Abnormal AI Targets Machine-Speed Hacks with Behavioral Baselining

Behavioral Defense for the AI-Era Attack Chain With Abnormal AI — Ai4

Ai4

Static security gateways fail against AI-driven deepfakes and session hijacking because automated intrusions exploit valid credentials, leaving continuous behavioral baselining as the only durable defense.

AI-assisted summary of Behavioral Defense for the AI-Era Attack Chain With Abnormal AI — original source. Check the original for full context.

Source published: 2026-08-18

Detailed notes

## Background Published on YouTube by Ai4 on August 18, 2026, this session features Ryan Schwartz, Senior Manager of Product Marketing at Abnormal AI. According to the page description, the presentation traces the evolution of AI-accelerated email and identity attacks, making the case for an AI-native behavioral defense framework capable of monitoring both human and non-human identities at machine speed.

## TL;DR Ryan Schwartz explains how threat actors weaponize generative AI, deepfakes, and automated reconnaissance to execute hyper-personalized social engineering and session hijacking that easily bypass static security rules. Because modern intrusions frequently exploit valid credentials and authentic email channels without deploying traditional malware signatures, defending enterprise perimeters requires establishing dynamic behavioral baselines across identity and communication data layers. The session details the mechanics of multi-stage identity compromises, breaks down emerging threat vectors in autonomous AI agents like skill corruption and benign risk, and outlines the shift toward telemetry-driven Human Risk Management.

## Atmosphere & style The presentation carries a pragmatic, tech-forward conference tone that balances sobering cyber threat intelligence with approachable humor and real-world executive anecdotes. Schwartz delivers an engaging, well-paced walkthrough that shifts smoothly from alarming live-hacking demonstrations to structured architectural blueprints. The session feels authoritative and grounded, fostering an interactive exchange with the audience as questions steer the discussion into the cutting-edge nuances of autonomous agent governance and defensive AI efficacy.

## Key takeaways - [00:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=3s) Generative AI compresses spear-phishing reconnaissance and targeted asset creation from dozens of hours into less than five minutes using open-web intelligence. - [00:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=3s) Threat actors deploy real-time voice and video deepfakes to impersonate corporate executives and bypass applicant tracking systems (ATS) as fraudulent remote job candidates. - [02:14](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=134s) Identity compromise increasingly relies on session cookie hijacking to bypass MFA challenges entirely, evading security tools focused strictly on the login perimeter. - [02:14](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=134s) Static rules and manual SOC triage cannot scale against machine-generated threats, with 87% of organizations already reporting encounters with AI-driven identity attacks. - [04:30](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=270s) AI-generated vendor attacks routinely pass SPF, DKIM, and DMARC without malicious payloads, requiring defenders to replace static IOC checks with historical behavioral baselines. - [06:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=363s) Multi-stage identity intrusions leverage help desk social engineering or voice cloning to secure legitimate credential resets, masking their presence from traditional IAM solutions. - [06:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=363s) Adversaries establish stealth persistence through automated inbox forwarding and deletion rules, creating behavioral anomalies that identity telemetry can intercept. - [10:25](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=625s) Because 91% of enterprise cyberattacks originate through email, an API-native data layer modeling communication behavior is essential for stopping machine-speed intrusions. - [12:05](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=725s) Public AI agent skill repositories introduce supply chain vulnerabilities where poisoned tools can silently exfiltrate enterprise database records to command-and-control servers. - [12:05](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=725s) AI governance must address 'benign risk,' where non-malicious agents over-index on fulfilling user prompts and unintentionally violate sensitive enterprise data boundaries. - [15:34](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=934s) Defensive AI outperforms offensive automation only when built AI-native from the data layer up, rather than bolted on as a generic third-party wrapper lacking organizational context. - [17:37](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=1057s) Human Risk Management (HRM) replaces generic compliance videos with dynamic, multi-channel simulations modeled directly on live threats intercepted within the enterprise.

## Detailed walkthrough ### [00:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=3s) The Threat Landscape in the Age of Generative AI

Ryan Schwartz opens by introducing himself as the senior manager of product marketing for new products at Abnormal AI. Joking about checking notes on his phone—"I'm a millennial, so I'm attached to it"—he pivots directly to the premise of the session: while attendees gather at Ai4 to explore what legitimate organizations can build with AI, attackers have operational needs as well. Threat actors are aggressively adopting generative AI tools to target enterprises at an unprecedented scale and speed, rendering traditional defensive solutions obsolete. The core vectors remain what they have always been—email and identity—but the execution has evolved drastically beyond the crude spam schemes of the past.

```mermaid flowchart LR accTitle: Generative AI Reconnaissance and Deepfake Weaponization Flow subgraph Recon["Automated Reconnaissance"] direction TB LLM["Generative AI LLMs (Open Web Access)"] OSINT["Rapid OSINT Scraping (Social Media & Public Data)"] LLM --> OSINT end

subgraph Weaponization["Live Weaponization"] direction TB CLONE["Real-Time Face/Voice Deepfake"] PHISH["Scalable Hyper-Personalized Phish"] OSINT --> CLONE OSINT --> PHISH end

subgraph Exploit["Target Compromise"] VIP["Enterprise VIPs / ATS IT Candidates"] CLONE --> VIP PHISH --> VIP end ```

Rather than receiving generic messages reminiscent of "a Nigerian prince a decade ago," modern targets are subjected to hyper-personalized, multi-layered attacks. A threat actor requires only a few minutes with open-internet-enabled large language models to assemble an open-source intelligence (OSINT) dossier from social platforms and public records. Schwartz highlights a striking demonstration performed during an executive roadshow by the renowned ethical hacker Freaky Clown (FC). In mere minutes from his laptop during a live presentation, FC leveraged common LLMs to scrape public intelligence on a CISO in the room, construct a dossier, extract their facial likeness, and superimpose a real-time deepfake video overlay over his own face.

- Spear-phishing reconnaissance that once demanded 16 to 40 hours of manual research to target a high-profile VIP can now be completed in under 5 minutes. - Nation-state operatives deploy deepfake audio and video to compromise corporate applicant tracking systems (ATS), successfully posing as legitimate remote IT candidates to secure organizational access. - Turnkey phishing-as-a-service (PhaaS) platforms now bundle generative AI text generation and cloned landing pages designed explicitly to harvest active session tokens.

---

[02:14](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=134s) Session Hijacking, MFA Bypass, and the Failure of Static Rules

Identity compromise has moved far beyond raw password theft. Attackers leverage session hijacking to siphon valid session tokens from web browsers or workplace collaboration platforms like Slack. Because applications remain persistently signed in on a device via valid session cookies, an attacker possessing an exported cookie bypasses authentication credentials altogether without ever prompting an MFA challenge. When static security appliances only monitor the initial sign-in perimeter, these intrusions fly completely under the radar.

Traditional perimeter and gateway security architectures are intrinsically ill-equipped to combat these evolving vectors. Security operations stacks that depend on static rules, regex expressions, manual tuning, and known indicators of compromise (IOCs) are easily evaded by machine-generated variations. Furthermore, the immense volume of attacks generated by automation outpaces the analysis capacity of human security operations center (SOC) analysts. As Schwartz emphasizes, human-based triage cannot scale to counter threats executing at machine velocity.

- A recent study by identity verification firm Regula revealed that 87% of surveyed organizations have already experienced AI-driven identity attacks. - Advanced threat campaigns leverage newly discovered zero-day MFA bypass techniques alongside malicious and compromised non-human identities, such as autonomous AI agents. - Attackers acquire exported valid browser session tokens on dark web forums for nominal sums or harvest them directly via intermediate reverse proxies without tripping traditional credential alarms.

---

[04:30](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=270s) Shifting from Known-Bad Indicators to Behavioral Baselines

To counter adversaries operating at machine scale, defenders must utilize AI to fight AI. The traditional paradigm of hunting for known malicious signatures must be abandoned in favor of establishing a comprehensive baseline of normal human and non-human identity behavior. When defenses monitor continuously for correlated deviations rather than relying on brittle, isolated signals (such as a single flagged IP address), attacks can be detected with high confidence even when no explicit malicious payloads or links are present.

Schwartz illustrates this with an AI-generated vendor email that circumvents every standard inspection filter. The message contains no suspicious attachments, no malicious hyperlinks, passes all domain authentication mechanisms—SPF, DKIM, and DMARC—and presents flawless contextual grammar. A standard secure email gateway (SEG) would score the transaction as completely benign because it matches zero signatures. However, under deep behavioral inspection, subtle anomalies emerge: the vendor entity is emailing from an alternate domain they do not historically use. Even if the domain was aged for months to slip past "young domain" filters, the behavioral mismatch against communication history, paired with unusual subtle urgency and conversational phrasing, confirms malicious intent.

| Inspection Vector | Traditional Rule / Signature-Based Tools | Abnormal Behavioral AI Platform | |:--- |:--- |:--- | | **Domain Authentication** | Verifies SPF, DKIM, and DMARC passes; passes clean if authentic | Detects vendor domain mismatch against historic communication baselines | | **Domain Age** | Checks domain creation date; fooled by aged attacker-owned domains | Identifies deviations from normal historical correspondence cadence | | **Message Contents** | Scans for known malware payloads, blacklisted URLs, or suspicious keywords | Evaluates natural language tone, anomalous urgency, and semantic context | | **Remediation Speed** | Depends on SOC triage queues, manual alert correlation, or delayed blacklists | Executes automated API-driven inbox extraction before user interaction occurs |

---

[06:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=363s) Deconstructing the Multi-Stage Identity Attack Chain

Turning to full identity intrusions, Schwartz examines an attack chain pattern popularized in high-profile breaches, such as the social engineering incidents that struck major Las Vegas casinos. An attacker begins by calling an enterprise IT help desk, either relying on phone-based social engineering or deploying a real-time deepfake voice clone of an employee. By convincing the help desk technician to reset a password or register a brand-new multi-factor authentication (MFA) device, the threat actor secures legitimate credentials. Because the sign-in leverages genuine access credentials rather than an exploit, traditional identity access management (IAM) solutions raise no warnings.

