Breach-and-attack simulation is going autonomous: agents that pick and detonate real ATT&CK techniques with no human in the loop. The frameworks already run the attack. The unsolved problem is containing the attacker, and the discipline that contains it is what makes its measurements honest.
No CVE, no patch, roughly half the internet-facing FortiGates in the world. FortiBleed is a case study in how perimeter appliances became the softest target and the ransomware economy's favorite front door.
An AI agent is a credentialed insider, but a technique label like Valid Accounts cannot tell you which other agents a leaked key unlocks or how far the compromise spreads. In an agentic estate, lateral movement is a walk across shared secrets, and posture, not the ATT&CK label, decides its reach.
108 poisoned packages across npm, Packagist, Go, and Chrome. A fake font file that runs when you open a folder. Inside PolinRider, the DPRK supply-chain campaign that treats your build environment as the way in.
I ran four LLMs at mapping threat reports to ATT&CK. On easy hand-labeled reports they bunched together and the cheapest won. On 25 real CISA advisories with the answer key stripped, a clear ladder emerged: Claude leads on quality, Kimi K3 is the value pick, and the closed flagship finished last.
A dozen domains sharing a certificate, an IP range, and a registration date look like a threat actor's infrastructure. Usually they are a parking company's inventory. Here is the tenant versus landlord test that separates a real cluster from a coincidence, run against two live examples.
Uber open-sourced an 'Agentic AI Detection and Response' platform. The benchmark is a gift. The architecture can only detect the past.
Most coverage maps measure whether a rule was deployed, not whether it has ever fired. A rule sitting on top of a missing log source cannot trigger, yet it still counts as coverage. Here is how to tell real detection from the assumption of it.
J.P. Morgan's Patchmageddon report is right that the vulnerability warning system works and the lead time is collapsing toward zero. The gap it leaves is relevance. A warning that cannot tell you which of your assets sits in the storm's path is a national bulletin, not a warning.
Almost every threat intelligence product decides what matters to you by matching sector and geography tags against your profile. There is no surviving empirical evidence that either predicts who gets breached once you account for what you run. Here is what the data supports instead.
Sysdig documented a ransomware operation with no human at the keyboard. An LLM broke into an exposed Langflow server, moved laterally, and encrypted a production database start to finish. The tactics were old. The operator was not a person.
Anthropic's J-space research promises something like intent telemetry for AI agents. The opportunity is real, but it is not the logs we never had: it is a noisy, adversarially fragile sensor that needs an enforcement point you should have built anyway.
AI Security
Private data, untrusted content, and an exfiltration channel. When an agent has all three, someone else decides what it does with your secrets. Here is the pattern, drawn from three real breaches.
AI Security
AI agents have credentials, autonomy, and total gullibility. Stop securing them like software and start securing them like staff.
Meta
Threat intelligence, offensive security, and AI security: why this blog exists and what to expect.