#246: Beyond Threat Hunting

Key Takeaways

• The Transport for London (TfL) and Marks & Spencer (M&S) attacks demonstrate the growing importance of identity as the primary attack surface in modern organisations.

• Public reporting suggests both incidents relied heavily on social engineering and compromised identities rather than novel software vulnerabilities.

• The principles described in NIST SP 800-207: Zero Trust Architecture assume that identities, devices and networks may all become compromised and are designed to reduce the impact of successful intrusions.

• Zero Trust should not be viewed as a technology or product. It is an architectural approach that continuously evaluates trust, limits privileges and assumes that attackers may already be present within the environment.

• While no security architecture can guarantee prevention, Zero Trust provides a framework for reducing attacker freedom, limiting lateral movement and improving organisational resilience.

  ---

Artificial intelligence has rapidly become one of the most influential technologies in modern cybersecurity. Over the past few years, security teams have embraced AI to improve threat detection, accelerate investigations and reduce the burden placed on analysts working within increasingly complex SOCs. Large language models can summarise incident reports, generate search queries, explain malware behaviour and help analysts navigate enormous volumes of telemetry. Machine learning systems identify behavioural anomalies that might otherwise go unnoticed, while autonomous AI agents are beginning to automate repetitive investigative tasks.

These developments are transforming security operations. Analysts spend less time writing complex queries or manually correlating logs from dozens of different platforms and more time interpreting evidence, making decisions and understanding attacker behaviour. AI has not removed the need for skilled cybersecurity professionals, but it has made their expertise considerably more scalable.

Continuous Agentic Pentesting for the Modern Web

The only enterprise-grade agentic penetration testing platform built for modern web applications. No consultants. No delays. Up to 10x testing capacity at the same cost of manual.

Learn more

As organisations become increasingly dependent upon AI, however, a new challenge emerges. Security teams must not only use AI to defend their organisations; they must also ensure that the AI systems themselves are secure. An insecure AI model can become an attack vector just as readily as an unpatched server or misconfigured cloud workload.

This shift has led to growing interest in frameworks that apply established cybersecurity principles to artificial intelligence. One of the most prominent is Google’s Secure AI Framework (SAIF), which provides guidance for building, deploying and operating AI systems securely throughout their lifecycle. Rather than introducing entirely new security concepts, SAIF adapts familiar practices such as defence in depth, Zero Trust and continuous monitoring to address the unique challenges presented by machine learning and generative AI.

For security professionals already using AI to enhance their operations, understanding SAIF offers a valuable next step.

AI is changing how security teams work

Security operations have traditionally been constrained by three persistent challenges: an overwhelming volume of security data, a shortage of experienced analysts and the increasing sophistication of modern cyber attacks.

A typical enterprise may generate millions of events every day from endpoints, firewalls, identity providers, cloud services and network monitoring platforms. Although Security Information and Event Management (SIEM) platforms have helped centralise this information, analysts have still been required to search, filter and correlate vast quantities of telemetry before meaningful investigations can begin.

Artificial intelligence significantly reduces this workload. Modern security platforms increasingly allow analysts to interact with systems using natural language rather than platform-specific query languages. Instead of remembering complex search syntax, an analyst can simply ask for endpoints exhibiting suspicious PowerShell activity combined with unusual authentication behaviour during the past week. AI translates that request into appropriate search queries, retrieves the relevant data and often provides an initial interpretation of the results.

Large language models are also proving valuable during investigations themselves. They can explain unfamiliar command-line arguments, decode obfuscated scripts, summarise lengthy log files and map attacker behaviour to frameworks such as MITRE ATT&CK. Tasks that previously required extensive manual research can now be completed within seconds, allowing analysts to devote more attention to validating evidence and understanding the broader context of an attack.

Machine learning extends these capabilities further by identifying behavioural anomalies across users, devices and cloud environments. Rather than relying exclusively on signatures or known indicators of compromise, AI identifies subtle relationships between seemingly unrelated events. An isolated authentication anomaly may appear harmless, but when combined with unusual process execution, privilege escalation and unexpected cloud activity, it begins to resemble a coordinated intrusion.

This ability to correlate weak signals across diverse sources is one of AI’s greatest contributions to modern security operations.

AI as a force multiplier rather than a replacement

Despite concerns that artificial intelligence may eventually replace cybersecurity professionals, the reality within most organisations is considerably more nuanced. Today’s AI systems function most effectively as force multipliers.

They automate repetitive analytical tasks, accelerate investigations and reduce the time required to mov