```mermaid flowchart TD accTitle: Multi-Stage Identity Attack Chain vs Behavioral AI Detections subgraph AttackChain["Attacker Intrusions"] direction TB A1["Help Desk Social Engineering (Voice Deepfake / Reset Ticket)"] A2["Session Hijacking / Dark Web Cookie (MFA Bypass)"] A3["Privilege Exploitation (VIP/Admin Targeted Directly)"] A4["Persistence via Mailbox Rules (Auto-Delete Inbound Mails)"] A1 --> A2 --> A3 --> A4 end

subgraph DefenseDetections["Behavioral AI Countermeasures"] direction TB D1["Caller Phone, Device & IP Anomaly Compared to Baseline Profile"] D2["Unknown Device & ISP Utilizing Pre-Satisfied MFA State"] D3["Identity Baseline Flags Sudden Access to Uncorrelated Sensitive Resources"] D4["Anomalous Inbox Forward/Delete Rule Flagged as Telltale Persistence"] D1 -. Correlates With.-> D2 D2 -. Correlates With.-> D3 D3 -. Correlates With.-> D4 end ```

Once inside, an attacker targeting an established privileged or VIP identity avoids the noisy lateral movement and privilege escalation maneuvers that typically trigger alarms inside a security information and event management (SIEM) pipeline. Instead, they pivot to establish persistence, often leveraging the newly bound MFA device or modifying internal configurations to cover their tracks.

Behavioral defense identifies each phase of this chain by evaluating subtle contextual inconsistencies across disparate identity touchpoints:

- **Help Desk Ingestion:** Correlating the inbound help desk call or service ticket against the user's registered phone number, device fingerprint, and known network subnet reveals that the reset request originated from an unassociated source. - **Authentication Anomalies:** Post-reset logins exhibit subtle mismatches, such as an unfamiliar internet service provider (ISP), an incongruous operating system, or an unusual time-of-day access pattern. - **Session Hijack Discovery:** When an active session token is used from a completely new physical location or unauthorized device while claiming a previously satisfied MFA state, behavioral telemetry flags the impossible travel and context shift as session theft. - **Persistence Footprints:** Adversaries routinely configure automated inbox forwarding or filtering rules designed to delete incoming messages silently, concealing warning emails from IT. Schwartz remarks that while deleting every work email is an urge many workers playfully relate to—"sometimes I want to, but that's not something I would typically do on a given workday"—in reality, it serves as an unmistakable behavioral indicator of compromise that behavioral AI catches and neutralizes.

[10:25](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=625s) AI-Native Behavioral Defense Architecture

To effectively solve the modern attack chain, security architectures must be fundamentally AI-native and API-native. A massive ingestion capability is required at the base to build a rich data layer used for behavioral baselining and anomaly detection. This architecture consolidates disparate data streams into unified context across email security, identity governance, AI governance, and insider threat detection. Abnormal Security was established as an AI-native security company specifically to tackle these enterprise challenges, starting with the primary entry point: email. CISA data shows that 91% of cyberattacks still originate via email, making baseline behavioral modeling across communications essential.

```mermaid flowchart TD accTitle: Abnormal AI Behavioral Defense Architecture accDescription: Architectural pipeline showing data ingestion flowing through AI-native behavioral baselining to unified threat detection.

subgraph INGEST ["1. API-Native Ingestion Layer"] D1["Email & Communications"] D2["Identity Providers & IdP Logs"] D3["SaaS Applications & Audit Trails"] D4["AI Agent & Non-Human Identity Telemetry"] end

subgraph ENGINE ["2. AI-Native Behavioral Engine"] B1["Baseline Normal Behavior"] B2["Cross-Correlate Deviations & Anomalies"] end

subgraph DOMAINS ["3. Unified Detection & Response"] T1["Email Security"] T2["Identity & Account Takeover Defense"] T3["AI Security & Governance"] T4["Insider Threat Detection"] end

INGEST --> ENGINE ENGINE --> DOMAINS ```

Abnormal acts as the foundational data layer by baselining what normal activity looks like for every identity and system. It detects attacker presence by cross-correlating malicious communication patterns, suspicious sign-in telemetry, and subtle audit log deviations. The core thesis remains clear: "the only way to stop attackers armed with AI is with behavioral AI to be able to uncover their patterns."

- CISA statistics indicate that 91% of all enterprise cyberattacks still start through email communications. - Comprehensive threat baselining correlates malicious communication signals, suspicious authentication anomalies, and unexpected audit log variations. - Abnormal showcased these solutions across Black Hat and booth 1559 at Ai4.

---

[12:05](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=725s) Emerging Risks in AI Agents: Skill Corruption and Benign Risk

During the audience Q&A, a question arose regarding agent-to-agent interactions, particularly in retail and B2C e-commerce environments, and whether autonomous agents heighten data exfiltration risks. While enterprise defense often focuses on B2B infrastructure, autonomous agent interactions introduce serious new attack vectors. One primary concern is agent corruption through public skill repositories (such as integrations developed for Anthropic ecosystems). Attackers can silently embed malicious logic inside a public skill or tool, siphoning sensitive enterprise data back to attacker-controlled command-and-control domains without the user's awareness.

```mermaid flowchart LR accTitle: Agent Corruption and Data Exfiltration Flow accDescription: Flowchart illustrating how a compromised skill repository enables data exfiltration from enterprise systems.

subgraph REPO ["Skill Repositories"] S1["Compromised Public Skill / Tool"] end

subgraph EXECUTION ["Enterprise AI Execution"] A1["Autonomous AI Agent"] D1["Internal Enterprise Database"] end

subgraph THREAT ["Exfiltration"] AT["Attacker Domain"] end

S1 -->|"Injected into"| A1 A1 -->|"Accesses Data"| D1 A1 -.->|"Silently Siphons Data"| AT ```

To counter this, security vendors at Black Hat have focused on sandboxing or "exploding" skills before an AI agent ingests or executes them. Securing agents also demands robust AI governance: tracking agent ownership, auditing invocation prompts, establishing strict guardrails, and limiting database permissions. Beyond deliberate malice, enterprises face "benign risk"—a phenomenon where an agent, operating without adversarial intent, aggressively bypasses data boundaries or compromises sensitive databases simply to fulfill its assigned prompt instructions.

- Skill repository corruption allows hidden code to siphon enterprise data to external attacker domains during standard tool calls. - Sandboxing technologies ("exploding a skill") evaluate external agent capabilities before execution. - Benign risk occurs when an AI agent over-indexes on task completion, unintentionally exposing sensitive databases due to overly broad permissions.

---

[15:34](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=934s) AI for Offense vs. AI for Defense

An audience member raised a perspective heard in security circles: that AI excels at offensive operations (such as automated penetration testing and red teaming) but underperforms in defensive roles. The speaker challenged this framing, arguing that the discrepancy stems from legacy security products merely "bolting on" a generic third-party AI layer. Those add-ons lack the deep organizational telemetry and continuous behavioral context required to make high-fidelity detections.

Truly effective defensive AI must be AI-native from inception. The defensive efficacy of a model depends directly on the breadth of data ingested and how that data is structured for baselining. When an AI security engine understands normal organizational patterns across human identities, non-human accounts, and communication flows, defensive AI possesses a structural advantage in spotting the deviations left behind by machine-speed attacks.

- Bolted-on AI layers fail because they lack historical context and behavioral baselines. - Purpose-built AI-native platforms outpace generic AI wrappers by combining extensive telemetry pipelines with domain-specific cybersecurity models.

---

[17:37](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=1057s) Reimagining Human Risk Management with Real-World AI Scenarios

A former consultant in the audience noted that across 95% of enterprise clients, security education programs fail to prevent users from falling victim to social engineering as attack surfaces accelerate. When asked how Abnormal addresses the human education component, the speaker outlined the shift from legacy security awareness training to modern Human Risk Management (HRM).

Traditional security training relies on static video modules and canned, generic phishing templates that yield little actionable behavioral improvement beyond tracking uninformative click rates. Abnormal’s approach leverages AI to generate dynamic simulations derived directly from actual, neutralized threats that have targeted the organization or specific employees. By exposing staff to realistic social engineering tactics—including multi-stage campaigns threading email phishing, smishing, vishing, and deepfakes—enterprises measure genuine behavioral change based on actual environmental threat profiles rather than artificial compliance metrics.

- Legacy awareness training over-indexes on simplistic click rates and generic video templates that fail to change habits. - Human Risk Management (HRM) builds dynamic simulations based on real attacks intercepted in the customer's live environment. - Modern simulations incorporate multi-channel attack vectors, combining email phishing, SMS smishing, voice calls, and deepfake impersonations into coordinated exercises.

