunction and a specific interpretation of “access” under the CFAA and CDAFA based on the record before the court.

AI Powered Cybercrime – How AI Supercharged a Sextortion Wave

AI Powered Cybercrime - How AI Supercharged a Sextortion Wave

Part 3 of AI Powered Cybercrime

Sextortion isn’t new. Velocity has increased, personalization has sharpened, and attackers can now run campaigns at industrial scale. This wave is a collision event between the first two posts in this series: facilitation (credible intimidation) and scale (high-volume delivery). AI Powered Cybercrime – How AI Supercharged a Sextortion Wave.

Many security programs have an important blind spot: they treat coercion as a personal problem. In reality, coercion quickly becomes an enterprise problem when it pressures employees into silence, errors, or unsafe, unethical, illegal behavior.

What happened (high level)

Following the large-scale exposure of personal data from a data broker, threat actors began sending extortion emails that included real names, real email addresses, and real home addresses. The goal was not technical proof; it was psychological terrorism. When a recipient of these types of emails and/or files sees real personal details, the scam feels “more real,” even if the core claim is false.

Some variants escalated intimidation by including a photo of the victim’s home sourced from publicly available mapping imagery. That addition is a masterclass in facilitation: it takes something the attacker can generate cheaply and turns it into a credibility anchor that increases stress and compresses decision time.

Why it works: plausibility beats truth under pressure

Most victims don’t evaluate these messages like analysts. They evaluate them like humans under threat, with emotion. The campaign design is built around that reality: shock, shame, urgency, and a narrow window to “fix” the situation. The scam doesn’t need to be technically accurate to be operationally effective; it only needs to feel plausible long enough to trigger payment.

This is the same vibe hacking dynamic we see in enterprise fraud: urgency is used as a control bypass. When the attacker can manufacture plausibility quickly, policy and verification become the only reliable defenses.

Where AI fits (without fluff)

AI does not need to run the entire scheme to increase harm. It only needs to improve the leverage points. First, it enables endless text variation while maintaining a consistent tone and similar messaging. Second, it makes personalization easy by merging templates with leaked data and also seamlessly integrating with Open Source Intelligence (OSINT) sources. Third, it reduces the human effort required to run a campaign, which increases throughput.

The result isn’t “smarter extortion.” It’s cheaper extortion at higher volume paired with sharper intimidation artifacts. That combination is what makes waves like this so disruptive.

Why CISOs should care: coercion becomes a business threat

Even when a victim is targeted “personally,” the downstream effects can land inside a CISOs organization. An employee under threat may avoid reporting, reuse credentials poorly, or comply with nefarious demands. Panic and stress can lead to unsafe behaviors, and this noise can weave its way into an organization distracting security teams from secondary attacks that aim to exploit some of that chaos.

If a resilience program covers ransomware but not coercion-driven fraud and extortion, there could be an operational gap. Sextortion waves are a reminder that the adversary’s true target is often decision-making under pressure.

What organizations should do during a wave

The objective in a wave is speed, clarity, and support. Issue a same-day bulletin that states what is happening, what employees should do, and how to report. Keep it stigma-free. The most important message is this: employees can report safely, and they won’t get in trouble.

Next, harden the identity bridge. Ensure MFA is enforced for email and sensitive applications, watch for anomalous sign-ins, and monitor for new device enrollments. Then improve detection quality by treating this as a campaign: pattern match across inboxes and route messaging to a single owner to reduce confusion and duplicate work.

The resilience lesson

Waves like this are not just security events; they’re leadership events. The organizations that respond well reduce harm by moving fast, communicating clearly, and providing support. They also learn: which workflows were stress-tested, where employees hesitated, and what verification gates were missing.

If you treat coercion as out-of-scope, you will eventually treat it as an incident, under pressure. Build the playbook now.

Key takeaways

  • Normalize coercion reporting; activate employee assistance programs immediately to protect people and organizational reputation.
  • Instrument wave messaging detection to tune signals and reduce both data fatigue and operational distraction.
  • Harden identity ecosystems fast; enforce MFA immediately to prevent panic-driven account takeover actions.
  • Operationalize extortion playbooks and drill them regularly to reduce chaos and decision latency.

AI Powered Cybercrime – Scale: From One-off attacks to broad campaigns

AI Powered Cybercrime - Scale: From One-off attacks to broad campaigns

Part 2 of AI Powered Cybercrime

Once AI facilitates and reduces the skill barrier, the next step is predictable: industrialization. Scale is not simply “more X.” It’s more volume, experiments, parallel campaigns, faster iteration, and lower cost per attempt. Attackers can tolerate failure because machines keeps trying, and keeps learning. AI Powered Cybercrime – Scale.

In practice, scale changes how you risk is experienced. The question stops being “can this attack be blocked?” and becomes “can we withstand continuous throughput without fatigue, mistakes, or control bypass?” If the attacker runs campaigns like a high-volume system, defenders must design controls that behave like high-volume systems too.

Scale is attack throughput based on more attempts, more variation, and faster learning loops than human teams can match.

How scale happens

Cybercrime at scale is a stack: commodity infrastructure to deliver, automation to orchestrate, and AI to generate convincing content and decision support. That stack allows adversaries to operate like entire sophisticated teams, testing, measuring response rates, iterating on what works, and abandoning what doesn’t.

This matters because “good enough” at massive volume beats “excellent” at low volume. Even if your controls catch 99.9% of attempts, at enough throughput the remaining 0.1% becomes a real business problem.

Agentic workflows: campaigns become orchestrated systems

The most important mental model for scale is orchestration. Instead of one attacker manually working a process, you face workflows that plan tasks, execute in parallel, and adapt based on outcomes. Target research, lure writing, follow-ups, and handoffs can be partially automated, even when a human remains in the loop for high-value steps.

For defenders, this means control gaps are discovered faster, exploited more accurately, and reused more reliably. If your organization has exception-heavy processes (e.g., ad hoc approvals, inconsistent vendor change procedures, unclear escalation paths) those become discoverable cracks that an attacker’s system can exploit repeatedly.

Dark social distribution: coordination at platform speed

Distribution and coordination channels accelerate scale by enabling rapid churn: new templates, new lists, new scripts, and fast feedback loops from peers. The operational consequence is that takedowns and blocks often trail behind the adaptation cycle. If you rely solely on external enforcement or on the hope that a campaign will “fade out,” you will lose the timing battle.

This is why brand and executive impersonation monitoring matters. When attackers can quickly align a pretext with what’s visible about your leadership, partners, or vendors, they can now manufacture credibility in hours.

DDoS and distraction: availability pressure as a cover layer

At scale, disruption is often a tactic, not an outcome. Availability pressure can consume attention, create noise, and induce rushed decisions that enable secondary goals (e.g., fraud, credential abuse, or data theft). The attacker doesn’t need to “win” the DDoS battle; they need to win the operational tempo battle.

The resilience countermeasure is degraded-mode planning. If you pre-stage how the business continues when systems are strained (e.g., what gets paused, what gets routed differently, who approves exceptions) you reduce the attacker’s ability to force mistakes through urgency.

A/B testing on humans: volume plus variation

A subtle but powerful aspect of scale is experimentation. Attackers don’t need a perfect lure. They need a pipeline that generates variants, tests them across segments, measures responses, and doubles down on what works. AI makes this cheap: the cost of a new variant approaches zero.

This turns awareness training into an operational control problem. You’re no longer defending against one “phishing style.” You’re defending against a continuously mutating persuasion engine. The stable defense is workflow integrity, consistent rules for high-risk actions, enforced regardless of how convincing the request appears.

