Until recently, cybersecurity was almost entirely reactive.
Organizations, forever on the defensive, learned how adversaries compromised their networks by collecting telemetry data and analyzing intrusion incidents. They used those findings to develop detection protocols.
The problem with this approach is that it can only tell you what attackers have already done.
Many organizations have adopted a reactive cybersecurity posture that has never been ideal. Identifying and patching vulnerabilities was a somewhat workable strategy when technologies developed over several years. This was the case during the proliferation of the World Wide Web in the late ’90s and early 2000s, as well as the migration to cloud computing.
The advent of agentic AI; however, has compressed that timeline to weeks. Merely reacting to intrusion events is wholly insufficient to mitigate the threats made possible by agentic AI, and doing so is effectively surrendering to the adversary.
If studying the last cyberattack is no longer enough to secure networks from AI-enabled adversaries, how are companies to combat these threats? By anticipating, modeling, and wargaming every possible attack scenario there is.
Modeling possible futures with hyper-synthetic data
The only way to effectively combat agentic AI is by deploying agentic AI, which demands reliable data upon which to train and validate agentic defenses.
This creates a paradox for researchers. How do you model and simulate attack scenarios that have never been seen before, with data that doesn’t exist? The answer is hyper-synthetic data (HSD).
HSD is data created by LLMs and machine-learning models for testing and simulation purposes. It can be created at scale to virtually any parameter, allowing companies to conduct high-fidelity simulations of likely attack scenarios facing their networks.
This is done in securely isolated testing environments entirely separate from production. These environments closely recreate an organization’s actual network infrastructure, including its operating systems and security applications. Benign network traffic provides realistic operational noise against which to test and validate agentic behavior.
These simulated networks are then attacked with real malware, including identity-centric attacks and living-off-the-land persistence, to create accurate training data and implement preemptive detection rules.
The effectiveness and accuracy of these simulations are critically dependent on realistic testing conditions. Agentic technologies can detect when an environment is overly simplistic or gamified, which can lead to inaccurate test data.
Organizations must test their network’s defenses to identify the most likely attack vectors and specific vulnerabilities threat actors could exploit, without deploying unproven agents to production.
The past has only so much to teach us
The greatest drawback to reactive security policy, besides the additional risk exposure, is that the past, no matter how well documented, is still something that has already happened. We can and should endeavor to learn from security incidents as best we can, but we can only effectively mitigate the next generations of threats only by looking forward.
Historical attack data still has its uses. Documenting individual incidents in detail, such as the OpenAI Hugging Face (OAI-HF) breach from earlier this year, allows researchers to identify how specific vulnerabilities were exploited and how intruders move through the attack chain. But basing future security decisions on past incidents alone is as misguided as focusing solely on patching more efficiently.
The most serious cyberattacks we are likely to see in the near and foreseeable future will be unlike anything we have seen before in terms of both ingenuity and scale.
However, while the media may be preoccupied with sensationalized headlines about zero-day exploits and models breaching containment, one of the greatest threats of agentic cyberoffense is its ability to orchestrate and execute millions of known attack workflows in parallel, simultaneously.
As agentic attacks become more frequent and increase in scale and speed, historical attack data will become less useful. Simulation data, meanwhile, will become invaluable.
Start small with automation — but start soon
Truly autonomous cyberdefense is still some time away, but the window of opportunity for security leaders to act is closing. Threat actors have always had the upper hand — attackers need to succeed only once, whereas defenders must be constantly vigilant — but agentic AI multiplies the potential risk factors far beyond human capability. This means testing the resilience of your networks, your detection rules, and your team.
Start small when automating any aspect of the defensive lifecycle. Initial tests might focus on identity management or access controls, or on protocols for response or recovery.
Simulations should be conducted in a secure, isolated environment where agents can be tested and validated under real-world conditions. Most importantly, such testing should be conducted far from production environments where real customer and business data could be inadvertently compromised.
As agentic technologies mature, cyberdefense will become increasingly resilient to AI-enabled attacks. For the time being, however, security leaders remain very much on the defensive. The time to act is now, but we mustn’t allow urgency to supersede quality data, responsible controls, and quality engineering practices.
Ready to start testing your defenses? Learn how breach and attack simulation can help your team identify security gaps before attackers exploit them.