## Notable quotes > [00:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=3s) I'm a millennial, so I'm attached to it — Ryan Schwartz

> [00:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=3s) a Nigerian prince a decade ago — Ryan Schwartz

> [06:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=363s) sometimes I want to, but that's not something I would typically do on a given workday — Ryan Schwartz

> [10:25](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=625s) the only way to stop attackers armed with AI is with behavioral AI to be able to uncover their patterns. — Ryan Schwartz

> AI has given attackers the speed, scale, and sophistication to move through an enterprise before defenders even know they're in. — Ryan Schwartz

> The rapid adoption of AI agents, OAuth-connected integrations, and cross-platform automation has created attack surface that most security stacks weren't built to monitor. — Ryan Schwartz

> The only durable defense is behavioral: modeling what normal looks like for every human and non-human identity, then surfacing the deviations that signal compromise. — Ryan Schwartz

> A practical framework for reasoning about AI-era risk and what it actually takes to defend against threats that move at machine speed. — Ryan Schwartz

## Mentioned Ryan Schwartz, Abnormal AI, Abnormal Security, Ai4, Freaky Clown (FC), Regula, Cybersecurity and Infrastructure Security Agency (CISA), Slack, Anthropic, Black Hat

## Video description Ryan Schwartz - Senior Manager, Product Marketing, Abnormal AI

AI has given attackers the speed, scale, and sophistication to move through an enterprise before defenders even know they're in. At the same time, the rapid adoption of AI agents, OAuth-connected integrations, and cross-platform automation has created attack surface that most security stacks weren't built to monitor.

This session traces the evolution of email-borne threats and identity-based attacks—from bulk phishing and stolen credentials to AI-generated social engineering, compromised identity providers, and multi-stage intrusions that pivot across SaaS applications and non-human identities. We'll make the case that the only durable defense is behavioral: modeling what normal looks like for every human and non-human identity, then surfacing the deviations that signal compromise. Attendees will leave with a practical framework for reasoning about AI-era risk and what it actually takes to defend against threats that move at machine speed.

[Source](https://www.youtube.com/watch?v=qhwBUhKBBNg)

中文简报

Abnormal AI 利用行为基线化防御机器级速度攻击面对 AI 驱动的深度伪造与会话劫持，静态安全网关往往失效，因为自动化入侵利用的是有效凭据，这使得持续的行为基线化成为唯一持久的防御手段。 Ryan Schwartz 解释了威胁分子如何将生成式 AI、深度伪造以及自动化侦察武器化，从而实施能够轻易绕过静态安全规则的高度个性化社会工程攻击和会话劫持。鉴于现代入侵通常利用有效凭据和真实电子邮件渠道，而不部署传统恶意软件特征，企业边界防御需要在身份和通信数据层建立动态行为基线。本场分享详细分析了多阶段身份失陷的机制，剖析了自主 AI 智能体中技能损坏（skill corruption）和良性风险等新兴威胁载体，并概述了向遥测驱动的人为风险管理（Human Risk Management）转型的路径。生成式 AI 利用开放网络情报，将鱼叉式钓鱼的侦察及针对性物料制作时间从数十小时压缩至五分钟以内。 (0:03) 威胁分子部署实时语音和视频深度伪造来冒充企业高管，并作为欺诈性远程求职候选人绕过申请人跟踪系统（ATS）。 (0:03) 身份失陷越来越依赖会话 Cookie 劫持来彻底绕过 MFA 验证，从而规避仅严格关注登录边界的安全工具。 (2:14) 静态规则与人工 SOC 分流无法应对机器生成威胁的规模，87% 的组织已报告遭遇过 AI 驱动的身份攻击。 (2:14) AI 生成的供应商攻击通常不含恶意载荷即可通过 SPF、DKIM 和 DMARC 验证，这要求防御者使用历史行为基线取代静态 IOC 检查。 (4:30)

Reading summary

Ryan Schwartz of Abnormal AI argues that generative AI enables threat actors to execute hyper-personalized reconnaissance, session hijacking, and social engineering at machine velocity, rendering static security rules obsolete. To counter these automated attack chains, organizations must shift from signature detection to AI-native behavioral baselining across communications, identity access, and autonomous agent environments. Weaponization Speed and the Breakdown of Static Perimeters (0:03) Generative AI has radically compressed offensive timelines. Ryan Schwartz points out that reconnaissance for VIP spear-phishing campaigns, which previously demanded 16 to 40 hours of manual intelligence gathering, can now be executed in under 5 minutes using open-web large language models. Demonstrations by ethical hacker Freaky Clown showed real-time video deepfakes generated from live OSINT scraping within minutes, while nation-state operatives deploy audio and video clones to bypass applicant tracking systems for remote IT roles. Simultaneously, identity compromise has moved toward session hijacking, where threat actors acquire exported browser cookies to bypass multi-factor authentication (MFA) entirely without triggering credential alerts. A cited study by Regula revealed that 87% of surveyed organizations have already experienced AI-driven identity attacks. Schwartz argues that perimeter defenses relying on static rules, regular expressions, and known indicators of compromise cannot scale to match automated, machine-generated variations. Replacing Static Signatures with Behavioral Baselines (4:30) Modern AI-generated phishing frequently circumvents traditional security filters by passing SPF, DKIM, and DMARC authentication, leveraging aged domains, and omitting overt malicious links or malware payloads. Because standard secure email gateways evaluate isolated indicators, these clean-looking messages pass inspection. Schwartz asserts that defenses must instead establish comprehensive behavioral baselines for normal human and non-human identity patterns, allowing engines to identify deviations in sender domains, communication rhythms, and semantic urgency. With CISA data indicating that 91% of cyberattacks still originate through email, an AI-native data architecture is necessary to continuously ingest communication signals, identity provider logs, and SaaS audit trails. Schwartz contends that purpose-built, API-native behavioral systems hold a defensive advantage over legacy tools with bolt-on AI wrappers, as they correlate cross-vector anomalies that human security operations centers lack the capacity to manually triage. Correlating Context Across the Identity Attack Chain (6:03) Deconstructing intrusions such as the high-profile Las Vegas casino breaches, Schwartz examines how attackers exploit identity touchpoints rather than software exploits. Attackers use phone-based social engineering or real-time voice deepfakes to trick IT help desks into resetting passwords or registering new MFA devices. Once an attacker obtains legitimate access to a privileged identity, they avoid noisy lateral movement and instead establish persistence by creating automated mailbox rules that silently delete incoming administrative warnings. Behavioral AI counters this multi-stage chain by cross-referencing disparate contextual signals. The system flags discrepancies between a help desk caller's network subnet and registered profile, catches post-reset logins from uncharacteristic internet service providers or devices, identifies stolen session tokens exhibiting impossible travel anomalies, and flags stealthy inbox auto-deletion rules as active indicators of compromise. Agent Vulnerabilities and Adaptive Human Training (12:05) The rapid deployment of autonomous AI agents introduces novel risks, particularly around public skill repositories where hidden malicious code can quietly exfiltrate enterprise data during standard tool invocations. Beyond deliberate attacks, Schwartz highlights "benign risk," in which an autonomous agent granted overly broad permissions compromises internal databases unintentionally while attempting to fulfill a prompt. Security approaches discussed include sandboxing or testing external skills before execution alongside strict identity governance. Addressing the workforce attack surface, Schwartz critiques legacy security awareness training, noting that static video modules and generic phishing templates fail to alter real-world behavior. Instead, Human Risk Management uses AI to generate dynamic simulations mirrored after real, neutralized attacks intercepted within the enterprise's live environment, conditioning employees against coordinated multi-channel vectors including phishing, SMS smishing, voice calls, and deepfake impersonation. While Schwartz argues that AI-native behavioral baselining provides an architectural defense against adversaries operating at machine speed, organizations face expanding complexities as attack chains shift toward autonomous AI agents and automated session compromise, requiring continuous governance over both technical permissions and human risk.