What to do: control throughput with identity and workflow gates

To survive scale, design defenses like you’re protecting a high-traffic API. The objective is not perfect prevention; it’s making irreversible actions rare, gated, and verifiable. Start with the workflows that move money, grant access, or export sensitive data.

Phishing-resistant MFA and risk-based session controls reduce account takeover success. Dual control and out-of-band verification reduce fraud success. Campaign-level detection reduces fatigue by catching patterns across many inboxes or users rather than treating each event as a one-off.

Board-level framing

Scale bends the loss curve upward even if individual success rates decline. Boards should ask a small set of questions that map directly to business continuity: Which workflows are irreversible? Which are gated? How fast can we verify? How quickly can we contain identity-driven compromise?

If you can answer those questions with metrics (e.g., time-to-verify, exception rates, time-to-contain) you can translate a complex threat into operational readiness and financial risk reduction.

Key takeaways

  • Assume nonstop attack throughput to model monthly, reduce fraud and downtime exposure.
  • Harden approval workflows; the goal is to enforce dual control always while preventing irreversible payment loss.
  • Automate identity containment by tuning regularly to cut attacker dwell time and blast radius.
  • Instrument dark social risk; that goal is to monitor weekly to reduce brand-driven compromise and extortion.
  • Govern exceptions tightly by reviewing regularly to prevent blind-spot failures and audit fallout.

Part 3 of AI Powered Cybercrime

AI Powered Cybercrime – Facilitation: How AI lowers the skill barrier for attackers

AI Powered Cybercrime - Facilitation: How AI lowers the skill barrier for attackers

Part 1 of AI Powered Cybercrime

Cybercrime has historically had a skills bottleneck. Someone had to do the research, craft a believable story, write the lure, build the tooling, and then keep the victim engaged long enough for an outcome. Even for seasoned operators, that work takes time, and time is money. AI Powered Cybercrime – Facilitation.

Generative AI has changed the economics of that effort. It acts like a quality assistant that can draft, rephrase, personalize, and refine at machine speed. The net effect is not simply “smarter attackers.” It’s more adversaries that historically could not operate in this space. It is also a set of adversaries that can now perform at a higher baseline, scale larger, with fewer mistakes and more believable artifacts.

In this series, I use “facilitation” to describe the first-order impact of AI on cybercrime: removing friction across the attack lifecycle so that an individual attack becomes easier to execute, easier to adapt, and more likely to succeed.

Facilitation is where AI makes individual attacks better by lowering the skill barrier and improving content and/or persuasion quality.

The Facilitation Lens

A useful way to think about AI-enabled crime is as a pipeline. Attackers rarely win because they have one magic tool; they win because they can move smoothly from one stage to the next, recon, pretext, access, execution, and monetization. AI can assist at every stage, and it doesn’t need to be perfect. It only needs to be good enough to keep the process flowing through its journey.

For defenders, this creates a trap: many programs still focus on blocking discrete artifacts (one phishing email, one payload hash, one suspicious domain). Facilitation shifts advantage to the attacker because artifacts can be generated rapidly and with great volume; but the human processes and identity controls on the defensive side often remain static.

AI-powered malware: from coding to assembling outcomes

“AI malware” may inspire unrealistic notions of a fully autonomous super-virus. The more realistic, and more dangerous, reality is simpler: AI compresses development and iteration cycles. Instead of writing everything from scratch, adversaries can draft components, refactor quickly, generate variants, and troubleshoot faster. That matters because it reduces the time between idea and execution. It also empowers people that would not be operating in cybercrime without AI capabilities.

For defenders, the implication is that static signatures and one-off IOCs degrade faster. The same intent can show up as many slightly different implementations, and the “shape” of attacks changes just enough to evade brittle detection logic.

What can be done about this? Shift emphasis toward behavior and context. Instead of some static defense model we need to become more adaptable. If some payload dynamically changes, attackers will likely still need access to credentials, session tokens, the creation of persistence, or the exfiltration of data. Those are the slivers of opportunity where defenders have a chance of stable detection and containment. Given todays dynamic, the best place to shrink an attacker’s options is identity: the stronger and more tightly governed the identity boundary, the fewer places malicious tooling can successfully land.

Deepfakes: visual presence is no longer identity

Deepfakes move social engineering from “message deception” to “presence deception.” It’s one thing to spoof a sender name; it’s another to appear on a call as someone your team recognizes. That’s why deepfake-enabled fraud is so consequential: it attacks the human verification shortcuts we’ve relied on for decades, voice, face, and confidence.

The operational lesson is straightforward: “I saw them on video” is no longer a control. Nor is it a point of trust. A convincing presence can be manufactured, and group dynamics can be exploited to create social proof. The only reliable protection is to place high-risk actions behind verification steps that synthetic media cannot satisfy, out-of-band callbacks to known numbers, dual control for sensitive payments, and defined escalation rituals when urgency appears.

Social engineering: AI adds memory, consistency, and coordination

The biggest upgrade AI brings to social engineering is not grammar, it’s continuity. AI can maintain context over time, keep a persona consistent across messages and disparate systems, and pivot smoothly when a target makes adjustments. That capability turns many “one-and-done” lures into persistent conversations that wear down defenses.

This is why awareness training that focuses on typos and awkward phrasing is losing relevance. The tell is increasingly a process violation: a new payment path, a new channel, a sudden bypass of normal approvals, or an exception request that tries to compress decision time. If your employees know how to spot workflow bypass, they can defeat even polished, highly personalized lures.

Vibe hacking: weaponizing emotion to bypass analysis

Vibe hacking is the weaponization of emotion as a control bypass. Attackers don’t need you to believe every detail; they need you to act before you verify. Shame, urgency, fear, status, and belonging are some of the levers that move decisions faster than policy comes into play.

The countermeasure is not “tell people to be calm.” The countermeasure is building organizational escape hatches: clear permission to slow down, explicit escalation paths, and operational friction for irreversible actions. If urgency is treated as a trigger for verification, not a reason to move faster, we can turn the attacker’s primary advantage into a liability.

Short term reset

If you want one practical takeaway from facilitation, it’s this: identity and workflow integrity are choke points. AI can generate unlimited persuasion and/or manipulation artifacts, but we have to force it to cross an authorization boundary somewhere.

Start by identifying the three most irreversible workflows in your organization, for example pick from a pool like this one: payments, vendor banking changes, payroll updates, privileged access grants, or large data exports. Then ensure those workflows have step-up verification that cannot be satisfied by sense of urgency, polished messaging, or synthetic media. Finally, run a short blind red-team exercise on a deepfake or coercion scenario and measure how long it takes the organization to verify and contain. Blind = this must mimic reality.

Key takeaways

  • Assume high-quality lures and retrain owners monthly to reduce fraud loss and downtime.
  • Gate privileged actions and enforce out-of-band checks always; the goal is to prevent unauthorized transactions.
  • Detect behavior shifts and tune telemetry regularly to cut dwell time and response costs.
  • Standardize escalation and drill managers quarterly; the goal is to reduce coercion-driven errors.
  • Institutionalize dissent and review exceptions monthly to avoid governance blind spots and audit fallout.

Part 2 of AI Powered Cybercrime

Decentralized Agentic AI: Understanding Agent Communication and Security

Decentralized Agentic AI: understanding agent communication. In the agentic space of Artificial Intelligence (AI) much recent development has taken place with folks building agents. The value of well built and/or purpose built agents can be immense. These are generally autonomous stand-alone pieces of software that can perform a multitude of functions. This is powerful stuff. It is even more power when one considers decentralized Agentic AI: understanding agent communication and security.

