In the field of information security, AI-powered technology is still in the early stages of introduction and operation. We can confidently assert that the integration of AI into security tools has clear advantages: reduced employee workloads and faster incident response through automation of routine processes, behavioral analysis of users and systems, and successful detection of previously unknown threats. Today, AI already serves as a co-pilot alongside cybersecurity professionals, complementing and expanding the capabilities of traditional security solutions.
Detection
The most common use of AI in cybersecurity is detecting malicious or abnormal activity. AI can analyze vast amounts of data efficiently, helping discover malware in traffic flows, detect abnormal user behavior, filter security events, and flag phishing emails or AI-generated content.
Processing security events
According to Microsoft, SOC teams receive an average of 4,484 alert triggers per day and spend around three hours manually separating real threats from noise. Meanwhile, Positive Technologies data shows that analyzing each event takes a SOC analyst about 10 minutes. Under these conditions, false positives become a serious issue, wasting employees' time and effort and increasing the risk of missing real threats. False positives occur when attackers mimic legitimate user activity—especially when using "living off the land" techniques, where they rely only on existing legitimate tools on the victim's device. As a result, SIEM correlation rules may flag normal user behavior as potentially dangerous, triggering a false positive. According to the SANS Survey 2024 on Incident Response, 64% of respondents cited false positives as their SOC's biggest challenge.
AI has the potential to solve this problem of SOC overload. AI-powered solutions can triage security events, filtering out likely false positives and highlighting only truly critical incidents for human analysts to review. For instance, one of the functions of MaxPatrol SIEM's BAD (behavioral anomaly detection) ML module is the ability to assess the risk of each security event on a 100-point scale, enriching alerts with additional context to reduce response times. An analyst can then prioritize alerts by risk score and immediately get to work on the most dangerous and urgent cases. According to IBM, AI-powered tools can halve the time it takes to sort and process security events, significantly boosting overall SOC efficiency. We explored these prospects for monitoring and incident response in more detail in our research on autonomous SOCs.
Behavioral analysis
Machine learning technology can be used to create a normal operation profile for an entity: user, system, or network. Depending on the task, this profile can include various parameters: traffic generated by a host, the standard set of applications used by employees who share the same role, or the system's power consumption. You can use ML models to continuously analyze and compare behavior with normal operation. Any deviations (anomalies) may indicate cybercriminal activity.
Behavioral analysis consists of the following key stages:
- Collecting data on the normal behavior of the object, including users, network traffic, and system activity. The broader and more detailed the dataset, the more accurate the behavioral analysis module's verdicts will be. For instance, the BAD module in MaxPatrol SIEM creates a preliminary infrastructure profile after just one week of operation. By that point, typical interactions, tasks, and processes are already becoming clear. After about a month, accuracy continues to improve as all routine activities have had time to occur within the infrastructure (for example, employees have returned from their vacation). The module reaches its highest accuracy levels after about three months, once a comprehensive dataset has been collected to create a behavioral profile. A fixed time for training dataset collection must cover a variety of legitimate working modes (remote work, in-office work, weekends, holidays), and all types of tasks performed by the employee.
- Training the model on the data, unless the model has been pre-trained.
- Defining sensitivity thresholds to detect anomalies based on deviations from normal values. A low sensitivity threshold will only detect major deviations, while a high sensitivity threshold may flag even minor irregularities as potentially dangerous. In other words, lower sensitivity reduces the number of incidents to analyze, but risks missing stealthy attackers. In contrast, higher sensitivity can result in more false positives. Determining the optimal sensitivity level is a key aspect of implementing an ML-based solution.
- Recognizing behavior and detecting anomalies. Once trained, the model monitors system activity, identifying behavioral patterns and comparing them against the established norm. Various approaches and models may be used in this process. Examples:
- A statistical approach to detect suspicious activity on a host. If a workstation has always had just one user, and a second one suddenly appears, that is an anomaly. However, if a host with thousands of daily connections suddenly gets one or two more than usual, that is just a minor deviation, not a security incident.
A recommendation-based approach to detect atypical processes initiated by a user. Recommender systems were originally created as a class of machine-learning algorithms that recommend products or content to users. Based on the preferences of similar users, such systems should predict items likely to interest a certain customer. In the BAD module, this approach has been adapted for cybersecurity purposes: users take the place of customers, and processes replace products. Users in similar roles tend to run similar processes, so if a coder installs a new IDE (integrated development environment) they have never used before, the recommendation model may still consider this normal. Since other coders have used similar code editors, this is not flagged as anomalous. However, it is a whole different story if, say, an accountant runs reconnaissance utilities on their machine. The recommendation system will determine that this process does not match the user profile, and thus can flag the behavior as anomalous.