精炼阅读摘要

Abnormal AI 新产品产品营销高级经理 Ryan Schwartz 指出，攻击者正利用生成式 AI 实现超个性化攻击、会话劫持与多阶段身份渗透，导致依赖静态规则与签名的传统防御体系失效；企业必须转向以基线行为分析为核心的 AI 原生防御架构，以机器速度对抗机器速度的威胁。生成式 AI 加速威胁武器化与传统防线失效 (0:03) 威胁组织正利用大语言模型（LLM）与自动化工具大幅缩短攻击准备周期。以往针对企业高管的鱼叉式钓鱼踩点通常需要 16 至 40 小时的手动调查，如今攻击者仅需几分钟即可借助公开网络模型抓取开源网络情报（OSINT）并构建目标档案。在行业演示中，白帽黑客 Freaky Clown 仅耗时数分钟便通过抓取现场企业安全负责人的公开数据，实时合成了面部 Deepfake 视频。此外，国家级黑客组织利用伪造的音视频绕过企业招聘系统（ATS）以冒充远程 IT 候选人，钓鱼即服务（PhaaS）平台也开始捆绑生成式 AI 文本与克隆登录页来批量窃取会话令牌。面对这种演进，基于静态规则、正则表达式和已知威胁指标（IOC）的传统边界网关防线迅速失效。身份验证机构 Regula 的调查显示，87% 的受访企业已遭遇过由 AI 驱动的身份攻击。攻击者无需攻破密码，而是直接在暗网购买有效浏览器会话 Cookie 或通过中间人反向代理窃取凭据，在绕过多因素认证（MFA）的同时不触发任何登录警报。这种以机器速度生成的攻击负载与变种，已经彻底超出了传统安全运营中心（SOC）人工分类与处理的承载极限。从已知签名转向行为基线检测 (4:30) 为应对无恶意载荷的新型入侵，安全防御必须由“寻找已知恶意特征”转变为“对正常人类与非人类身份行为建立综合基线”。Schwartz 指出，现代 AI 生成的供应商欺诈邮件能够轻松通过 SPF、DKIM 和 DMARC 等域验证标准，内容没有恶意链接或附件，且语意和语法毫无破绽，传统安全邮件网关（SEG）会直接判定其合规。然而，深度行为检测可以发现异常：发信方虽然声称是已知供应商，但使用了历史上从未见过的域名；即使攻击者提前数月注册该域名以避开新域名过滤器，系统依然能识别出其与历史通信频率的偏差，并结合语义中异乎寻常的紧迫感确认为恶意攻击。行为 AI 引擎通过实时关联多维度的细微偏差，能够在无需等待黑名单更新或人工审核的情况下，通过 API 自动在收件箱中隔离潜在威胁。这种架构将分散的单点信号（如单个异常 IP）整合为连贯的行为上下文，即便攻击者完全没有使用已知的恶意软件载荷，系统也能实现高精度的威胁阻断。解构多阶段身份攻击链与跨维度上下文关联 (6:03) 以拉斯维加斯赌场遭遇的典型攻击为例，攻击者往往首先针对 IT 帮助台发起社工呼叫，甚至利用实时语音克隆冒充员工，诱导技术人员重置密码或绑定攻击者控制的新 MFA 设备。由于登录环节使用的是合法生成的有效凭据，传统身份访问管理（IAM）系统无法察觉异常。进入内网后，攻击者倾向于直接劫持高权限特权账号，避开在安全信息和事件管理（SIEM）系统中容易报警的大范围横向移动与权限提升操作，转而通过修改配置建立持久化驻留。行为防御方案通过对全生命周期身份接触点进行上下文交叉比对来拆解这一攻击链：在请求发起端，系统会将帮助台工单与用户的既有注册电话、设备指纹及常用网段进行比对，识别不匹配的重置请求；在访问阶段，系统会捕捉异常的网络服务提供商（ISP）、操作系统与非常规登录时段；在会话阶段，检测由于跨地域或未授权设备使用已验证令牌而构成的“不可能旅行”状态；在驻留阶段，系统会严密监控攻击者静默配置的邮件自动删除或转发规则，及时阻断攻击者隐藏 IT 告警的图谋。自主智能体风险与 AI 原生防御架构构建 (10:25) 随着自主 AI 智能体进入企业业务与电商流程，攻击面进一步扩大。在公用技能库（如特定模型生态的插件库）中，攻击者可能植入恶意逻辑，使企业智能体在执行日常工具调用时将内部敏感数据外发至恶意指令控制端。此外，企业还面临“良性风险”，即智能体本身虽无对抗意图，但因权限分配过宽，在极力完成特定指令的过程中意外突破数据边界并导致敏感数据泄漏。防御此类风险需要将技能预先沙箱化运行评估，并对智能体的调用权限、身份归属及提示词进行持续治理。针对“AI 仅适用于进攻而不利于防守”的行业观点，Schwartz 强调，防守乏力的根源在于许多产品仅仅是外挂了缺乏组织上下文的第三方 AI 模型。由于网络安全中 91% 的攻击仍发端于电子邮件（CISA 数据），防御方必须构建以 API 驱动、具备深度数据摄取能力的 AI 原生架构。通过将通信记录、身份提供商日志（IdP）、SaaS 审计轨迹和非人类智能体遥测整合进统一的数据层，安全系统才能掌握全组织的正常活动基线，并转化为在攻防对抗中的结构性优势。以动态真实攻防重塑人员风险管理 (17:37) 传统安全意识培训长期依赖静态教学视频与格式化的钓鱼演练模板，行业实践显示约 95% 的此类项目无法切实防止员工在复杂社工攻击中受骗，仅仅记录了缺乏指导意义的点击率。面对日趋立体的攻击手段，企业需向新型人类风险管理（HRM）模式转型。 Abnormal 提出的 HRM 方案主张利用 AI 技术，将企业日常实际拦截并中和的真实威胁动态转化为培训场景。通过结合具体员工的威胁暴露面，系统能够跨渠道发起涵盖电子邮件钓鱼、短信钓鱼（Smishing）、电话社工（Vishing）乃至 Deepfake 仿冒的多阶段协同演练，让员工在接近真实的业务环境中建立防范能力，使安全团队基于真实行为指标而非形式化的合规测试来评估并降低人为风险。生成式 AI 已彻底重构了网络攻击的生成速度与伪装深度，使依赖已知特征和单点验证的静态安全产品失效。防御方唯一的应对路径是采用 AI 原生的行为分析架构，在邮件、身份凭据、智能体工具链与员工交互的多维上下文中建立正常基线，以此实现全局态势的主动防护。