An Application Security (AppSec) parallel I consider when looking at some of these is the use of a single dedicated HTTP client that performs specific attacks, for instance the Slowloris attack.

For those who don’t know, the slowloris attack is a type of Denial of Service (DoS) attack that targets web servers by sending incomplete HTTP requests. Each connection is kept alive by periodically sending small bits of data. In doing so this attack keeps many connections open and holds them open as long as possible, exhausting resources on that web server because it has allocated resources to the connection and waits for the request to complete.. This is a powerful attack, one that is a good fit for a stand-alone agent.

But, consider the exponential power of having a fleet of agents simultaneously performing a Slowloris attack. The point of resource exhaustion on the target can be achieved in a much quicker timeline. This pushes the agentic model into a decentralized one that will need to allow for communication across all of the agents in a fleet. This collaborative approach can facilitate advanced capabilities like dynamically reacting to protective changes with the target. The focal point here is how agents communicate effectively and securely to coordinate actions and share knowledge. This is what will allow a fleet of agents to adapt dynamically to changes in a given environment.

How AI Agents Communicate

AI agents in decentralized systems typically employ Peer-to-Peer (P2P) communication methods. Common techniques include:

  • Swarm intelligence communication – inspired by biological systems (e.g. ants or bees), agents communicate through indirect methods like pheromone trails (ants lay down pheromones and other ants follow these trails) or shared states stored in distributed ledgers. This enables dynamic self-organization and emergent behavior.
  • Direct message passing – agents exchange messages directly through established communication channels. Messages may contain commands, data updates, or task statuses.
  • Broadcasting and multicasting – agents disseminate information broadly or to selected groups. Broadcasting is useful for global updates, while multicasting targets a subset of agents based on network segments, roles or geographic proximity.
  • Publish/Subscribe (Pub/Sub) – agents publish messages to specific topics, and interested agents subscribe to receive updates relevant to their interests or roles. This allows strategic and efficient filtering and targeted communication.

Communication Protocols and Standards

Generally speaking, to make disparate agents understand each other they have to speak the same language. To standardize and optimize communications, decentralized AI agents often leverage:

  • Agent Communication Language (ACL) – formal languages, such as the Foundation for Intelligent Physical Agents (FIPA) ACL, standardize message formats and by doing so enhance interoperability. These types of ACLs enable agents to exchange messages beyond simple data transfers. FIPA ACL specifications can be found here: http://www.fipa.org/repository/aclreps.php3, and a great introduction can be found here: https://smythos.com/developers/agent-development/fipa-agent-communication-language/
  • MQTT, AMQP, and ZeroMQ – these lightweight messaging protocols ensure efficient, scalable communication with minimal overhead.
  • Blockchain and Distributed Ledgers – distributed ledgers provide immutable, secure shared states enabling trustworthy decentralized consensus among agents.

Security in Agent-to-Agent Communication

Security in these decentralized models remains paramount. This is especially so when agents operate autonomously but communicate in order to impact functionality and/or direction.

Risks and Threats

  • Spoofing attacks – malicious entities mimic legitimate agents to disseminate false information or impact functionality in some unintended manner.
  • Man-in-the-Middle (MitM) attacks – intermediaries intercept and alter communications between agents. Countermeasures include the use of Mutual Transport Layer Security (mTLS), possibly combined with Perfect Forward Secrecy (PFS) for ephemeral key exchanges.
  • Sybil attacks – attackers create numerous fake entities to skew consensus across environments where that matters. This is particularly dangerous in systems relying on peer validation or swarm consensus. A notable real-world example is the Sybil attack on the Tor network, where malicious nodes impersonated numerous relays to deanonymize users (https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/winter). In decentralized AI, such attacks can lead to disinformation propagation, consensus manipulation, and compromised decision-making. Countermeasures include identity verification via Proof-of-Work or Proof-of-Stake systems and trust scoring mechanisms.

Securing Communication with Swarm Algorithms

Swarm algorithms pose unique challenges from a security perspective. This area is a great opportunity to showcase how security can add business value. Ensuring a safe functional ecosystem for decentralized agents is a prime example of security enabling a business. Key security practices include:

  • Cryptographic techniques – encryption, digital signatures, and secure key exchanges authenticate agents and protect message integrity.
  • Consensus protocols – secure consensus algorithms (e.g. Byzantine Fault Tolerance, Proof-of-Stake, federated consensus) ensure resilient collective decision-making despite anomalous activity.
  • Redundancy and verification – agents verify received information through redundant checks and majority voting to mitigate disinformation and potential manipulation.
  • Reputation systems – trust mechanisms identify and isolate malicious agents through reputation scoring.

Swarm Technology in Action: Examples

  • Ant Colony Optimization (ACO) – in ACO, artificial agents mimic the foraging behavior of ants by laying down and following digital pheromone trails. These trails help agents converge on optimal paths towards solutions. Security can be enhanced by requiring digital signatures on the nodes that make up some path. This would ensure they originate from trusted agents. An example application is in network routing. Here secure ACO has been applied to dynamically reroute packets in response to network congestion or attacks (http://www.giannidicaro.com/antnet.html).
  • Particle Swarm Optimization (PSO) – inspired by flocking birds and schools of fish, PSO agents adjust their positions based on personal experience and the experiences of their neighbors. In secure PSO implementations, neighborhood communication is authenticated using Public-Key Infrastructure (PKI). In this model only trusted participants exchange data. PSO has also been successfully applied to Intrusion Detection Systems (IDS). In this context, multiple agents collaboratively optimize detection thresholds based on machine learning models. For instance, PSO can be used to tune neural networks in Wireless Sensor Network IDS ecosystems, demonstrating enhanced detection performance through agent cooperation (https://www.ijisae.org/index.php/IJISAE/article/view/4726).

Defensive Applications of Agentic AI

While a lot of focus is placed on offensive potential, decentralized agentic AI can also be a formidable defensive asset. Fleets of AI agents can be deployed to monitor networks, analyze anomalies, and collaboratively identify and isolate threats in real-time. Notable potential applications include:

  • Autonomous threat detection agents that monitor logs and traffic for indicators of compromise.
  • Adaptive honeypots that dynamically evolve their behavior based on attacker interaction.
  • Distributed patching agents that respond to zero-day threats by propagating fixes in as close to real time as possible.
  • Coordinated deception agents that generate synthetic attack surfaces to mislead adversaries.

Governance and Control of Autonomous Agents

Decentralized agents must be properly governed to prevent unintended behavior. Governance strategies include policy-based decision engines, audit trails for agent activity, and restricted operational boundaries to limit risk and/or damage. Explainable AI (XAI) principles (https://www.ibm.com/think/topics/explainable-ai) and observability frameworks also play a role in ensuring transparency and trust in autonomous actions.

Future Outlook

For cybersecurity leadership, the relevance of decentralized agentic AI lies in its potential to both defend and attack at scale. Just as attackers can weaponize fleets of autonomous agents for coordinated campaigns or reconnaissance, defenders can deploy agent networks for threat hunting, deception, and adaptive response. Understanding this paradigm is critical to preparing for the next evolution of machine-driven cyber warfare.

Decentralized agentic AI will increasingly integrate with mainstream platforms such as Kubernetes, edge computing infrastructure, and IoT ecosystems. The rise of regulatory scrutiny over autonomous systems will necessitate controls around agent explainability and ethical behavior. Large Language Models (LLMs) may also emerge as meta-agents that orchestrate fleets of smaller specialized agents, blending cognitive reasoning with tactical execution.