- Log analysis for detecting malware during dynamic file analysis. Just like in dynamic code analysis described earlier, dynamic file analysis involves executing the object in an isolated virtual environment, recording its behavior logs, and checking them. AI enhances the capabilities of traditional rule-based checks. For example, in PT Sandbox, behavioral trace analysis helps detect atypical malware.
- Network traffic filtering based on various criteria and metrics, such as the volume of data transferred between certain network nodes over specified time intervals or traffic volumes. For instance, using a User Profiling Rule (UPR), PT NAD detects a large data upload to an external cloud storage service in real traffic during the evening on a weekend. The activity turns out to be legitimate, but it could have indicated data exfiltration by an attacker.
- Analysis of the request parameters to detect DDoS attacks. A model trained on normal web application behavior can analyze various aspects of incoming requests, such as header signatures, source geography, and request rate. An anti-DDoS system enhanced with a behavioral analysis module can instantly filter and block potentially malicious requests with anomalous parameters.
- Human verification. An information security engineer checks whether the model worked correctly and whether the anomaly actually points to a security incident.
In the future, behavioral analysis technology may evolve to not only track user actions but also build a full biometric profile. A profile like that could include parameters such as typical mouse movements or the rhythm of keystrokes in specific applications. By monitoring user behavior and comparing it against the profile, the security system can verify whether it is the actual employee working at the computer.
Detecting threats in network traffic
Artificial intelligence can be used to analyze network traffic not just for behavioral anomalies, but also to detect malware activity and threats in HTTP sessions.
For example, a machine learning model can be trained on indicators typical of malicious content in HTTP traffic. Once trained, the model will scan HTTP sessions for these indicators and flag potential threats. This kind of ML solution helps detect new malware that is left undetected by expert-defined rules. One such model, expected in an upcoming release of PT Sandbox, has already detected several unknown threats during testing. However, it is important to note that ML solutions are not replacing expert rules any time soon. Rather, they will complement and enhance them, improving the ability to detect even new, previously unseen threats.
Another specific example of threat detection in HTTP traffic is detecting web shells. Web shells are malicious command interfaces used for controlling erb servers remotely. They must be distinguished from legitimate traffic, and full detection requires analyzing both requests and responses. Detecting web shells at the request stage helps block them before they are uploaded, while analyzing responses helps catch active ones. The ML models that detect web shells in PT Application Firewall are trained on open-source data and examples from the Standoff cyberbattles, which not only boosts detection by about 30% compared to traditional rule-based approaches, but also helps uncover new web shells.
Machine learning can also help detect encrypted communications between malware and C&C servers in network traffic. Malware can encrypt its communication sessions to evade security tools, sometimes using the same methods as legitimate apps like Telegram to bypass restrictions. By learning to analyze indirect signs, such as TCP packet length patterns, it is possible to accurately distinguish between malicious and legitimate traffic. This approach is especially effective because it is hard for attackers to change their basic obfuscation methods. Modifying a tool to evade detection costs attackers time and effort, slowing down their hacking attempts.
Detecting unknown threats
A major strength of AI in cybersecurity is its ability to uncover previously unknown threats. For instance, the BAD module in MaxPatrol SIEM can detect attacks that are not covered by existing correlation rules. AI technology can spot zero-day vulnerability exploits and unknown malware by analyzing anomalies and potentially dangerous patterns of activity.
The behavioral ML module in PT Sandbox has already shown it can detect novel threats on multiple occasions. For example, during one Standoff cyberbattle, attackers ran malware that launched a chain of 100 subprocesses before doing anything else. The ML model picked up this odd behavior, even though the product contained no classic signature existed for it. Static analysis methods struggle to catch brand-new malware that is still unknown to security systems—especially when attackers are constantly switching methods and masking their attacks by obfuscating files or sending them from compromised trusted accounts. Behavioral analysis tools will still flag them as threats, helping keep organizations protected.
Detecting phishing and harmful content
Social engineering remains one of cybercriminals' main methods in 2024. It was used in every second attack on organizations and the most common (61%) method of attacking organizations in the Middle East. Moreover, phishing emails served as the delivery channel in 42% of malware attacks. Cybercriminals are skilled at manipulating victims' emotions to achieve their goals, so employee training alone is not enough to prevent phishing—anyone can make a mistake and overlook a malicious email.
One potential software-based method for phishing protection is the use of AI technology, which researchers have already demonstrated to be potentially effective. AI can analyze not just the content of an email but also contextual features, such as its length or the properties of attachments. In the early stages of deployment, a system like that could potentially detect suspicious emails and warn the user. Once it reaches a company-defined accuracy threshold, it could begin blocking dangerous messages outright.