Detailed notes — zh

## Background 本内容由 YouTube 频道 Ai4 于 2026 年 8 月 18 日发布，主讲人为 Abnormal AI 的产品营销高级经理 Ryan Schwartz。视频页面介绍指出，本场演讲探讨了 AI 时代电子邮件与身份威胁的演进，阐述攻击者如何借助 AI、OAuth 集成及自动化技术快速渗透企业，并提出通过建模人类与非人类身份的正常行为基线、捕捉异常偏离的“行为防御”实用框架来抵御机器速度的攻击。 ## TL;DR 演讲剖析了攻击者如何利用生成式 AI、自动化 OSINT 侦察和 Deepfake 将鱼叉式钓鱼的制作周期从数天压缩至几分钟，并结合 Session Token 劫持与 MFA 绕过轻松击穿传统基于已知签名和静态规则的防御体系。Ryan Schwartz 提出“以 AI 对抗 AI”的核心范式，强调通过 AI 原生与 API 原生架构对通信、身份认证和审计日志进行多维关联，建立正常行为基线以精准捕捉微小偏离。针对新兴的 AI Agent 技能投毒、红蓝对抗效果差异以及传统培训失效等挑战，分享了涵盖 AI 治理、全链路异常检测以及 AI 驱动的人类风险管理（HRM）应对策略。 ## Atmosphere & style 演讲整体呈现出专业务实、风趣幽默且兼具前瞻警示的技术宣讲氛围。主讲人以千禧一代自嘲开场，结合现场黑客实演与拉斯维加斯真实攻击案例，生动揭示了 AI 武器化带来的迫切危机感，节奏明快且极具说服力。在问答环节，主讲人条理清晰地拆解技术争议与落地痛点，给听众带来兼具思想启发与工程实操深度的现场视听体验。 ## Key takeaways - [00:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=3s) AI 极大降低了威胁攻击者的技术门槛与时间成本，针对高管（VIP）的鱼叉式钓鱼制作周期从过去的 16-40 小时缩短至仅需 5 分钟。 - [00:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=3s) 攻击者利用生成式 AI 配合公网数据可瞬间完成开源情报（OSINT）调查与 Deepfake 视频合成，实现高度逼真的社会工程学攻击。 - [01:56](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=116s) 87% 的企业已遭受过 AI 驱动的身份攻击，钓鱼即服务（PaaS）工具包被广泛用于窃取有效 Session Token，从而完全绕过多因素身份验证（MFA）。 - [01:56](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=116s) 基于已知威胁指标（IOC）、静态签名和规则过滤的传统安全体系在面对零日 MFA 绕过和高度定制化 AI 攻击时已全线失效。 - [04:30](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=270s) AI 时代的核心防御范式必须转变为“建立正常行为基线（Baselining Normal）”，通过多维关联捕捉攻击者无法完美伪造的行为偏离。 - [04:30](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=270s) 即使伪造邮件完全符合 SPF、DKIM、DMARC 且使用了合规域名，行为 AI 依然能通过历史通信关系、语调、紧迫感及发信时序进行精准拦截。 - [06:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=363s) 身份攻击链防御需要串联分析服务台重置请求、异常会话登录、跨设备 Token 劫持及后渗透收件箱规则篡改等多阶段微小破绽。 - [10:25](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=625s) 根据 CISA 数据，91% 的网络攻击仍始于电子邮件，有效的安全架构必须采用“AI 原生”与“API 原生”以打破数据孤岛进行跨域关联。 - [12:05](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=725s) AI Agent 面临“技能投毒（Skill Poisoning）”与良性失控风险，企业需要加强沙箱检测以及涵盖权限、所有权与提示词护栏的 AI 治理。 - [15:34](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=934s) 传统安全厂商在旧架构上“外挂 AI（Bolt-on AI）”缺乏业务上下文与深层行为数据积累，只有 AI 原生架构才能在防御端建立高精度行为基线。 - [17:37](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=1057s) 安全意识培训正演进为 AI 驱动的人类风险管理（HRM），通过提取真实攻击样本生成动态脱敏攻防演练，全方位加固员工这一防御层。 ## Detailed walkthrough ### [00:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=3s) AI 驱动型威胁的崛起与传统防御的困境 Abnormal AI 的新产品营销高级经理 Ryan Schwartz 登台，幽默地自嘲自己是个离不开手机看笔记的千禧一代。他指出，参会者齐聚 AI4 峰会是为了探讨企业如何应用 AI，但不可忽视的是“攻击者同样有需求”。现在的威胁攻击者正在全方位利用 AI 工具武装自己，其攻击形态与渗透速度让传统安全工具望尘莫及。攻击的核心目标依然是传统焦点——电子邮件和身份（Email & Identity）。过去十年前那种拙劣的“尼日利亚王子”式泛滥钓鱼邮件早已成为历史。如今，攻击者只需使用具备公网访问权限的生成式 AI 工具并输入几条提示词，几分钟内就能完成一份详尽的开源情报（OSINT）报告，自动化爬取目标人员的社交媒体与公开信息。Ryan 分享了一个内部经历：Abnormal AI 在面向 CISO 的巡回交流会上邀请了知名黑客 Freaky Clown 进行现场实演。Freaky Clown 仅凭个人笔记本电脑与几个主流大模型，直接在演讲的短短几分钟内，现场对台下一位听众进行实时联网背景调查，调取其个人资料，甚至当场利用 Deepfake 面部叠加技术生成了逼真的换脸视频。一旦有了这样的报告与 Prompt 体系，不仅可以批量生成高度针对性的钓鱼邮件，更能在极短时间内对组织内的所有高管（VIP）进行全方位攻击覆盖。 ```mermaid flowchart TD accTitle: AI-Driven Reconnaissance and Social Engineering Pipeline subgraph S1["情报侦察与模型提示"] A["联网生成式 AI / LLM"] --> B["自动化爬取 OSINT / 社媒公开信息"] B --> C["5 分钟内生成目标人物画像"] end subgraph S2["武器化与规避"] C --> D["Deepfake 音视频合成"] C --> E["高度定制化钓鱼诱饵"] D --> F["绕过常规内容检查与身份鉴别"] E --> F end ``` - **制作周期骤降**：过去编写一份针对核心 VIP 的高定制化鱼叉式钓鱼邮件需要耗费 16 到 40 个小时（整整一周工时），如今借助生成式 AI 仅需 5 分钟。 - **门槛被抹平**：AI 让初出茅庐的业余攻击者瞬间拥有了顶尖黑客水准的攻击与文案能力。 --- ### [01:56](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=116s) 身份攻击的进阶：Token 劫持、深度伪造与防线失效在身份攻击领域，攻击者同样利用 AI 全面升级战术，特别是“钓鱼即服务”（Phishing-as-a-Service，PaaS）工具包的大量普及。这些工具包利用 AI 生成的逼真邮件和钓鱼落地页窃取有效的会话令牌（Session Token），使攻击者完全绕过输入密码的环节。Ryan 举例说明，就像日常在笔记本电脑上登录 Slack，一旦认证成功便会持久保持在线状态，其根源在于本地生成并存储了合法 Session Token；攻击者一旦通过劫持窃取该 Token，即可长驱直入。更令人担忧的是，科幻电影般的攻击手法已经落地为现实：不仅 Deepfake 换脸伪造层出不穷，近期甚至出现外国国家级黑客（Nation-State Operatives）利用 AI 伪装身份，渗透企业的人才招聘系统（ATS），冒充合法 IT 工程师入职潜伏。传统安全防护体系之所以全线失守，是因为传统工具始终建立在“已知威胁指标”（Known Indicators of Compromise, IOC）、静态签名、规则策略与人工调优之上。攻击者借助 AI 可以轻易绕过这些死板的过滤规则；另一方面，AI 攻击的爆发式规模与海量吞吐量，已经彻底击垮了安全团队的人工研判与响应能力。 - **Regula 调研数据**：近期由 Regula 发布的报告指出，87% 的企业都经历过 AI 驱动的身份攻击。 - **MFA 绕过零日漏洞**：年内已出现针对 MFA 绕过的新型 Zero-day 攻击，配合 Deepfake 与受损的非人类身份（AI 智能体、API 账户等），实现对传统防御的全量穿透。 --- ### [04:30](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=270s) 核心防御范式转换：用行为 AI 对抗生成式 AI 面对这种态势，Ryan 强调单纯渲染恐慌毫无意义，防御之道就是“用 AI 对抗 AI”（Fight AI with AI）。有效的防御思路绝不是寻找已知的恶意指纹，因为在 AI 时代并不存在已知的恶意文件或固定特征，真正的关键在于**建立正常行为基线（Baselining Normal）**，随后通过多维事件关联，捕捉偏离基线的微小异常。防御者追求的不再是 IP 不一致等单一的粗暴模式匹配，而是识别“无法被完美伪造的行为特征”——即使攻击者的生成式 AI 再强大，也不可能日复一日地完全复刻目标个人的全面行为习惯。为了证明这一点，Ryan 展示了一封没有任何超链接、没有恶意附件载荷、完全由几句 Prompt 瞬间生成的虚假供应商邮件。这封邮件在传统邮件网关眼中毫无破绽：它完全符合 SPF、DKIM 和 DMARC 等电子邮件安全协议，甚至发信域名也是攻击者精心注册并经过数月“预热（Bake）”的合法高信誉域名，没有触发任何“拦截新建年轻域名”的规则。在旧范式下，这种攻击是完全不可见的。 ```mermaid flowchart LR accTitle: Traditional vs Behavioral Detection Model subgraph TRAD["传统检测范式（失效）"] direction TB T1["检查已知 IOC / 恶意签名"] --> T2["SPF / DKIM / DMARC 校验"] T2 --> T3["【漏报】完美伪装，直接放行"] end subgraph BEHAV["行为 AI 检测范式（Abnormal AI）"] direction TB B1["发信历史基线比对"] --> B2["语调、紧迫感、发信时间多模态关联"] B2 --> B3["【拦截】精准识别异常偏离并自动隔离"] end ``` --- ### [06:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=363s) 身份攻击链剖析与多维行为关联防御很多企业普遍存在误区，以为身份攻击仅仅源于社交工程，但实际上大多始于邮箱被攻破。例如几年前本地赌城多家赌场遭受的毁灭性黑客攻击：攻击者直接致电 IT 帮助台，凭借社工话术或声音克隆骗过客服重置密码并绑定攻击者自己的 MFA 设备，从而堂而皇之地以合法凭据长驱直入。更有甚者，通过暗网廉价购买或者钓鱼工具窃取 Session Token，全程无需认证。此时若受害者本就是高权限人员（VIP），攻击者连内网权限提升（Privilege Escalation）的警报都不会触发，且能凭借绑定的新 MFA 设备达成永久持久化（Persistence）。针对这种看似完全合法的操作，行为 AI 展现了截然不同的防护路径： ```mermaid flowchart TD accTitle: Multi-Stage Behavioral Correlation Across Identity Attack Chain subgraph Step1["阶段一：服务台重置请求"] A1["来电电话号码异常"] -. 关联基线.-> A2["与用户历史通信画像不符"] A3["请求发起的 IP / 设备基准"] -. 关联分析.-> A2 end subgraph Step2["阶段二：异常凭据登录"] A2 --> B1["运营商 ISP / 操作系统基线偏差"] B1 --> B2["非惯用登录时段与异常会话"] end subgraph Step3["阶段三：Token 滥用与持久化"] B2 --> C1["原设备已满足 MFA，突现新环境访问该 Token"] C1 --> C2["内网动作异常：突建全量邮件删除过滤规则"] end C2 --> D["触发全自动响应与账号隔离"] ``` - **邮件层面的行为穿透**：尽管伪造供应商邮件域名合规，但行为 AI 发现该发信地址并非该供应商日常与该收件人沟通所用的历史域名，同时模型在邮件文本内容中捕捉到了语气急迫感、用词习惯与发信时序的冲突。