Conclusion

Decentralized agentic AI represents an ocean of opportunity via scalable, autonomous system design. Effective and secure communication between agents is foundational to their accuracy, robustness, adaptability, and resilience. By adopting strong cryptographic techniques, reputation mechanisms, and resilient consensus algorithms, these ecosystems can achieve secure, efficient collaboration, unlocking the full potential of decentralized AI. Decentralized Agentic AI: Understanding Agent Communication.

Why Decentralized Agentic AI is the Future of Cyber Warfare

Why Decentralized Agentic AI is the Future of Cyber Warfare

Agentic Artificial Intelligence (AI) (What Is Agentic AI?) is becoming a powerful force in cybersecurity and modern warfare. These AI systems consist of autonomous agents with minimal human oversight. They perceive, decide, and act independently to achieve specific goals. Both defenders and attackers now wield unprecedented digital power. These agents can write code, hunt threats, and execute complex operations. One analyst called agentic AI a “huge force multiplier” for cybersecurity teams (Agentic AI is both boon and bane for security pros). At the same time, attackers can use it to craft phishing lures and create advanced malware. This dual-use nature makes agentic AI a double-edged sword in cybersecurity.  That’s why decentralized agentic AI is the future of cyber warfare.

In the military domain, the consequences are even more severe. Cheap AI-powered drone swarms could threaten advanced weapons and shift the global balance of power. Decentralized, autonomous agents are transforming cyber and kinetic warfare. This emerging ecosystem evolves faster than we can control it. Experts predict attackers will exploit vulnerabilities in half the time it takes today.

What is Agentic AI?

Agentic AI refers to AI systems that can act as independent agents, pursuing goals through sequences of actions in a given environment. Traditional AI stops after output. These systems often consist of multiple specialized agents working together. Each agent might handle a subtask (e.g. monitoring logs, scanning for vulnerabilities, or controlling a drone). Together they orchestrate complex workflows to achieve an overall objective. In other words, agentic AI extends generative or analytical AI models by giving them a type of freedom. This latitude enables the capacity to make decisions and take actions without constant human prompts.

A key feature is that agentic AI can maintain long-term goals and react to real-time conditions. An agent might continuously monitor a web application’s state. It reasons about potential threats in real time. The agent can take actions like updating a Web Application Firewall (WAF) dynamically. Agents use reinforcement learning and planning algorithms to choose optimal responses. They often integrate Large Language Models (LLMs) for perception and reasoning. Other Machine Learning (ML) models may also support their decision-making. Agents are not static systems. They are designed to learn from experience and adapt over time. Agentic AI takes things further by coordinating groups of agents through custom integrations. This gives the agents greater contextual awareness and the ability to act in concert.

Varying agentic architectures exist. The design of the architecture must be tailored to the problem being solved. Some are hierarchical with a “conductor” agent overseeing multiple subordinate agents. This vertical design can be effective for linear workflows, but it introduces a single point of control that could become a bottleneck. Other architectures are more horizontal, with agents working as peers in a distributed fashion. In such a decentralized design, there is no single leader. Disparate agents collaborate or even compete, sharing information and dividing tasks among themselves. This latter approach is often slower to converge on a solution than a tightly managed hierarchy. But, it introduces major advantages in its ability to scale as well as its level of resilience and adaptability.

Decentralized Agents and Swarm Intelligence

Decentralization makes agentic AI very powerful because it removes the reliance on any central coordinator. Moreover, it enables swarm intelligence. Swarm intelligence draws inspiration from ant colonies and bee hives. It drives how simple agents follow rules and interact with each other (Military Drone Swarm Intelligence Explained). In a decentralized AI system, each agent makes decisions based on the combination of its own observations and signals from its peers. In this mode of operation there is no waiting for commands from a top-down, central controller. Each individual agent is not capable of anything earth shattering. But numerous agents working in unison can solve problems no single agent could handle alone.

Swarm AI

Swarm AI has been introduced into the cybersecurity space to leverage the swarm concept. It involves deploying autonomous agents across an ecosystem in a mesh formation, where each agent (or node) can process data and share relevant insights peer-to-peer (What is Swarm AI and How Can It Advance Cybersecurity?). A key benefit to this technology is the real-time collective learning and response. If one agent detects a threat, it can immediately broadcast that to its peers. This allows the entire swarm to adapt in almost real-time. This stands in contrast to traditional centralized systems that might suffer lag or single points of failure in communication.

Some of the advantages of decentralized swarms include:

  • No single point of failure – agents can act individually or collectively with no central server. This makes for a robust system. If one node fails, others quickly adjust and continue operations. The notion of self-healing becomes real and there is resilience to attacks or failure within swarms.
  • Scalability and coverage – a swarm can expand past the boundaries of traditional networks, with each agent handling local data. This scales naturally, with a swarm being able to dynamically add more agents to increase coverage and/or processing power.
  • Real-Time responsiveness – each agent reacts to local conditions relative to encountering them, without needing approval from a central brain. For example, a device-level agent can quarantine a malware outbreak on a single host, while simultaneously informing others to be on the alert.
  • Adaptability and learning – decentralized agents share observations to collectively refine their larger strategies. The swarm as a whole can continuously adapt and learn by distributing new knowledge to all swarm members. If one agent discovers a novel attack vector, all agents can update their detection models in concert.
  • Privacy and trust – by processing data locally agents can limit what gets shared with swarm peers. This decentralized approach can protect sensitive data better than centralizing all raw data. Developers use blockchain-based communication to let agents trust each other’s signals without revealing private data. A project called Naoris Protocol, for instance, employs a blockchain-backed swarm of cybersecurity agents to share threat intelligence across organizations securely in a decentralized mesh.

Cyber attacks often start from many points and spread across systems, like in botnets or Distributed Denial of Service (DDoS) attacks. Deploying a distributed defense matches this structure and makes strategic sense. Compounding the effectiveness factor, the lack of a central command makes a decentralized system harder to predict or defeat. Adversaries cannot simply “cut the head off the snake” as there is no head at all. This was illustrated in a U.S. Department of Defense (DoD) test where a swarm of 103 Perdix micro-drones was launched from fighter jets. The drones organized themselves via a swarm pattern, reforming their flight trajectories on the fly without any single drone leading (Meet the future weapon of mass destruction, the drone swarm). In essence, this is a parallel to a decentralized swarm that contributes to a collective intelligence that can outperform a monolithic AI agent on complex, enterprise level problems.

Defensive Applications of Decentralized Agentic AI

Decentralized agentic AI offers powerful new defensive capabilities in cybersecurity. Security teams can deploy swarms of intelligent agents to act as always-on, adaptive sensors operating at varying parts of a network. These autonomous defenders can monitor systems continuously, do so at different levels (e.g. endpoints, network, industrial devices, etc), detect threats faster than humans, and even coordinate automated responses across an enterprise. All of that can take place without requiring human direction.

Intrusion Detection

One interesting use case is real-time intrusion detection. But this model of operation can also include responses. Instead of a single security solution inspecting traffic, imagine a fleet of lightweight AI agents on every endpoint and subnet, all collaborating in close to real time. Each agent analyzes local events (e.g. network packets, login attempts, file changes, etc) and shares alerts or anomalies with the entire swarm. This makes possible a distributed Intrusion Detection System (IDS) where suspicious activity is detected and acted upon in seconds.

Swarm-based IDS agents can identify abnormal conditions and propagate relevant data to peers, who then collectively can decide on responses and/or countermeasures. For example, if one agent detects a brute force attack against an Application Programming Interface (API) header that grants access via a key. Peer agents could automatically adjust their Web Application Firewall (WAF) rules across disparate cloud hosting providers. All of that can take place faster than the traditional log shipping to a SIEM and subsequent analysis that typically is necessary.

