3 pieces in SOC.
Eleven months after the first detailed account of an AI-orchestrated espionage campaign, agent-assisted attacks have become routine in threat reporting. A synthesis of what the year’s public reporting shows, and which defensive assumptions held up.
‘Hours saved’ is the most common way to justify security automation, and one of the least reliable. A set of measures that show whether automation is helping investigations, response and the team, with an illustrative example.
The first publicly documented espionage campaign run largely by an AI agent changes the tempo defenders should plan for. What the disclosure showed, what it didn’t, and how to adjust detection, triage and response.