AI is emerging not only on the defense side—cybercriminals are also eager to use new technology in attacks. In our report, we discussed how the biggest success that cybercriminals have had applying AI is in social engineering. With generative AI, they automate phishing and bot content generation, and are enhancing classic social engineering attacks with deepfakes. AI-generated content is constantly evolving, making it increasingly difficult to spot with the naked eye. AI-powered detection of AI-generated content can help here. Researchers have already demonstrated the potential effectiveness of this technology, and we are starting to see them enter the market. One possible way to make generated content easier to detect would be for legitimate and responsible developers of generative models to agree to embed watermarks into graphic and audio content their models generate. However, text remains problematic as there is currently no way to reliably mark it—not to mention the potential for cybercriminals to create their own generative tools, free from any restrictions or safeguards.
Another potential application of AI in content recognition is the detection of dangerous websites. With AI-powered technology, the contents of a web page can be analyzed in real time, just as the user is about to visit it. If harmful content is detected, access to the site can be blocked before the user even lands on the page. This kind of system can be used to build protection against phishing sites, potentially dangerous websites, or those not suitable for viting on corporate devices.
In any case, it is essential to remain vigilant and learn how to spot social engineering tactics without AI assistance. We recommend that upon receiving any message, email, or call, you ask yourself a few simple questions:
1. Is this an inconvenient time? Am I on vacation or about to finish my working day? Is it the weekend?
2. Is the message trying to pressure me with urgency, importance, or authority? Does it communicate something critically important, scary, or beneficial to me personally?
3. Are there any spelling or punctuation errors? Are any job titles or company names incorrect?
4. Is the message impersonal, without mentioning names?
5. Is the text clumsy? Does it contain repetitions?
6. Does it include attachments, links, or QR codes?
If the answer to any of these questions is "Yes", this may be a phishing message.
What to do:
1. Take a five-minute break and calmly assess the situation.
2. Verify the information in the message through other channels: contact the sender by phone or email directly, or search the web for the organization's website or the promotional campaign.
3. If the message seems suspicious, report it to the security department.
The security team will guide you on the next steps. We recommend that security teams conduct internal phishing recognition training and cyberexercises. All employees should be informed that they may receive phishing emails without warning at any time. Employees must avoid clicking links in these emails, instead forwarding them to the security team. Sending this type of emails from time to time prepares employees for potential real attacks, and their response will be a clear indication of the organization's readiness to defend against phishing attacks. We suggest varying the topics of these phishing emails, referencing global events, local company activities, or universal phishing themes. Knowing about these cyberexercises will encourage employees to treat each message with caution and report any suspicious ones to the security team, which will help catch genuinely harmful emails. Phishing is not limited to emails, messengers, and websites—scammers have already expanded their arsenal with deepfakes, which means we need to learn to recognize them too. Alongside the basic questions and tips, here are some signs of deepfakes to watch for:
1. A change in the manner of speaking and sound (especially at junctions between phrases), and unusual vocabulary can be signs of an artificially generated audio track.
2. In videos, fakes may be detectedf from unnatural body and facial movements, such as the mouth (deepfakes often do a poor job of representing teeth) or eyes (unnatural pupil movement and blinking).
3. Poor recording or call quality can be an indirect sign of a deepfake. Cybercriminals mask flaws in generated voice and video with supposedly poor connection quality. It is always best to verify received information through another channel—but a scammer can also be exposed early by asking a verification question that only the real person would know. The question can be anything—like what we had for lunch yesterday, or which TV show we discussed last week. The scammer will not know the answer, giving themselves away.
The future of AI in defense
Heat maps of tactics and techniques as presented in the MITRE D3FEND and ATT&CK matrices
To evaluate which defensive tactics and techniques are using AI technology, we analyzed the MITRE D3FEND matrix.
Tactics are seven high-level categories of defensive actions, roughly following a chronological order: Model, Harden, Detect, Isolate, Deceive, Evict and Restore. Technique categories are the columns in the matrix that list actions and methods linked by a unified security process. For example, the tactic D3-UBA: User Behavior Analysis describes the process of detecting abnormal user behavior compared to a typical work profile. Techniques are the elements within the columns that describe specific defensive actions and methods. For example, the User Behavior Analysis tactic includes the technique D3-UDTA: User Data Transfer Analysis. This technique refers to analyzing the volume of data transferred by a user, which can be used to detect abnormal, potentially unauthorized activity.
