Key Insights
A new attack technique gets published on a Tuesday morning. How long until your team can detect it in your own environment?
For many security engineering teams, the answer is weeks. Someone reads the write-up, translates it into a query language, tests it against production data, tunes out the false positives, gets it reviewed, and ships it.
Attackers have stopped waiting that long. The CrowdStrike 2026 Threat Hunting Report found that 88% of observed exploitation of vulnerabilities with a public proof of concept happened within 48 hours of its release, and one Belarus-nexus group was caught exploiting CVE-2026-31431 just over 20 hours after disclosure. CrowdStrike's Global Threat Report adds that AI-enabled adversaries increased operations 89% year over year.
The race isn't against every new CVE. VulnCheck data reported by Cybernews shows only 14 of 1,061 AI-discovered vulnerabilities, about 1.3%, have confirmed exploitation. It's against the few that get used, and those get used fast.
Software engineering already went through this shift, as coding assistants turned days of work into hours. Security engineering can follow, if the architecture underneath supports it. Here are the five layers, in the order they depend on each other.
Layer 1: One Identity Context
Every detection and every investigation eventually asks "who is this, and is this normal for them?" If answering means stitching together your identity provider, HR system, cloud accounts, and SaaS logs by hand, everything downstream is slow.
The foundation is a single graph of identities, human and non-human, with their relationships, permissions, owners, and, where available, behavioral history. This is the context that makes an AI model useful instead of generic.
Layer 2: Queryable Behavioral Streams
Security teams sit on large volumes of behavioral events across email, identity, SaaS, and cloud, and much of it is searchable only through slow, separate consoles. The second layer makes those streams queryable together, joined to the identity graph, fast enough to support back-and-forth investigation.
Layer 3: A Security Harness for AI
The third layer is a harness: a model, the tools it can call, and the guardrails that govern it, set up for defensive work. It should be able to query the streams, walk the identity graph, draft and test detection logic, and explain its reasoning. It has to be allowed to think like an attacker, because investigation requires it, and limited to acting within boundaries the team sets.
Layer 4: Detection as Code, on a Fast Loop
With the first three layers in place, detection engineering becomes a tight loop. An engineer describes the behavior to detect in plain language. The harness drafts the logic. The team replays it against historical data, including the loudest legitimate day on record, and sees how often it would have fired. The engineer reviews, adjusts, and deploys.
The replay step is what makes speed safe. A detection that fires on normal business traffic will be ignored within a week. Testing against real normal traffic before shipping is the difference between fast and reckless.
Layer 5: Pre-Authorized Response
The last layer closes the loop. Decide in advance which actions can happen without a human when a detection fires with high confidence: revoke a session, rotate a credential, isolate a workload. Keep the list short and reversible. Humans set the policy and review every action afterward.
This is the layer that turns precision into time. A detection that ends in a ticket waits for someone to read it. A pre-authorized action lands inside the attacker's breakout window. The automation is the easy part. Agreeing before the incident on which actions are safe to take without asking takes longer.
Three Numbers That Show Whether Your SOC Is Ready
Three numbers are a good place to start when it comes to your SOC:
Time from new technique to deployed detection, which should move from weeks toward hours.
False-positive rate on replayed legitimate traffic, which should approach zero before anything ships.
Time from detection to containment, which needs to land inside breakout time.
Then ask one question: if a new technique dropped tomorrow morning, which of the five layers would slow your team down most? Fix that one first. The rest of the stack only moves as fast as its slowest layer.
We track how AI is changing both attacks and security operations. Our AI security resource hub collects our latest research, guides, and analysis in one place.
Get the Latest in AI Security