Threat Hunting

Another area of interest is autonomous threat hunting. Agentic AI “hunters” can proactively sweep through logs, user behavior, and system telemetry 24/7 in search of hidden indicators or signals. These agents can also use ML to find patterns humans might miss across large volumes of data. Because they operate in parallel across the environment, they can cover a huge range of hypotheses quickly. If one agent uncovers a signal (e.g. unusual privilege escalation), it can enlist others to follow in pursuit and cover much ground in divide and conquer style.

This type of adaptive hunting has the potential to catch advanced threats that evade signature-based tools (Agentic AI: How It Works and 7 Real-World Use Cases). It also reduces fatigue on human analysts by filtering out false positives and handling routine tasks. In fact, autonomous agent platforms are surfacing that automate alert triage and Security Operations Center (SOC) routines that were once manual. This frees up human analysts to focus on confirmed alerts and/or incidents (Agentic AI and the Cyber Arms Race).

Incident Response

Crucially, decentralized defense agents can also coordinate active responses to incidents. These are more akin to real time countermeasures than the traditional incident response world of playbooks and system recovery. As an example, North Atlantic Treaty Organization (NATO) researchers have outlined an architecture for Autonomous Intelligent Cyber Defense Agents (AICA) (https://ccdcoe.org/uploads/2018/11/Towards_NATO_AICA.pdf). These would essentially be cyber hunter-killer agents deployed in military networks.

According to a NATO report, friendly cyber agents will work in swarms to detect cyber-attacks, devise countermeasures, and adapt their response. The vision is that these defensive swarms would stealthily patrol networks, find and fight nefarious activity in real-time without waiting for human instructions. NATO experts argue that only collective intelligence from swarms of agents would be effective against a sophisticated, coordinated cyberattack, especially in a military setting. Notably, the NATO study warns that “without active autonomous agents, a NATO C4ISR network will not survive an encounter with a determined, technically sophisticated enemy”.

Beyond theory, there is evidence of defensive agentic AI in practice:

  • Copilot agents – there have been demonstrations where agents autonomously talk to disparate security products (e.g. SIEM, endpoint, identity systems) to identify vulnerabilities and compromised assets in an enterprise environment (https://www.microsoft.com/en-us/security/blog/2025/03/24/microsoft-unveils-microsoft-security-copilot-agents-and-new-protections-for-ai/). Essentially, each agent is specialized (one might watch identity systems, another cloud configs, etc.) and the Copilot orchestrates their findings. This is an example of multiple agents coordinating to improve a defensive posture.
  • Autonomous penetration testing – running red team agents is a defensive tactic to find weaknesses before real adversaries do. Agentic AI can simulate realistic multi-stage attacks against an organization’s own systems continuously. Unlike human-led pen-tests that happen periodically, autonomous agents can hammer away at defenses continuously. By employing such agentic “attack” bots in a controlled way, defenders can expose weaknesses and harden their systems faster. This is decentralization at another level, instead of one small team of human red-teamers, one can have hundreds of relentless AI agents probing environments in parallel.
  • Security orchestration – Agentic AI is also improving how SOCs function internally. Agents can automate the handling of incidents and related steps (e.g. opening tickets, documenting steps, sending communications, etc). For instance, one agent detects a malware outbreak and isolates impacted hosts, then signals another agent to gather forensic data or notify admins. This kind of automation at scale means incidents get contained and resolved with minimal human delay.

Ultimately, decentralized agentic AI gives defenders the possibility of speed, scale, and adaptability that traditional tools simply cannot match. By distributing intelligent agents throughout networks and systems, living, intelligent, cooperative defensive mechanisms are possible. These mechanisms come with the promise of observability and action everywhere at once. Early results are promising, but defenders must also prepare for the flip side as attackers have access to the same technology.

Offensive Implications: Decentralized AI as a Threat

Unfortunately, the power of decentralized agentic AI makes it a double-edged sword. The same capabilities that benefit defenders can be harnessed by malicious actors to create more sophisticated and possibly even resilient cyber attacks. To an extent this is the beginning of the era where AI-driven threats operate in a decentralized, swarm-like manner and they will overwhelm traditional defense mechanisms.

Malware

One area of concern is that of swarm malware. This is essentially a network of AI-powered malicious agents that collaborate like a team of attackers, without a central command server (Swarm Malware: How AI-Powered Attacks Are Redefining Cyber Warfare). Traditional botnets usually rely on a Command-and-Control (C2) server and follow pre-programmed instructions. In contrast, a swarm malware attack involves adaptable independent malware instances that communicate peer-to-peer, make intelligent decisions (e.g. reinforcement learning), can act in polymorphic form, and even self-modify to evade detection.

For example, one infiltrated agent might quietly map out a network’s topology and hunt for points of ingress; if it finds something of interest, it can signal the rest of the swarm which then converge to exploit that target. All the while another subset of bots work to disable security logging. All of this can happen very rapidly. We have already encountered this level of sophistication with some Advanced Persistent Threat (APT) cases; this simply exaggerates the threat due to the distributed nature, possible speed of attack, and the necessary level of coordination.

Some of the features of AI-driven swarm attacks that make them especially interesting are:

  • Peer-to-Peer coordination – swarm bots communicate over decentralized channels like encrypted P2P networks, blockchain transactions, or anonymous networks (e.g. Tor). This means there is no single C2 server for defenders to find and take down; the instructions are coming from within the swarm itself. For example, agents can publish and read commands on a blockchain, which is very hard to block. If defenders find and remove some agents, the remaining ones detect the change and reroute communications. They might switch to DNS or SSH tunneling to adapt and maintain swarm cohesion.
  • Autonomous decision making – each malicious agent can generally mimic thinking for itself using AI algorithms. Reinforcement learning allows the malware to improve across multiple iterations, learning what techniques work or don’t work against a specific set of targets. The agents don’t need to wait for instructions; they can be coded to evolve their attack strategies in real-time. They might even go polymorphic, mutating their payloads on the fly to avoid antivirus detection. This autonomy makes them unpredictable and pattern matching becomes of less utility in these scenarios. A swarm can also exhibit emergent attack behaviors that its creators may not have explicitly programmed.
  • Specialization and multi-vector attacks – just as defenders can use specialized agents, attackers can assign roles to different AI agents in a swarm. For example, an agent can be programmed to perform reconnaissance, another one can be focused on exploit execution, there can be evasion focused agents to cover tracks, and there can be mutation agents to ensure a pattern is never exposed. Working together, these agents can create a problematic scenario for defenders. This can become overwhelming for most environments in their current state. It’s the digital equivalent of a wolf pack hunting prey, some distract the sentries, others go in for the kill.

Evasion

Realistically, decentralized malicious swarms are hard to detect and contain. Traditional security tools that look for centralized C2 traffic or known malware signatures struggle against a shape-shifting, adaptively communicating swarm. Law enforcement finds it difficult to shut down infrastructure when the “infrastructure” is a non-static hive of agents coordinating over standard protocols. Instead of noisy obvious attacks, AI agents enable stealthy penetration of a specific target. For instance, an agentic malware could infiltrate an enterprise. Then it can patiently analyze the internal network to find the most valuable data or the keys to escalate privileges. Cooperating AI agents can now do in hours what once took skilled hackers weeks of manual effort. These agents don’t take sick days or face personal issues, enabling nonstop operations.

