How AI Can Detect Attacks That Follow the Rules

Consider a hypothetical intrusion that begins at 02:14am, when a VPN session authenticates with valid credentials and a successful MFA challenge. Five minutes later, at 02:19am, the same account opens SMB sessions to four file servers over TCP 445, all permitted by policy. By 02:40am, it has queried Active Directory for privileged group membership and reached a hypervisor management interface it has never touched before. Although the firewall logged every session as allowed, the identity provider recorded a clean sign-in, and the EDR agent raised no alert, an attacker was already moving through the network without any individual control flagging the activity.

Individual controls can work as configured while missing the broader pattern of an emerging attack, because each assesses a different aspect of the activity. Static firewall rules determine whether a connection is permitted and signature-based detection looks for known patterns of malicious activity, but neither establishes on its own whether permitted activity makes sense in the wider context.

Most enterprises already collect data that can help answer that question, but connecting those observations quickly enough to act before an intrusion causes wider damage remains a challenge. AI can help teams interpret the data they already have and make better decisions about how to respond.

Why Rule-Based Network Security Misses Legitimate-Looking Attacks

Next-generation firewalls remain fundamental, but attackers with valid credentials can reach applications through connections permitted by their rules. Even a successful MFA challenge does not establish that a sign-in was legitimate, since push fatigue, session token theft, and adversary-in-the-middle phishing can undermine authentication security without necessarily triggering an alert. A compromised workload may also communicate with another internal server over a permitted protocol, or data may leave through a sanctioned application. Techniques such as Valid Accounts (T1078) and Remote Services (T1021), documented in the MITRE ATT&CK Enterprise Matrix, illustrate how attackers can operate within configured access rules while exposing the business to an attack.

Hybrid cloud complicates detection because a model trained in the previous environment may flag legitimate traffic as anomalous following a migration. Retraining too quickly, however, risks treating a misconfiguration or unauthorized path in the new environment as part of the accepted baseline.

A workload moved to Azure, for example, may receive new private IP ranges, route through hub-and-spoke peering, access PaaS services through private endpoints, and inherit network security group rules. These changes alter the peers, paths, and ports used by a detection model, even when the workload’s business function remains the same.

Approved change records, dependency maps, and workload ownership can help teams distinguish planned changes from behavior that needs investigation. Including this context in detection reduces the need to choose between excessive alerts during migrations and a baseline that quietly absorbs risk.

What Predictive Threat Detection Can Realistically Deliver

The practical purpose of predictive threat detection is to recognize patterns of an emerging threat before traditional controls produce a definitive alert, rather than to provide a reliable forecast of when or where an attack will occur.

When a server that normally communicates with three backend systems suddenly connects to fifteen more, the change could reflect a deployment, maintenance, or reconnaissance. An AI-assisted system can help distinguish between these possibilities by assessing the change against the server’s history, recent authentication events, endpoint posture, and asset criticality.

Useful behavioral indicators include the number of distinct internal destinations an entity contacts per hour, the proportion of peers it has not contacted before, and first-seen ports or protocols. Other signals include unusual outbound volume and the use of administrative protocols such as RDP, SSH, WinRM, or LDAP by hosts that do not normally use them. Baselines work best at both entity and peer-group level: a domain controller should be compared with its own history and with other domain controllers, rather than with a typical laptop.

An unusual connection needs to be assessed in context, particularly when a sudden spread of connections to sensitive systems coincides with a suspicious sign-in and departs from the expected behavior of that user, device, or workload.

Behavioral analysis can also support Zero Trust by informing access decisions that account for more than network location, as described in NIST SP 800-207 and the CISA Zero Trust Maturity Model. Behavioral risk signals can prompt changes after login, such as step-up authentication or restricted access, provided leaders have defined how signals pass between platforms and which platform enforces the resulting decision.

Building AI-Driven Detection on Reliable Data and Context

Discussions about AI in security often focus on algorithms, but the quality of the underlying data can determine whether a deployment succeeds. As Corey Kaemming notes in AI-First Cybersecurity Still Depends on Getting the Fundamentals Right, AI can amplify existing weaknesses, including fragmented data.

Without reliable user identity, a firewall log shows addresses and ports without establishing who acted, while an identity platform may record sign-ins without linking them to the corresponding network sessions. Inconsistent timestamps or ingestion delays can further complicate the picture by causing a correlation engine to reconstruct events in the wrong order, even when the underlying tools work properly.