We have created a heat map highlighting which tactics, techniques, and sub-techniques already utilize AI or could potentially use it in the future. Artificial intelligence technology is already being applied across a wide range of information security tasks (four out of seven tactics).
We have divided all the tactics and techniques into three levels, based on whether they use AI-powered technology:
Blue: AI is already in use. This group includes 28% of the techniques, with the Detect tactic being the most covered—one of the strongest and most promising areas for AI use in cybersecurity. This includes analyzing user behavior, network traffic, and actions executed by files.
Light Blue: AI can be applied. This category includes 27% of techniques where AI can be applied, but real-world solutions are still in various stages of development. Examples include the Deceive tactic (AI can generate various traps and decoys or imitate user activity) or the technique category D3-NM: Network Mapping: in the future, AI could be used to gather network information, build a complete map, and detect shadow IT.
Gray: the use of AI is not justified or would not provide significant benefits. The potential for AI use in information security is immense, but even as technology becomes more sophisticated, there remain areas it cannot reach—such as physically verifying the connectivity of network nodes (D3-DPLM: Direct Physical Link Mapping).
The MITRE D3FEND knowledge graph is closely linked with the MITRE ATT&CK matrix: most defensive techniques are listed next to the attack techniques they defend against. Based on these connections between attack methods and defensive countermeasures, we have created a heat map that aligns defensive techniques enhanced with AI technology with each attack technique. It is immediately clear that 100% of ATT&CK tactics and 65% of techniques will be covered by D3FEND techniques that can incorporate AI.
2025: The year of agents
In early 2025, a clear trend had emerged toward the use of multi-agent systems (MAS), in which several interacting agents are employed to solve a task. The main advantages of such systems over single-agent ones are modularity and specialization in narrow tasks:
In early 2025, a clear trend had emerged toward the use of multi-agent systems (MAS), in which several interacting agents are employed to solve a task. The main advantages of such systems over single-agent ones are modularity and specialization in narrow tasks:
The specialization of agents in specific tasks in the multi-agent approach means workload can be efficiently distributed among modules with expertise in particular domains. This helps avoid problems seen in single-agent systems where all tasks are directed to a single general-purpose agent.
This trend can also be seen in the field of cybersecurity: in our research on the use of AI in cyberattacks, we already mentioned an experimental multi-agent system for vulnerability exploitation—but there are so many more possibilities here. For example, multi-agent systems can simulate the actions of defenders and attackers to practice incident response scenarios, and different agents can be distributed across the network to detect DDoS-type attacks.
However, the multi-agent approach comes with challenges:
A multi-agent system is more complex to configure, since it is necessary to check and refine the results not only of the entire system but of each individual agent;
If resource-intensive models are used for each agent, increasing the number of agents will lead to a significant load on computing resources.
Autopilots
The ultimate goal of implementing AI-powered technology in cybersecurity is to create an autopilot. This can both increase the speed of incident response and significantly reduce employees' workloads. This makes autopilot defenses especially relevant in a context of workforce shortages and a growing number of cyberattacks—all the more so as cybercriminals have already begun experimenting with automated attacks using AI.
Autopiloting can be introduced gradually at different levels for various tasks. At a minimum, an autopilot can be a digital clone of an individual employee or team, learning from their actions and repeating them in similar situations. This system can promptly suggest and carry out standard solutions to routine tasks. The next stage of development is a full-fledged autopilot that detects and stops cybercriminal activity, guided by the expertise embedded in the system. This is how MaxPatrol O2 operates. In the future, we might even see the reverse scenario, where autopilots participate in training cybersecurity newcomers, acting as mentors that respond appropriately to attacks.
The effectiveness of the AI-powered autopilot concept has already been confirmed by MaxPatrol O2. At the Standoff 13 cyberbattle, the metaproduct prevented hackers from breaking into a replica of Positive Technologies' infrastructure. The autopilot for result-driven security operated in response mode—detecting and stopping attacks before these damage the digital twins of key Positive Technologies systems.
Cyber-range modeling
With generative AI, it is potentially possible to automate the creation of digital clones This kind of digital twin can be used as a cyber-range for security testing, attack simulation, and assessing the impact of proposed changes. Generating a digital twin would require significantly less time and money than creating a copy manually, making this a much more accessible method of testing security.
In addition to test cyber-ranges, creation of decoys that imitate user or system behavior (as in the Deceive tactic of the MITRE D3FEND matrix) could be an interesting area to apply generative AI in. AI can generate artificial network traffic or simulate user behavior on the network. With time, these decoys will become more realistic—and therefore more effective, as their main purpose is to deceive the attacker and divert their attention.