Attack automation and the changing conditions of defense
Claude Mythos, a general-purpose AI model released in April 2026, detected vulnerabilities that had gone unnoticed for 27 years in OpenBSD and for 16 years in FFmpeg, with no human involvement. On Linux, it chained code defects together on its own to build a path to server takeover. These offensive capabilities emerged with no security-specific training, as a byproduct of broad gains in coding, reasoning, and autonomy (Anthropic 2026). As the time from vulnerability discovery to exploit generation shrinks, so does the response time available to the defending organization. The figures below show the shift.
Time-to-exploit (TTE), the gap between the release of a patch and the first exploitation of the vulnerability, averaged 63 days in 2018 and reached -7 days in 2025. Exploitation now begins a week before the patch is released. The time from initial intrusion to the start of follow-on attacks has also fallen, from more than 8 hours in 2022 to 22 seconds in 2025 (Mandiant M-Trends 2026). No cycle in which a person reviews an alert and decides on a response can keep up with that speed.
Once attacks are automated, the stages from intrusion to objective get shorter and variants multiply quickly. An approach that relies on predefined detection rules and scenarios struggles to detect attacks that no rule defines. That is why the defense side now needs agentic AI as well: AI that interprets the situation on its own and decides the next action.
One point deserves attention. Automation on offense and automation on defense are not symmetrical. An attacking AI can try thousands of times and needs to succeed only once; a defending AI can affect live operations with a single wrong judgment. A false positive that isolates a legitimate service halts business, and a threat that goes undetected becomes a breach in progress. Unlike attack automation, where failure is cheap, defense automation needs grounds for every single judgment. The conditions on defense data must therefore be stricter.
Put in data terms, the requirement comes down to this. The quality of the input data shapes judgment accuracy as much as the performance of the model does. Logs and alerts summarize what happened; they show the state of an event, not the original data needed to judge its cause. A judgment that gains speed without grounds is not defense. It is a new risk.
Four gaps that dependence on logs and alerts leaves in AI judgment
State information is data that summarizes the current situation: detection events, system logs, alerts. It does not carry the original data needed to trace a root cause. The problem is that most security operations depend on exactly this kind of state information. In that structure, adopting agentic AI does little to secure sufficient grounds for judgment, and four gaps open up that lower the accuracy and reliability of AI judgment.
- Root cause gap: event logs show only the state of an occurrence. Tracing how an attack got in, what it passed through, and how far it went requires raw packets and sessions. An investigation run on logs alone circles from one system’s logs to another’s, reconfirming the same symptoms, while the attacker moves to the next stage.
- Predefinition gap: defining every threat type in advance and writing a response rule for each is not realistic. When an attacker bypasses a detection rule or abuses legitimate tools, the rule does not fire. In an environment where variants are generated automatically, the undefined territory grows rather than shrinks.
- Alert handling gap: detection built on state information is a structure in which false positives grow. The more alerts there are to process, the greater the risk that a real threat is buried in the volume, and as alerts lose credibility, so does any automated action taken on them.
- Data connection gap: reconstructing logs scattered across many systems into a single attack flow costs time and money. AI performs when it can connect and analyze data across the whole organization. AI that learns and judges from incomplete, siloed data reaches wrong conclusions.
Under human operation, the four gaps show up as investigation delays. Once judgment is handed to an autonomous system, their character changes: a wrong judgment now flows into the next action with no review. The data quality requirements for adopting agentic AI are therefore far higher than for existing operations.
Comparing judgment structures: state-information-based AI and context-data-based AI
The difference between the two approaches starts with the data each one judges on and extends to the scope of visibility, the way false positives arise, and whether a judgment can be verified after the fact.
The five criteria are closely linked. When the grounds for judgment stop at summarized information, visibility is limited too, inference on incomplete information grows, and the likelihood of false positives rises with it. Without the original data, tracing a root cause or verifying the AI’s decision process is hard as well. In the end, the data used as grounds for judgment sets the level of the other four criteria.
The state-information-based approach has clear uses of its own. When the scenario is well defined, such as fast handling of known threat types or filtering large volumes of events, it is efficient. Whether a context-data-based approach is needed comes down to three challenges that decide judgment quality: tracing unknown attack paths, operator verification of the grounds for AI judgment, and full forensic reconstruction after an incident. If any one of them applies, the organization should move to a context-data-based approach.
The cost structure belongs in that review as well. A state-information-based structure is cheap to build, but the operating cost of verifying false positives and running circular investigations grows in proportion to alert volume. A context-data-based structure requires upfront investment in collecting and storing the original data. In return, the grounds for judgment are already inside the data, and the cost of repeated verification falls. Adopting agentic AI is a decision that multiplies the number of judgments. Putting the structure with the lower verification cost per judgment in place first is the better choice on total cost.
The first condition, raw data: the layer that sets the scope of AI judgment
Context data starts with the original data. Sampling leaves packets out of the collection, and metadata collection does not restore the actual content of a communication. Without a structure that stores all traffic within the collection scope through full-packet collection, three risks appear in practice once agentic AI is in operation.
- Areas the AI cannot judge: whatever is not collected remains an area the AI cannot judge. The ceiling on what the AI can cover is the collection scope, not the performance of the model.
- No investigation of past traffic: without the raw traffic data, a newly discovered indicator of compromise (IOC) cannot be checked against the past to see whether the same threat already got in. In an automated attack environment, intrusion increasingly runs ahead of detection. Responding to a new threat requires the ability to re-analyze past data.
- Declining trust in judgment: judging on incomplete data raises false positives, and repeated false positives lead operators to stop accepting automated judgments as they are. The efficiency gained from automation is then canceled out by the burden of verification.