系统在用户还未点击交互前，即可完成自动化隔离补救。 - **身份全链路的微小破绽**： - **帮助台交互**：核实拨打电话的主叫号码是否为该员工登记的惯用号码，分析接入的设备类型、IP 地址与工单提交特征。 - **会话鉴权滥用**：监测到登录请求所用的操作系统（OS）、互联网服务提供商（ISP）以及登录时间段偏离其历史画像。 - **Session 劫持指纹**：检测到同一个已经完成 MFA 验证的合法会话，突然从另一台未知设备或远端网络进行访问，暴露出 Token 跨设备劫持事实。 - **后渗透潜伏动作**：攻击者得手后为了隐藏痕迹，往往会新建邮件收件箱规则来删除所有进站邮件——Ryan 笑称“虽然我有时忙得也想这么干，但这绝不是正常工作日会发生的事情”。多维特征链条闭环后，AI 即可高置信度切断非法访问。 ### [10:25](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=625s) AI 原生与 API 原生：行为基线防御与 Abnormal 的解决路径要真正解决 AI 时代攻击链的威胁，安全架构必须具备两个核心特征：**AI 原生（AI Native）** 与 **API 原生（API Native）**。由于系统必须在底层进行海量数据摄取，才能构建起用于建立基线（Baselining）并捕捉微小偏离的数据层。这些数据随后需要以多种不同维度进行重构与分析，以同时覆盖电子邮件安全、身份安全、AI 安全与治理，以及内部威胁检测（Insider Threat Detection）。 ```mermaid flowchart TD accTitle: Abnormal AI 行为防御架构 subgraph DataIngestion["API 原生数据摄取层"] A["通信模式与邮件网关"] B["身份认证与登录信号"] C["SaaS 审计日志与行为记录"] end subgraph BehavioralAI["AI 原生分析与基线建模"] D["基准线建模 (Baselining Normal)"] E["跨域信号关联与异常偏离检测"] end subgraph DefenseOutput["综合威胁判定与响应"] F["邮件安全 (Email Security)"] G["身份与 AI 治理 (Identity & AI Governance)"] H["内部威胁防御 (Insider Threat Detection)"] end DataIngestion --> BehavioralAI BehavioralAI --> DefenseOutput ``` Abnormal Security 从创立之初便是一家以 AI 为核心的安全公司，旨在解决网络安全专业人员最迫切的痛点。尽管如今攻击链日趋复杂，但 CISA 的数据显示 **91% 的网络攻击仍然始于一封电子邮件**。Abnormal 的核心逻辑就是充当这一数据智能层：理解正常行为、对其进行基线化建模、寻找行为偏离，并将恶意的通信模式、异常登录信号以及审计日志中的反常轨迹综合关联，最终精准判定是否存在攻击者。面对使用 AI 武装的攻击者，"唯一的防御方式就是使用行为 AI 来揭示他们的模式"。 - **AI 原生与 API 原生**：依靠 API 深度集成各平台数据，省去传统网关架构的笨重与盲区。 - **关联判定**：将邮件上下文、身份登录状态及 SaaS 审计日志联合分析，打破数据孤岛。 - **展会联动**：演讲者提到除了 Ai4 展位（1559 号），Abnormal 团队当时也同时在 Mandalay Bay 的 Black Hat 展会参会。 --- ### [12:05](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=725s) 问答互动 1：零售 Agent 交互风险与 AI Agent 的“技能投毒”与内部失控现场观众提出在零售场景下，随着面向消费者的**代理对代理购物（Agent-to-Agent Shopping）**模式普及，例如 ChatGPT 等 AI 代理直接与电商平台代理交互，企业是否面临更大的数据安全风险。虽然企业安全（B2B）与消费者端（B2C）存在应用场景差异，但针对 Agent 的数据窃取和外传风险已经成为各大企业高度关注的问题。攻击者完全可以通过被污染的“技能”（Skills）进行武器化攻击。例如在利用 Anthropic 等平台的公共技能仓库时，恶意攻击者可以非常隐蔽地在公共技能中植入恶意逻辑。当终端用户调用该 Agent 时，其敏感数据会在无感知状态下被直接外流到攻击者的未知域名。 ```mermaid flowchart LR accTitle: Agent 技能污染与数据外泄路径 A["公共技能仓库 (Public Skill Repo)"] -- "植入恶意代码/指令" --> B["受污染的技能 (Corrupted Skill)"] B --> C["AI Agent 调用执行"] C -- "隐蔽外传企业/用户数据" --> D["攻击者控制域名 (Attacker Domain)"] ``` 在 Black Hat 展会上，许多安全团队都在探讨如何在 AI 工具或 Agent 加载使用外部技能之前，先对其进行沙箱式“引爆”（Explode a skill）与动态检测。此外，解决该问题需要深入到 **AI 治理（AI Governance）** 范畴： 1. **访问权限控制**：明确限制 Agent 允许访问哪些底层数据库。 2. **所有权与使用审计**：厘清 Agent 的创建者、使用者、调用频次及使用范围。 3. **提示词与护栏溯源**：审查构建 Agent 的原始 Prompt，设定严格的安全防护护栏（Guardrails）。 4. **良性风险（Benign Risk）防范**：防范“良性风险”——即 Agent 本身并未被黑客入侵，但为了竭尽全力完成既定任务指令，擅自越权读取并泄露了敏感数据。 --- ### [15:34](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=934s) 问答互动 2：AI 擅长进攻还是防御？AI 原生与外挂式 AI 的本质区别另一位观众提及业内一种观点：**AI 工具在红队渗透测试（Pentesting / Red Teaming）等攻击端表现优异，但在防御端并不好用**。面对攻防能力的争议，演讲者指出这一痛点根源在于当前安全行业产品的实现差异： - **外挂式 AI（Bolt-on AI）**：许多传统安全厂商只是在原有的传统架构之上生硬地嫁接一个第三方 AI 大模型层。这种外挂方式缺乏企业内部深度的业务上下文与长期行为数据积累，无法做出高质量、低误报的威胁检测，因而显得“AI 防御乏力”。 - **AI 原生架构（AI Native）**：真正的价值不在于 AI 模型本身，而在于底层拥有多少高质量的数据、如何组织数据以及训练的专业安全模型是否具备特定业务上下文。只有原生基于网络安全用例构建的 AI 解决方案，才能在防御端建立起高精度的行为基线。 --- ### [17:37](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=1057s) 问答互动 3：从打地鼠到以假乱真——以 AI 驱动的人类风险管理（HRM）应对社会工程最后一位具有顾问背景的观众提出：无论历史偏离度检测算法多么强大，在实际客户环境中，超过 95% 的企业在推行员工安全意识培训时收效甚微。面对以机器速度迭代的社会工程学攻击，安全团队如何从机制上提升“人”这一防御层的抗风险能力？当前的行业范式已经从单纯的安全意识培训（SAT）全面演进为**人类风险管理（Human Risk Management, HRM）**。传统的通用模拟测试模板和说教式视频已经失效，Abnormal 采用基于 AI 的全新培训机制： | 维度 | 传统安全意识培训 (Traditional SAT) | AI 原生人类风险管理 (AI-driven HRM) | |:--- |:--- |:--- | | **模拟内容** | 通用模板、固定的群发钓鱼演练邮件 | 提取企业真实遭遇过的定向攻击样本，经脱敏后动态生成高度仿真的攻防演练 | | **覆盖渠道** | 单一的电子邮件模拟 | 串联短信钓鱼（Smishing）、语音钓鱼（Vishing）、Deepfake 多渠道多阶段综合演练 | | **度量指标** | 单纯考核点击率（Click Rate） | 评估员工在面对真实威胁时的实际行为模式转变 | | **员工参与感** | 敷衍应付、缺乏真实感 | 面对真正可能击穿自身防线的真实攻击场景，警惕性与参与度大幅提高 | 通过使用 AI 深度模拟现实世界中的高阶攻击场景，企业得以从根本上对“人类层”（Human Layer）进行安全加固，使防御体系在自动化算法与员工辨识力两端同时具备弹性。 ## Notable quotes > [00:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=3s) 攻击者同样有需求 — Ryan Schwartz > [00:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=3s) 过去编写一份针对核心 VIP 的高定制化鱼叉式钓鱼邮件需要耗费 16 到 40 个小时（整整一周工时），如今借助生成式 AI 仅需 5 分钟。 — Ryan Schwartz > [00:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=3s) AI 让初出茅庐的业余攻击者瞬间拥有了顶尖黑客水准的攻击与文案能力。 — Ryan Schwartz > [01:56](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=116s) 87% 的企业都经历过 AI 驱动的身份攻击。 — Ryan Schwartz > [04:30](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=270s) 用 AI 对抗 AI — Ryan Schwartz > [06:03](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=363s) 虽然我有时忙得也想这么干，但这绝不是正常工作日会发生的事情 — Ryan Schwartz > [10:25](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=625s) 91% 的网络攻击仍然始于一封电子邮件 — Ryan Schwartz > [10:25](https://www.youtube.com/watch?v=qhwBUhKBBNg&t=625s) 唯一的防御方式就是使用行为 AI 来揭示他们的模式 — Ryan Schwartz ## Mentioned Abnormal AI, Abnormal Security, Ryan Schwartz, Freaky Clown, Regula, Slack, Anthropic, ChatGPT, CISA, Black Hat, Ai4, Mandalay Bay ## Video description Ryan Schwartz - Senior Manager, Product Marketing, Abnormal AI AI has given attackers the speed, scale, and sophistication to move through an enterprise before defenders even know they're in. At the same time, the rapid adoption of AI agents, OAuth-connected integrations, and cross-platform automation has created attack surface that most security stacks weren't built to monitor. This session traces the evolution of email-borne threats and identity-based attacks—from bulk phishing and stolen credentials to AI-generated social engineering, compromised identity providers, and multi-stage intrusions that pivot across SaaS applications and non-human identities. We'll make the case that the only durable defense is behavioral: modeling what normal looks like for every human and non-human identity, then surfacing the deviations that signal compromise. Attendees will leave with a practical framework for reasoning about AI-era risk and what it actually takes to defend against threats that move at machine speed. [Source](https://www.youtube.com/watch?v=qhwBUhKBBNg)

