Houston Hopkins, Abnormal AI’s CISO, describes what the AI governance baseline shift means for detection. PowerShell queries from an accounting team used to be a reliable indicator of compromise. Not anymore—accounting teams now use LLMs to generate code.
"The baseline has changed. Almost everyone looks like a developer, everyone looks like an engineer. Your entire company is now part of the engineering attack surface."
— Houston Hopkins, CISO, Abnormal AI
Behavioral playbooks built for the old baseline are no longer reliable. When the exception becomes the norm, detection has to start over.
Mike Britton, Abnormal AI’s CIO, sees the same structural shift and arrives at a different frame for it: this is where UEBA—behavioral analytics that practitioners dismissed for years as a technology that never delivered on its promise—finally becomes viable. "AI has enabled UEBA to be a reality. And I think behavior is always going to be your strongest indicator."
Average shadow AI incident costs $670K; 97% of those breached lacked proper AI access controls. (IBM 2025)
The technology needed to model baseline behavior for every identity, across every application, at production scale didn't exist a few years ago. It does now. Security teams that have written off behavioral detection because of legacy failures may be working with a different tool than the one they remember.
Harrison lands the governance argument: "It's not sexy work. But understanding the lifecycle of your human and non-human identities, knowing what's dormant, what's stale, what's active, what's too broadly connected—that's how you're supposed to secure things. Detection and response is three dollar signs. Prevention is one. I would eat prevention all day."