Software supply chain attacks are the textbook example. The malicious activity rides on legitimate communication channels, so code signing and package integrity checks alone rarely stop it, and without direct analysis of the raw traffic, even detecting it is hard. For this class of attack, collecting all of the raw traffic is what leaves grounds for judgment behind.
The second and third conditions: baseline and explainability
The original data is where accurate judgment begins. On top of it, two more things are needed: a consistent reference for analysis and a way to verify the result of a judgment.
Behavioral baseline data identifies activity that departs from the normal pattern, and raw transaction/session data supplies the details and context of that activity so that the AI can judge whether it is a real threat. Without behavioral baseline data, the AI treats each event as an isolated signal. As a result, insider threats disguised as normal activity and slow, covert attacks that unfold over a long period are hard to detect. When the direction and size of a deviation are fed in as numbers, the AI moves beyond a binary normal-or-abnormal call to a judgment that takes context into account.
Explainability (XAI) is the layer that records the decision process so that an operator can review which data and which features the AI based its judgment on. The wider the scope of autonomous judgment, the more this layer matters. In an environment without these two layers, the judgment errors agentic AI runs into take three forms.
- More false positives: with no baseline to separate normal from abnormal, the AI falls back on threshold rules, and the false-positive burden grows.
- Opaque grounds for judgment: when it is unclear which features led the AI to a threat verdict, the operator has no way to decide whether to accept that judgment.
- Higher verification cost: an AI whose decision process cannot be checked demands repeated manual confirmation while false positives are handled, which cancels out the effect of automation. When a wrong autonomous action occurs, accountability becomes unclear as well.
Explainability is not a license to trust AI judgment blindly. When feature contribution and the decision process are visible, the operator reviews the reliability of the AI judgment directly and identifies false positives quickly. This verifiability is the basis for deciding how far to extend autonomous execution.
Data requirements by industry: how regulation and environment change them
The same data foundation faces different requirements depending on the industry environment. One thing is common to all of them: for agentic AI to judge in any environment, the original data that grounds the judgment must be captured within that environment’s constraints.
- Finance: raw traffic retention, detection of anomalous insider activity, and evidence of regulatory compliance are all required together. The names of the regulations differ by jurisdiction, but the demands overlap. In Korea, the Standards for Measures to Ensure Safety of Personal Information require access records for personal information processing systems to be retained for at least one year. That rises to at least two years where 50,000 or more data subjects, unique identifiers, or sensitive information are processed. In Japan, the Guidelines on Cybersecurity for the Financial Sector, published on October 4, 2024, require log keeping and an incident response framework. The Act on the Protection of Personal Information requires a preliminary breach report within three to five days. In the United States, NYDFS 23 NYCRR Part 500 requires audit trails used for incident detection and response to be retained for at least three years and incidents to be reported within 72 hours. In the EU, the Digital Operational Resilience Act (DORA), applicable since January 17, 2025, requires firms to assess for themselves whether their security architecture meets the regulatory requirements. Whether the original data behind an AI judgment can be produced for regulatory review and audit must be confirmed as well.
- Defense: in an air-gapped network structure, reliance on external intelligence is limited. What is needed is a structure that learns the behavioral baseline from complete analysis of internal traffic inside the closed network and secures its own grounds for judgment.
- Manufacturing and OT: industrial protocols must be analyzable without stopping the production line. In environments where availability comes first, accurate judgment on the original data and confirmation of the scope of impact take precedence over blocking-centered response.
- Healthcare: patient data de-identification requirements and visibility into medical device networks must be satisfied at the same time. The design must keep investigation grounds at the level of the original data within the constraints of privacy protection.
Adoption order and the data infrastructure that comes first
An adoption review starts with checking the data infrastructure, not with comparing model performance. Agentic AI that arrives without data for the grounds of judgment merely automates inference, and the wider its autonomous execution, the higher that cost.
- Collect and preserve raw data: put full-packet collection of all traffic, retention of raw transaction/session data, and the ability to investigate past traffic in place first. This is the stage that removes the areas the AI cannot judge.
- Learn the baseline: establish a behavioral baseline that learns each asset’s normal pattern and quantifies deviation. This is the stage that gives AI judgment a reference.
- Put verification in place: build a structure that allows the decision process to be reviewed through Explainability (XAI). This is the stage that sets the grounds for deciding how far to extend autonomous execution.
The real differentiator is not a better AI model but complete context data. The automation of judgment leads toward closed-loop automation that runs from detection through analysis and judgment to response, or autonomous security operations. It runs more reliably the more of these layers are fed in together.
Frequently asked questions
Q. Is AI-based network detection and response (NDR) effective without full-packet collection?
Analysis based on metadata alone can detect communication patterns and anomalous activity, so it delivers a certain level of value. With full-packet data alongside it, the specific content and context of the detected activity can be analyzed as well, and the AI judges whether something is a threat on richer grounds. The collection method should therefore follow the level of detection required and the scope of data use.
Q. How much data does behavioral baseline learning need?
Behavioral baseline data becomes more accurate the more thoroughly it learns each asset’s normal pattern, and the learning period and scope differ from one environment to the next. What matters more is lossless collection of the raw traffic. A baseline learned from sampled data reflects only part of the actual communication, and its accuracy drops.
Q. Does an organization that already runs security information and event management (SIEM) need to add NDR to adopt agentic AI?
An existing SIEM provides visibility based on logs and events. Without the raw traffic and the behavioral context, the grounds for agentic AI judgment remain incomplete. Automation pays off more when logs, raw packets, and sessions connect into one investigation flow.