I describe an architecture for addressing these issues as Context-Aware Predictive Network Defense (CAPND), a conceptual model that has not been experimentally validated. Drawing on familiar building blocks from SIEM correlation, UEBA, risk scoring, and SOAR, it combines three elements:

• Entity resolution: Firewall, endpoint, and identity records are linked to the same user, device, or workload at the relevant time, accounting for the fact that an IP address assigned to one workload today may have belonged to another yesterday.
• Context-aware risk scoring: Models such as Isolation Forest or autoencoders identify deviations, which a risk engine then assesses against the available context.
• Graduated enforcement: Low-confidence findings are logged and moderate-confidence findings open an investigation or trigger step-up authentication, while access restrictions are reserved for high-confidence detections, with approvals, rollback, and audit records.

Conceptually, the risk engine can be expressed as Risk Score = f(Network Anomaly, Identity Risk, Endpoint Risk, Asset Criticality, Evidence Freshness), representing a calibrated combination of inputs rather than a universal formula. An endpoint alert raised five minutes before a network anomaly may provide stronger corroboration than one from three weeks earlier, although an old credential-theft alert could still be an important clue in a long-running compromise. Decay rates should therefore reflect the detection type and incident context, with the assumptions tested against past incidents.

CAPND connects decisions that often sit with different tools and teams by considering how evidence freshness affects a signal’s weight, whether migration context from approved change records explains a deviation, and who may act on the resulting score. Combining these considerations with agreed limits on automation is intended to turn a risk score into a proportionate response.

In the opening scenario, the aim would be to correlate the off-hours sign-in, SMB fan-out, and first-time hypervisor access around one identity, presenting the SOC with a single incident and its supporting evidence.

Governing AI-Driven Response Without Disrupting Operations

Automation can shorten response times for well-understood threats, but enterprise networks contain dependencies that no model fully sees. Because a single firewall rule may support several applications and a service account may run critical batch jobs, a false positive can become an operational incident.

The decision to use AI for detection should be separate from the decision to let it enforce a response, with distinct approval thresholds for each. This caution is reflected in a Surf survey of 51 senior security and IT leaders, discussed by Yonesy Núñez in What Was Found When Security Leaders Were Asked About Actual AI Adoption, in which autonomous remediation ranked among the claims leaders were most tired of hearing. Núñez also distinguishes between being open to automation and handing over control, a distinction that matters when defining what a system may do without human involvement.

Effective response depends on clear ownership of the risk thresholds at which an identity is challenged or a workload is isolated, a responsibility that rarely sits with the SOC alone. Application owners understand the business impact of interruptions, network teams know which rules support shared dependencies, and identity teams know which accounts underpin critical automation. Agreeing on decision rights before enabling automated response should put organizations in a better position to act quickly and limit disruption during an incident.

A phased rollout can limit disruption by focusing first on one problem, such as unusual east-west traffic, and running in observation mode while teams tune out recurring false positives and connect findings to incident response workflows. Automated enforcement should follow only for scenarios that have proved reliable through that process.

Detection models need governance because attackers may evade them by changing behavior gradually or poisoning training data. Access control, change management, and continuous monitoring help address these risks, consistent with the NIST AI Risk Management Framework.

Success should be measured through operational outcomes as well as model accuracy, since a model that detects nearly everything but overwhelms analysts offers limited practical value. Leaders should track precision and recall, detection latency, and how often automation interrupts legitimate work, using tests that cover migrations, encrypted traffic, and planned changes rather than relying on public intrusion datasets alone. These outcomes provide the basis for judging whether contextual analytics justify the complexity they introduce.

Progress in network security depends on understanding behavior well enough to recognize when legitimate access begins to resemble an attack, together with the engineering discipline to respond appropriately.

References

Cybersecurity and Infrastructure Security Agency. (2023). Zero trust maturity model (Version 2.0). https://www.cisa.gov/zero-trust-maturity-model

Kaemming, C. (2026, October 19). AI-first cybersecurity still depends on getting the fundamentals right. Cyber Security Tribe. https://www.cybersecuritytribe.com/articles/ai-first-cybersecurity-still-depends-on-getting-the-fundamentals-right

MITRE. (n.d.). MITRE ATT&CK: Enterprise matrix. Retrieved October 20, 2026, from https://attack.mitre.org/

National Institute of Standards and Technology. (2023). Artificial intelligence risk management framework (AI RMF 1.0) (NIST AI 100-1). https://doi.org/10.6028/NIST.AI.100-1

Núñez, Y. (2026, October 7). What was found when security leaders were asked about actual AI adoption. Cyber Security Tribe. https://www.cybersecuritytribe.com/articles/what-was-found-when-security-leaders-were-asked-about-ai-adoption

Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST SP 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207