There is already an uptick in AI-enhanced cyber attacks. Real breaches are basically getting assistance from AI. For example, the 2022 Activision breach was enabled by a series of convincing AI-generated phishing texts that tricked an employee. These stand to become more problematic over time. Imagine phishing emails not just written by AI, but orchestrated by an agent that monitors social media in real time. Autonomous agents with access to public APIs can learn patterns and strategically schedule communications when the target checks email.

Cyber Arms Race

Strategically, nation-state APTs are also eyeing agentic AI to enhance their campaigns. Given this, the “cyber arms race” is a very real concern. If one nation develops powerful cyber agent capabilities, others will follow suit. In some cases the technology even gets shared. The race is  accelerating the co-development of attack and defense in cyberspace. Attack agents get better, so defensive agents retrain to adapt, prompting attackers to create even more advanced techniques, and so on. However, this dynamic could also break the entry barrier and the nation-state notion starts to play a lesser role. Ultimately, this means that launching successful decentralized attacks becomes possible by many more groups than what is current state.

Currently, the most devastating cyber weapons (e.g. Stuxnet) are within reach of only a few well-resourced actors. This is due to the expertise and effort required to use them. Agentic AI might democratize the necessary skillset. Moderately capable AI attack agents will soon spread widely, allowing smaller groups or less advanced nations to cause greater impact. Autonomous agents could perform the laborious steps of a kill-chain (e.g. reconnaissance, vulnerability discovery, etc) far faster and at scale. This lets even a small team mount sophisticated attacks.

Asymmetric Cyber Warfare

Asymmetric cyber warfare is fast becoming part of reality. This is where large powers not only have to fend off other nation-states, but also highly capable cyber swarms launched by hacktivists, terrorist groups, or cybercrime groups. Just as nuclear technology eventually spread beyond the initial superpowers (with profound geopolitical effects), agentic AI tech will not stay confined to the “good guys.” This software will spread, and its development will be decentralized globally. This could possibly compress the timeline of nefarious agentic AI proliferation, meaning defensive measures will likely lag behind the threat.

Unpredictability

A big worry is the unpredictability and speed of AI-driven attacks. The worry is the real possibility of accidental escalation. Autonomous cyber operations happen at machine speed. If a swarm of AI agents targets critical infrastructure, the target might struggle to attribute the source of the attack. This potentially causes confusion or misdirected retaliation. In military scenarios, there’s concern that an AI may take an action that crosses a threshold without explicit human checks and balances, simply because the AI deems such action optimal. This lack of transparency and control is a new kind of risk, an AI-ignited flash conflict. Clearly, the offensive implications of decentralized agentic AI demand that we invest just as heavily in countermeasures and kill switches as we do in the agentic technology itself.

Agentic AI in Military Operations

The influence of agentic AI extends beyond the realm of cybersecurity. It is poised to impact military operations as well. Decentralized AI agents are becoming critical in both the digital domain (espionage, cyber attacks, cyber defense) and the physical domain (autonomous drones, robotic swarms, battlefield management).

Military Kinetic Operations

Emotionally, the most enticing application of agentic AI is in autonomous drone swarms and robotic systems on the battlefield. Militaries worldwide are developing swarms of unmanned systems (aerial drones, ground robots, naval drones). These swarms can perform missions collaboratively with minimal direct human control. Decentralized AI is the brains behind these swarms, enabling them to adapt to battlefield conditions, make split-second decisions, and coordinate maneuvers in cohesive form.

Defense contractor Thales recently demonstrated a system called COHESION for drone swarms with high autonomy (Thales demonstrates its capacity to deploy drone swarms with unparalleled levels of autonomy using AI). In tests, swarms of drones were able to carry out missions even under conditions where Global Positioning System (GPS) and other communications were jammed. This success was only possible because the drones could perceive their local environment, share information amongst each other, and collaboratively adjust tactics without needing continuous human commands. The drones identified targets, analyzed enemy movements, and reprioritized their objectives on the fly. In doing so they effectively accelerated the military Observe, Orient, Decide, Act (OODA) loop for faster decision-making in combat situations.

Importantly, these swarm systems aim to reduce the cognitive load on human operators. Theoretically, one operator can supervise an entire swarm rather than manually flying a single drone. This force multiplication means militaries can deploy dozens or hundreds of assets with the manpower that typically control one asset.

The strategic implications of drone swarms are enormous. Advanced militaries have invested in expensive platforms (e.g. aircraft carriers, stealth jets, etc). These investments assume they won’t face swarms of inexpensive kamikaze drones capable of overwhelming the defenses they have acquired. That assumption is no longer safe. Insurgent groups, hactivist groups, and mid-tier nations can afford low cost drones that can have explosives attached to them. With AI swarm technology, these typically underwhelming forces could coordinate an attack where dozens of drones simultaneously dive onto a warship or a tank battalion, overwhelming its defense systems. 

In April 2025, a U.S. CENTCOM commander stated that drones are among the top threats faced by forces, and swarms are an even bigger concern than individual UAVs (https://cuashub.com/en/content/centcom-colonel-discusses-the-challenge-of-adapting-to-the-drone-threat/). Imagine, a swarm of drones that cost $1,000 USD could potentially destroy a warship that cost $1 BN USD. To respond, entities such as the U.S. DoD are not only seeking anti-swarm defenses (like directed-energy weapons), but also building swarms of their own. As of 2020, the DoD had multiple programs and contracts explicitly focused on AI-coordinated drone swarms, recognizing that whoever masters swarming gains a tactical edge.

Military Logistics

Beyond battlefield drone operations, multi-agent AI is improving military logistics and planning. Agentic AI can effectively coordinate supply convoys, allocate tasks to autonomous robotic vehicles, and manage battlefield communications dynamically. This last point is important because agents could have visibility into areas where humans may not. In strategic planning, the U.S. DofD is exploring agentic AI to support war-gaming and operational planning. The implications are grand as agents can synthesize vast amounts of intelligence and generate unbiased decisions much faster than human staff alone (AI’s New Frontier in War Planning: How AI Agents Can Revolutionize Military Decision-Making).

An agentic AI could become a powerful advisor, analyzing geopolitical data, battlefield intel, and logistics in parallel to propose optimal strategies. By integrating such AI into command centers, commanders might get decision options in minutes that would take weeks via manual planning. This speeds up the command decision cycle, crucial in fast-moving conflicts. Agentic AI can become the next big thing in maintaining or gaining decision superiority, this is the ability to observe, decide, and act faster than the adversary.

Agentic AI and decentralization are driving a new era of warfare. This is one where swarms of autonomous agents, whether in cyberspace or the physical world, confront and engage each other. Warfighters may increasingly find themselves orchestrating AI teammates while  countering enemy AI. This new era comes with many challenges around trust, rules of engagement, and control, but militaries cannot ignore these technologies now.