Source quotes

[0:03] Ryan Schwartz: 攻击者同样有需求 [0:03] Ryan Schwartz: 过去编写一份针对核心 VIP 的高定制化鱼叉式钓鱼邮件需要耗费 16 到 40 个小时（整整一周工时），如今借助生成式 AI 仅需 5 分钟。 [0:03] Ryan Schwartz: AI 让初出茅庐的业余攻击者瞬间拥有了顶尖黑客水准的攻击与文案能力。 [1:56] Ryan Schwartz: 87% 的企业都经历过 AI 驱动的身份攻击。 [4:30] Ryan Schwartz: 用 AI 对抗 AI [6:03] Ryan Schwartz: 虽然我有时忙得也想这么干，但这绝不是正常工作日会发生的事情 [10:25] Ryan Schwartz: 91% 的网络攻击仍然始于一封电子邮件 [10:25] Ryan Schwartz: 唯一的防御方式就是使用行为 AI 来揭示他们的模式

Source quotes

[0:03] Ryan Schwartz: I'm a millennial, so I'm attached to it [0:03] Ryan Schwartz: a Nigerian prince a decade ago [6:03] Ryan Schwartz: sometimes I want to, but that's not something I would typically do on a given workday [10:25] Ryan Schwartz: the only way to stop attackers armed with AI is with behavioral AI to be able to uncover their patterns. Ryan Schwartz: AI has given attackers the speed, scale, and sophistication to move through an enterprise before defenders even know they're in. Ryan Schwartz: The rapid adoption of AI agents, OAuth-connected integrations, and cross-platform automation has created attack surface that most security stacks weren't built to monitor. Ryan Schwartz: The only durable defense is behavioral: modeling what normal looks like for every human and non-human identity, then surfacing the deviations that signal compromise. Ryan Schwartz: A practical framework for reasoning about AI-era risk and what it actually takes to defend against threats that move at machine speed.