Challenges and Safeguards

While the potential of decentralized agentic AI is immense, it does come with significant challenges, risks, and ethical considerations:

  • Reliability and control – by design, agentic AI reduces direct human control. This autonomy means agents might make mistakes or take unexpected actions. For example, a defensive agent could mistakenly shut down a critical server thinking it contains malware. In essence this creates a self-inflicted denial of service. In military use, the stakes are higher – what if a drone swarm interprets a civilian convoy as hostile due to faulty signals? Ensuring robust guardrails is essential. Industry recommendations include having configurable thresholds where an AI must pause and get human approval if an action crosses a certain threshold.
  • Accountability and ethics – when an autonomous agent causes damage, who is responsible? This is a dicey issue. Legal and ethical frameworks lag behind in the area. We currently treat software as tools under human responsibility, but truly autonomous agents blur that line a bit. In military scenarios, deploying lethal autonomous agents raises obvious ethical questions. International discussions have begun around potential treaties or at least guidelines for lethal autonomous weapons, often focusing on keeping meaningful human control. Meanwhile, organizations using agentic AI for security must implement governance policies that can be enforced.
  • Security of the agents themselves – ironically, the AI agents we deploy for defense could become targets of attack. This is seen in parallel today where products that are supposed to protect an environment get broken into themselves. Adversaries will try to trick or subvert defensive AI agents. Multi-agent systems also introduce new elements of an attack surface. If agents communicate peer-to-peer, could an attacker inject a rogue agent into the swarm to feed false information or disrupt coordination? Researchers have noted the possibility of poisoning attacks on cooperative multi-agent systems, where manipulating one agent’s behavior can degrade the performance of the whole team (One4All: Manipulate one agent to poison the cooperative multi-agent reinforcement learning). Strong inter-agent authentication, consensus protocols for decisions, and systemic isolation (so one compromised node doesn’t doom the rest) are active areas of research to ensure trust in decentralized AI networks.
  • Data privacy and abuse – decentralized agents often need broad access to data (e.g. endpoint data, log files, etc) to be effective. Without proper controls, this raises privacy concerns. Imagine an agent that scans employee communications to detect insider threats; it could inadvertently violate privacy laws or company policies if not carefully configured. Agents need to be coded such that on-device processing means data stays local and only alerts leave the source. The abuse potential of agentic AI is high. There is a responsibility for researchers and vendors to ensure that advances in agentic AI come with corresponding improvements in security and access control.

Despite these challenges, the trajectory is clear. Decentralized agentic AI will play an ever-growing role in cybersecurity and military theaters. To harness its benefits while managing risks, collaboration between AI researchers, cybersecurity experts, and policymakers is vital. Efforts like the Cloud Security Alliance (CSA) guidelines on agentic AI threat modeling (Agentic AI Threat Modeling Framework: MAESTRO) are steps in the right direction. Organizations adopting agentic AI should start with small steps, supervised deployments (e.g. agents that make recommendations, not final actions). This way it is possible to introduce incremental controls that should lead to trust and understanding of the behavior. We cannot afford to make the traditional cybersecurity mistake of it being an afterthought to some deployment. Over time, as confidence and safety mechanisms improve, we can transition more decision authority to these agents.

Conclusion

Decentralized agentic AI represents a major advancement for both cybersecurity and military operations. By empowering networks of autonomous agents to act in concert, we gain systems that are faster, more scalable, and more resilient than traditional centralized approaches. In cyber defense, this means security that can operate at machine speed across an entire organization, swarming to address threats the moment they arise. In warfare, it means smaller, smarter forces wielding swarms of potentially lethal drones or algorithms that can outmaneuver larger traditional forces. The offensive implications are equally powerful. Well-coordinated AI agents can mount sophisticated attacks that challenge even the best defenses, forcing a rethinking of how we position and secure critical assets.

Ultimately, agentic AI is a classic red / blue dichotomy. It will be a force for both offense and defense. As cybersecurity professionals, our task is to stay ahead of the curve as best as possible. Innovations in defensive agentic AI may make this possible. Attackers are innovating on the offense, and we must put proper and equally powerful safeguards in place. Decentralization is a force multiplier, hard stop. It makes AI systems more powerful by leveraging the strength of many. But, it also requires giving up some direct control. With robust design, continuous oversight, and a commitment to ethical use, we can embrace decentralized agentic AI to create more secure and resilient systems. The age of autonomous agents is exciting and here, decentralized agentic AI is the future of cyber warfare. How we navigate its opportunities and risks will define the security landscape of the coming decades.

The Unique Data Quality Challenges in the Cybersecurity Domain

Part 8 in the Series: Unlock Artificial Intelligence Potential – The Power Of Pristine Data

The integration of Artificial Intelligence (AI) into cybersecurity has ushered in a new era of sophisticated threat detection, proactive vulnerability assessments, and automated incident response. As organizations increasingly rely on AI to bolster their defenses, the fundamental principle remains that the quality of the data on which they train these advanced systems directly links to their effectiveness. The old saying “garbage in, garbage out” (GIGO) holds true here; navigating the unique data quality challenges in the cybersecurity domain.

Unlock Artificial Intelligence Potential - The Power Of Pristine Data - The Unique Data Quality Challenges in the Cybersecurity Domain

In Part 7 we covered some relevant examples where data is used successfully. While the principles of data hygiene and fidelity are universally applicable, the cybersecurity domain presents unique challenges that require specific considerations when preparing data for AI training.

Attacks

One significant challenge is addressing adversarial attacks targeting training data (https://akitra.com/cybersecurity-implications-of-data-poisoning-in-ai-models/). Cybersecurity AI operates in environments where attackers actively try to manipulate training data. This sets it apart from many other AI applications. Some of the forms this can take are:

  • Data poisoning: where attackers inject carefully crafted malicious data into training data sets to skew what a given model learns.
  • Adversarial attacks: where subtle modifications are made to input data at inference time to fool a model.

Countering these threats requires the implementation of robust data validation and anomaly detection techniques specifically designed to identify and filter out poisoned data (https://www.exabeam.com/explainers/ai-cyber-security/ai-cyber-security-securing-ai-systems-against-cyber-threats/). Practitioners can improve model resilience by using techniques like adversarial training, explicitly training models on examples of adversarial attacks.

Dynamic Data Maintenance

Another unique challenge in cybersecurity is the continuous battle against evolving cyber threats and the need for dynamic data maintenance. The threat landscape is constantly changing, with new attack vectors, malware strains, and social engineering tactics emerging on a regular basis. This necessitates a continuous process of monitoring and retraining AI models with the latest threat intelligence data to ensure they remain effective against these new threats. Training a model with current state data and thinking that is enough is the equivalent of generating hashes for known malware. The practice outlives its usefulness. As such, the “continuous” part of retraining is one to embrace.

Data hygiene and fidelity processes in the cybersecurity domain must also be agile and adaptable to keep pace with these rapid changes. For example, in Retrieval-Augmented Generation (RAG) architectures, it is crucial to address “authorization drift” by continuously updating the vector databases with the most current document permissions to prevent unauthorized access to sensitive information. Maintaining high data fidelity in cybersecurity requires not only preventing errors and biases. It also requires actively defending against malicious manipulation, and continuously updating data to accurately reflect ever-evolving threat landscapes.

Series Conclusion: Data Quality – The Unsung Hero of Robust AI-Powered Cybersecurity

In conclusion, high-quality data drives the success of AI applications in cybersecurity. Data hygiene, ensuring that data is clean, accurate, and consistent, and data fidelity, guaranteeing that data accurately represents its source and retains its essential characteristics, are not merely technical considerations. They are fundamental pillars upon which effective AI-powered cybersecurity defenses are built. The perils of poor data quality, including missed threats, false positives, biased models, and vulnerabilities to adversarial attacks, underscore the critical need for meticulous data preparation. Conversely, success stories in threat detection, vulnerability assessment, and phishing prevention show how high-quality data enables effective AI models.

Cybersecurity faces evolving challenges, including adversaries manipulating data and new threats emerging constantly. Maintaining strong data quality remains absolutely essential. Organizations must invest in strong data hygiene and fidelity processes to support trustworthy AI-powered cybersecurity. In today’s complex threat landscape, this is a strategic imperative—not just a technical need. Cybersecurity professionals must therefore prioritize navigating the unique data quality challenges in the cybersecurity domain. Data quality above all else will positively impact AI initiatives, it is the unsung hero that underpins the promise of a more secure future cyber landscape.