Original transcript

[0:03] Hey everyone, as noted, I'm Ryan Schwarz. I am from Abnormal AI. I am the senior manager of our [0:10] new products, product marketing team. Forgive me, I have notes on my phone. I'm a millennial, [0:14] so I'm attached to it. Um, but today I'm here to discuss what can be done about AI. Now, certainly [0:22] we're all at AI 4 because we want to learn what could be done with AI, and that's relevant to the [0:27] discussion today. But attackers have needs too. And those attackers are employing AI tools to [0:34] target organizations in ways traditional security solutions cannot keep pace with. So in particular, [0:43] they're targeting what they've always targeted, right? Email and identity. But unlike the general [0:48] fishing emails that you know your uncle may have received from a Nigerian prince a decade ago, [0:54] it now only takes an attacker minutes to build an Osent report, scraping social media, [0:58] getting public information on any individual through a few prompts into a gender of AI tool [1:05] with open internet access. I have an anecdote about this too. We've actually done an AI road [1:10] show for a variety of different CISOs that we've spoken to and we brought Freaky cl ah freaky clown [1:15] uh which is the name of a known black hat well white hat hacker now he does a demonstration [1:21] where he uses a few pretty well-known LLMs to go out to the open internet quickly build [1:27] a report on an individual in the room and then steal their face with his own personal laptop [1:32] and put a deep fake overlay over it. He does this all in minutes during the presentation live. Now, [1:39] once this report's been built, once these prompts are in, it's incredibly easy to turn this into [1:45] a scalable fishing email. And you can only imagine how easy it is to do this for not [1:49] just one individual, but a full list of VIPs. And identity is seeing much the same type of targeting [1:56] with AI powered attacks like fishing as a service kits that use AI generated fishing emails and [2:01] landing pages to steal valid session tokens from individuals and compromise accounts without them [2:06] ever having to enter a password. Simply for those unfamiliar with session hijack and fishing kits, [2:14] think about if you log into something like Slack and it's on your laptop, it's on your device, [2:19] it continues to persistently stay logged in because it created a valid session token. [2:23] Attackers can steal that token, never have to enter a username and password, and can access that [2:28] Slack session or other application very easily. But worse yet are the sci-fi attacks that are no [2:34] longer sci-fi, like the one I just described from Freaky Clown. Deep fake impersonation [2:38] is increasingly common and it's being used most often lately as we've actually seen by operatives [2:45] from various nation states trying to compromise identity workflows through applicant tracking [2:50] systems and pose as legitimate IT workers. So you don't just have to take my word for it. [2:57] I have here a few examples and some stats as well. It takes five minutes as I had noted it [3:02] is incredibly easy now where previously it took 16 hours sometimes up to 40 hours a full work [3:07] week to be able to build a single fishing email personalized fishing email for an individual VIP [3:12] now it's done in 5 minutes AI has turned even the most amateur threat actor into a sophisticated [3:17] attacker for identity a recent study by the organization Regula found 87% of companies [3:25] experienced AI powered identity attacks again this is a multiaceted threat type as it includes MFA [3:31] bypass aided by AI capabilities. Uh you can see that example up there that there's a new zero day [3:38] attack specifically targeting MFA bypass as of this year. It uses deep fakes, compromised [3:45] non-human identities like AI agents and the list goes on. And as I noted in the beginning, [3:50] traditional tools can't keep up. Why is that? Well, traditional tools, traditional security [3:56] solutions meant to detect these types of threats are relying on known indicators of compromise. [4:00] They're relying on rules, policies, tuning, and all of these manual and static indicators that [4:05] attackers can now easily fool or bypass through the aid of AI tools. And worse than that, if you [4:12] look at the box on the bottom right there, the volume exceeds the capacity of humans to analyze. [4:18] When AI is in the mix, the scale is so immense, the volume of these attacks so broad [4:23] that traditional human-based tools and human-based tuning rather cannot keep up. So, [4:30] I'm not going to spend this whole time just creating fear. What can you do about it? [4:34] Well, not to be glib, you could fight AI with AI. You look for the normal behaviors. You find [4:40] solutions that can baseline what normal looks like and then find deviations that indicate [4:46] something's a miss by correlating these events. It's not just about pattern matching. It's not, [4:50] hey, one IP address is off, therefore this is a threat. It's about looking at all of these various [4:55] behavioral signals in a chain and determining with a level of confidence automatically that this [5:00] deviation from normal patterns is truly malicious. So you aren't looking for known bad anymore, [5:07] right? You're looking for the behaviors that can't be faked. Even with a great AI tool helping [5:11] attackers, they can't mimic everyone consistently. There's always a tell. So, with that, I'll say [5:17] that looks legit, doesn't it? There's no link. There's no payload. This looks like a legitimate [5:23] email. There's no immediate tell. Here you can see an example of a prompt in the left [5:28] there that would be used to create this type of email in seconds. It passes every single check. [5:32] There's no IO, there's no known IOC, there's no malware. This is ostensibly a legitimate domain. [5:39] This, by all accounts, is a legitimate vendor email. What about an identity threat? [5:46] I went to Sorry, I had another slide that was going to show you all those signals. So, [5:50] I'll give you a second here for those who want to take pictures. This is what I'm talking about. [5:53] That domain looks legitimate. It passes SPF, DKIM, demark, all of the authentication checks [5:58] for a legitimate email. There's nothing to analyze. What about an identity threat? Well, [6:03] if we look across the entire attack chain of an identity attack, one specific type, because not [6:08] all of them start with social engineering. In fact, many of them start with email compromise. [6:12] An attacker may call the help desk, which we're actually seeing in a lot of cases in one very [6:16] notable attack that happened here to a variety of different casinos in the area a couple years ago. [6:21] The attacker calls the help desk. They convince them to reset their password to add a new MFA [6:27] device. They get access through legitimate credentials. So why would anyone ultimately [6:31] suspect them? And then worse yet, they might actually do that session hijacking [6:36] attack I talked about earlier. They're bypass authentication entirely. Either stealing a session [6:40] token from someone's browser directly, buying it on the dark web for pennies on the dollar, [6:44] using an AI fishing kit to be able to steal it from what looks to be a legitimate login page. [6:50] And at that point, they're completely invisible because most identity security tools are just [6:54] looking at authentication. And these attackers have found ways to consistently fool them. [7:00] that legitimate user that's been compromised might have been a privileged user. Attackers know who [7:03] the VIPs are. And at that point, there's no need for privilege escalation, which can set off alarms [7:09] internally for security teams. In this case, they already have access to sensitive assets. [7:14] And now, once they're inside, it's all about maintaining persistence. Right? That reset request [7:19] already added a new MFA device for this quote unquote legitimate user. So now they're not going [7:24] anywhere. What's the answer? Well, the answer is behavioral AI. Let's go back to that email I had [7:32] shown you earlier. Now, you can see some of the overlays here of what can ultimately be detected [7:36] with no known indicators. There's no problem because in this case, that sender domain isn't [7:41] simply a legitimate domain. It's actually not the usual domain that that vendor sends an email from. [7:48] It doesn't matter if it appears legitimate. It doesn't matter if the attacker let it bake [7:51] for months so that it wouldn't trigger any rules about blocking known young domains. [7:56] At this in this case, there is a mismatch between where this individual typically emails from [8:03] and where this email came from. The mismatch is then correlated against inconsistencies in tone [8:07] and urgency and timing. As you can see there in some of those examples, behavioral signals [8:12] in the cont content of the email itself which when in context showed that this is these are [8:17] not the behaviors of this vendor typically when they send a message to this individual recipient. [8:21] This is what gives the attacker away and the only other thing to do now [8:25] is allow for automatic remediation to remove that from the user's inbox before they can [8:29] interact. So now let's look at how you can do the same thing by analyzing the various [8:33] behaviors in the identity attack chain. Oh no, my slide overlapped a little. Well, anyway, [8:41] in this case, that call or request to the help desk is now tied to behavioral analysis, [8:48] right? The attacker may have mimicked that individual's voice print. Maybe they created [8:52] a deep fake uh a deep fake voice print and called the help desk. Maybe they just went [8:56] through uh traditional channels by requesting a reset to their MFA directly to the help desk [9:01] through a ticket. But what we can now see is is the phone number that was used for that call that [9:07] user's typical phone number was the device typical for them the IP address. You can do the same thing [9:13] across this entire chain. Right? That signin that authentication abuse that follows is not [9:18] from the correct ISP or at the right time of day or even on the right operating system. You [9:23] start to correlate all these signals together to determine this really is not that person. [9:27] the hijacked session that was uncovered from a new signin came from an unknown device using [9:32] previously uh satisfied MFA. In that case, we know that this user had already signed in from [9:39] whatever device they typically sign in from on a legitimate session. But then once you see [9:43] another person accessing that session from a completely different device or location, [9:47] you know that that seems to be an indication that this attacker bypassed MFA entirely. And finally, [9:54] even something as simple as a new mail filter can become a tell [9:58] for an attacker because these are not the behaviors of a legitimate individual. Right? [10:03] Creating a new mail filter deletes all inbound email. That's not something that I would typically [10:06] do. Well, sometimes I want to, but that's not something I would typically do on a given workday. [10:12] And all of this can be detected with behavioral AI that understands the [10:15] normal for this individual person and can see these attacker deviations. [10:22] So, how do you deploy this sort of behavioral security? What should you look for in a solution [10:25] to be able to solve for this problem? Well, you need something first off that's AI native and [10:30] API native because as you can see at the bottom, it takes a lot of ingestion to be [10:34] able to build that data layer that's then used for baselining and to find these deviations. [10:39] You need something that's going to be able to take all this data and construct it in a [10:42] variety of different ways for email security, for identity, for AI security and governance, [10:47] for insider threat detection. And then because I do work for Abnormal, that is what Abnormal does. [10:53] For those unfamiliar, we did begin as an AI native security company meant to solve the most pressing [11:01] problems for cyber security professionals. The first obviously always being email. [11:06] Uh SISA specifically says that 91% of attacks still start with an email. [11:11] But the idea here is that we're that data layer. We're understanding normal behavior. [11:15] We're baselining it. We're looking for those deviations and then looking at [11:19] malicious communication patterns, uh, malicious sign-in signals, uh, anomalies in the audit log, [11:26] taking all of those, correlating them, and making a determination on whether an attacker is present. [11:33] So, with that, I'll leave you with the only way to stop attackers armed with AI is with behavioral AI [11:41] to be able to uncover their patterns. If you want to learn more, you can come see us at booth 1559 [11:48] or you can go over to Mandalay Bay because we're also at Black Hat, which is where I rushed over [11:52] from. Uh, so thank you everyone for listening and I hope you have a great rest of the conference. [11:59] I guess I have seven minutes left if anyone had questions. Six minutes now. Please go ahead. [12:05] I can't handheld mics better anyway. Please. So with with the adoption of [12:11] retailer, one of the things we're looking for agent to agent shopping. [12:20] Does that increase the level of risk of what interesting [12:28] how those agents are so That's a really interesting question. So the question for [12:37] those who didn't hear is I want to make sure I repeat it correctly. um [12:42] you're from a retail organization and you're using agentto agent shopping essentially [12:47] is the risk increased because now you don't necessarily know what the agents are doing that [12:51] are communicating with the I guess the e-commerce platforms from you know something like chat GBT [12:56] that's not actually a use case I've run into before but I think I mean I've run into plenty of [13:01] agentic use cases but not from the I'm assuming this is more BTOC kind of consumer side [13:08] I think there's certainly a risk what I was talking about I'll admit is more from the B2B [13:12] security side but I do think when we think about agents there are a few different ways [13:20] oh okay [13:27] I see [13:36] agent [13:37] so that so the the the next point there was can one of The risks is can an agent ultimately steal [13:42] data and filter it out to bad actors. That is something that a lot of organizations I speak to [13:46] are concerned about right and it is possible. I've seen I'll think of a few few ways that that can be [13:52] weaponized. Right? One in particular is if you are say going through something like anthropic and [13:59] there are so many public skill repositories. It's not particularly hard to add in a part of a skill [14:06] that silently without the individual who's using it with a given agent uh knows can siphon out [14:15] data to an unknown attacker domain. Right? Being able to corrupt skills is something that there [14:20] were actually quite a few organizations on the floor at Black Hat that were talking about this. [14:24] Being able to explode a skill before it's used by an AI tool uh by you know agents looking to [14:31] uh uh access that skill. So I do think that agent corruption is something that's becoming more and [14:38] more prevalent. This wasn't particularly a part of that. Um that would be more in the realm of [14:44] AI governance and understanding what the agents have access to. Right? Being able to govern [14:48] what different databases can an agent access. Uh who ultimately owns that agent, who's using it, [14:53] and how often? What prompt was used to create that agent in the first place so you understand [14:57] the guard rails around it and what kind of access it can get. Which I guess kind of [15:00] gets out of the realm of attackers in the first place. Now you're getting into the realm of just [15:04] what one of our field CISOs kind of called benign risk where the agent is just going to try its [15:10] absolute best to complete a job even if that means compromising sensitive databases. Um guess that [15:18] was kind of a long-winded answer but I hope it gave you some some context. Any other questions? [15:34] that AI is bad at offense. [15:43] Yeah, I would say it's I guess I'd flip it and say AI is good at defense, right? Uh because if you're [15:53] That's an interesting point because I don't know if you'd be using it necessarily offensively. [16:00] I'd have to understand what the context of the word offense was [16:02] in this case. I think because I think AI is Yeah. [16:10] here. Do you want the come down? Oh, you don't want the mic. Okay. [16:15] I'll just come and listen and I'll repeat it. [snorts] [16:19] Okay. There you go. All right. Um I think uh the talk I think uh what he was trying to get at was [16:25] um that if you use AI tools for pentesting it's pretty good. Yeah. For red team and then um [16:33] it's just not good at the opposite of protecting your systems. I think that's what he meant. [16:39] I I guess I'm kind of paid to say this because I work for Abnormal. Um I would say it's pretty good [16:45] at defense. Um and I do have customer references that would agree, but I understand the point, [16:50] right? I think it comes down to a lot of security tools now are bolting on AI additionally. [16:55] Um, not to repeat a lot of what I said in the presentation, but I think there are more [16:59] cyber security solutions like abnormal that are cropping up that are AI native, [17:04] right? And based on understand that the value of the AI is how much data you have [17:07] and how you put it together rather than just adding uh, you know, a third party [17:13] AI layer that doesn't necessarily have the context to be able to make good detections. Um, [17:20] it's an interesting point though. I think it kind of comes down to is the solution you're buying [17:24] an AI tool that was built for cyber security use cases or is it a cyber security tool that kind of [17:29] just bolted on AI and doesn't necessarily have the data and expertise to effectively protect. [17:37] Go for it. Good. Thank you. In a prior life, I was an okay and one of the things that I [17:41] career is that there was one topic that was completely underexplored [17:43] [clears throat] [17:43] software based approach to comparing historical deltas in coming in uh you know historical [17:45] deltas what the normal is with respect to info factors. to what's coming in today [17:47] and you're identifying things that don't look normal and then automatically servicing them. [17:49] That's incredibly powerful. But one of the things that I would say is true of 95% of the clients we [17:51] have is that no matter what social engineering um education you need to encourage them to adopt [17:53] Yeah. they sort of didn't do it. [18:08] Yeah. So when I think about what you're doing is it's an essential part of the puzzle. But what's [18:11] the um at abnormal? What's the philosophy around getting your client organizations to think more [18:15] programmatically about the education component? Because this is a dynamic [18:18] attack surface. It's going to constantly change. The speed by which it changes will [18:22] probably accelerate beyond what you can see. So how do you how do you manage that aspect [18:25] of relationship? So the way I think about it is the more you push them actively the more [18:29] they'll see you care about [18:45] their That's a really good question. And so the question for those who didn't hear is essentially [19:09] you know social engineering obviously is is prevalent and being able to baseline normal [19:13] and find deviations is powerful but how do you ultimately educate organizations on how to educate [19:18] I guess their own individual employees as well right how to recognize social engineering and to [19:24] to paraphrase you know kind of harden that human layer too right you want to make sure that people [19:28] understand how to look out for social engineering and don't just rely on defensive tools like this [19:33] I think that's a great question I will say Um, we've thought about that quite a bit. So, we do [19:38] actually have an AI powered uh, security awareness training tool. That entire space has kind of moved [19:44] into this realm of human risk management as a lot of analysts are now calling it. The way that it [19:49] now functions is less about sending out generic simulations and templated videos and things [19:54] of that nature. Instead, focusing on how do you change user behavior by having employees face the [20:00] actual attack tactics that'll target them. Right? Right? So in an email example like I had shown, [20:05] we would take a real threat that had targeted you or my or me, send that out as the fishing [20:10] simulation itself to get people an understanding of here's what a social engineering email might [20:14] look like because that's often what attackers are sending these days. Similarly, we're exploring [20:18] smishing and fishing and deep fakes and also thinking about how do you thread those together [20:22] into multi-step attacks to mimic what a real social engineering and AI powered attack would [20:27] look like today. We found that not only has that been better adopted and better engaged [20:32] by users because now they understand they're being targeted by the things that actually might impact [20:36] them rather than just generic, it's also a much better way to you're not just measuring click [20:40] rates. Now you're measuring actual behavioral change in individuals and you're basing it on [20:44] what would really happen in my environment. So I guess the answer to your question is [20:49] the the way to effectively educate is also through essentially using AI to mimic real [20:54] world attack scenarios as much as possible. Does that kind of answer your question? Cool. [20:59] Thank you. And now I'm over time, but I appreciate the last question. Thank you again, everybody.