Data-Powered AI: Proven Cybersecurity Examples You Need to See

Part 7 in the Series: Unlock Artificial Intelligence Potential – The Power Of Pristine Data

The integration of Artificial Intelligence (AI) into cybersecurity has ushered in a new era of sophisticated threat detection, proactive vulnerability assessments, and automated incident response. As organizations increasingly rely on AI to bolster their defenses, the fundamental principle remains that the quality of the data on which they train these advanced systems directly links to their effectiveness. The old saying “garbage in, garbage out” (GIGO) holds true here; sometimes it is done correctly, data-powered AI: proven cybersecurity examples you need to see.

Unlock Artificial Intelligence Potential - The Power Of Pristine Data - Data-Powered AI: Proven Cybersecurity Examples You Need to See

In Part 6 we covered some data hygiene secrets, or best practices. These can prove to be fundamental to the quality of data used for training models. The importance of high-quality data in AI-powered cybersecurity is underscored by numerous real-world examples of systems that have demonstrated remarkable effectiveness.

Some Examples 

Darktrace stands out as a pioneer in using AI for threat detection. To begin with, its system operates by learning the normal behavior patterns of users, devices, and networks within an organization. Once established, it identifies outliers—deviations that may indicate a cyber threat. Moreover, Darktrace analyzes network and user data in real time, helping prevent cyberattacks across multiple industries. For example, it detected and responded to a ransomware attack at a healthcare organization before the attacker could encrypt critical data. Ultimately, this success hinges on its ability to learn a highly accurate baseline of normal behavior. To achieve this, it requires a continuous stream of clean and representative data.

Constella Intelligence has also demonstrated the power of high-quality data in AI-driven cybersecurity. At the core of their approach, Constella’s solutions focus on identity risk management and threat intelligence, leveraging a vast data lake of curated and verified compromised identity assets. In a notable example, a top global bank used Constella to identify a threat actor and uncover a broader group selling stolen credentials. As a result, Constella’s AI helped stop fraud, saving the bank over $100 million by preventing massive credit card abuse. In addition, Constella’s “Hunter” platform—built on this rich data foundation—has been successfully used by cybercrime investigative journalist Brian Krebs to track and identify key figures in the cybercriminal underworld. Collectively, these examples highlight how Constella’s commitment to data quality empowers their AI-powered solutions to deliver significant cybersecurity impact.

Google’s Gmail has achieved significant success in the realm of phishing detection by leveraging machine learning to scan billions of emails daily. This software identifies and blocks phishing attempts with a high degree of precision. The system learns from each detected phishing attempt, continuously enhancing its ability to recognize new and evolving phishing techniques. This massive scale of operation and the high accuracy rates demonstrate the power of AI when trained on large volumes of well-labeled, clean, diverse email data.

CrowdStrike and SentinelOne show how AI-enhanced EDR can improve threat detection and response on endpoint devices. (https://www.sentinelone.com/cybersecurity-101/data-and-ai/ai-threat-detection/). AI monitors devices for anomalies and responds in real time to detect, contain, or neutralize potential threats. The effectiveness of these platforms relies on their ability to analyze vast amounts of endpoint data to establish baselines of normal activity and to quickly identify and react to deviations that signify anomalous activity.

Getting Predictive

AI algorithms now play a growing role in analyzing extensive repositories of historical security incident data. These repositories typically include records of past breaches, detailed indicators of compromise (IOCs), and intelligence on known threat actors. By mining this historical information, AI can uncover hidden trends and recurring patterns that manual analysis might easily miss. Provided the data is high quality, machine learning models can then use these patterns to predict the likelihood of specific cyberattacks occurring in the future (https://www.datamation.com/security/ai-in-cybersecurity/). As a result, predictive analytics empowers organizations to adopt a more proactive security posture—strategically reinforcing defenses and allocating resources toward the most probable targets. In essence, predictive analytics stands as a cornerstone capability of AI in cybersecurity, enabling threat anticipation and smarter security prioritization.

Consider an organization that utilizes AI to analyze its comprehensive historical security incident data. AI detects recurring phishing attacks targeting finance and HR before fiscal year-end, revealing a seasonal pattern of threats. The organization uses AI predictions to launch tailored security training for finance and HR ahead of high-risk periods. Training helps employees recognize known phishing tactics and avoid similar attacks during future high-risk periods. AI tracks how attacker techniques evolve over time, going beyond just predicting attack type and timing. Organizations can adapt defenses in advance, using AI insights to counter evolving attacker techniques and future threats. Mastercard, for instance, uses AI for predictive analytics to analyze real-time transactions and block fraudulent activities. IBM’s Watson for Cyber Security analyzes historical data to predict future threats.

Detecting Insider Threats and Account Compromises

Organizations increasingly employ AI-powered User and Entity Behavior Analytics (UEBA) tools to analyze vast amounts of user activity data. These include login attempts, file access patterns, network traffic generated by specific users, and their usage of various applications (https://www.ibm.com/think/topics/user-behavior-analytics). The primary goal of this analysis is to establish robust baselines of what constitutes “normal” behavior. This applies to both individual users within the organization and for defined peer groups based on their roles and responsibilities. ML algorithms are then applied to continuously monitor ongoing user activity. The goal is to detect any significant deviations from those established baselines. SThe system flags such deviations as potential signs of compromised accounts, malicious insiders, or other suspicious behavior.

Anomalies may appear when users log in at unusual times or unexpected locations, access sensitive systems outside their usual scope, transfer unusually large volumes of data, or suddenly shift their typical activity patterns. UEBA systems use AI-driven risk scores to rank threats, helping security teams prioritize the most suspicious users and activities. In some cases external sources of identity risk intelligence are factored in as well (https://andresandreu.tech/disinformation-security-identity-risk-intelligence/). UEBA solutions use AI/ML to track user behavior and detect deviations. They also transform raw data into actionable insights by baselining normal behavior and detecting anomalies from there.

Consider an employee who consistently logs into an organization’s network from their office location during standard business hours. An AI-powered UEBA system has this user flagged as risky. This is based on an identity risk posture score that shows evidence of infostealer infections. The UEBA system continuously monitors relevant login activity. It detects a sudden login attempt originating from an IP address in a foreign country at 03:00, a time when the employee is not typically working. This unusual login is immediately followed by a series of access requests to sensitive files and directories. The employee in question does not normally interact with these files as part of their job responsibilities.

The AI system, which already has the user account flagged as risky, recognizes this sequence of events as a significant deviation from the employee’s established baseline behavior. In turn, it flags the activity as a high-risk anomaly. This strongly indicates a potential account compromise and promptly generates an alert for the security team to initiate an immediate action. Beyond detecting overt signs of compromise, AI in UEBA can also identify more subtle indicators of insider threats. For example, attackers may exfiltrate data slowly over time—a tactic that traditional security tools can easily overlook.

AI-driven UEBA needs clean, consistent data from logs, apps, and network activity to build accurate behavioral baselines. Poor data—like missing logs or bad timestamps—can cause false alerts or let real threats go undetected. AI must learn user-specific behavior and adapt to legitimate changes like travel or role shifts to reduce false alarms. Organizations must protect user data and comply with regulations when using systems that monitor and analyze behavior. Finally, it is important to be aware of potential biases that might exist within the user data itself. Biases may cause AI to unfairly flag certain users or behaviors as suspicious, even when they’re actually legitimate.

Part 8 will conclude this series and cover some unique data quality challenges in the cybersecurity domain. Data quality is the foundation for data-powered AI: proven cybersecurity examples you need to see.