Security operations teams have spent two decades building detection and intelligence-sharing capabilities around indicators of compromise: hash values, IP addresses, domains, and more. Those processes now have a problem: attackers are using AI to burn through indicators of compromise (IOCs) at an increasingly relentless pace, changing them for each victim and each deployment before security teams can even put them to use defending their organizations.
This doesn't mean the IOC is dead, as Nicole Beckwith, senior director, security engineering and operations at AI platform telemetry provider Cribl put it: IOCs need to be treated differently now, and security teams haven't caught up to what that means operationally.
This dynamic is not new. Decades ago, malware authors discovered that trivial code mutations, enough to change a file's hash, could defeat signature-based antivirus detection entirely. Defenders eventually adapted. Beckwith contends that defenders now find themselves at a similar inflection point, except that AI has made it possible for attacks to change what they do per victim very swiftly and cheaply.
Beckwith noted that for years, attackers have changed up malware, phishing URLs, IP addresses, and more to sidestep detection. AI, however, has dramatically accelerated the race. Now, Beckwith said, attackers are using vibe coding, AI-assisted code generation, to more swiftly switch up malware per victim.
So changing up attacks and IOCs hasn't changed. What has changed is the speed at which its artifacts: the IOCs that security teams would normally collect, share through ISACs, and build detections around—become stale. "This isn't novel," she said. "It's just that they're moving at machine speed versus human speed now."
That speed asymmetry has implications for IOC-sharing. ISACs and threat-intel platforms like MISP and OpenCTI, which exchange data using STIX/TAXII formats, were built around the premise that shared IOCs have operational shelf life. Threat actors have always cycled indicators; what AI has changed is the speed: they are now fast enough to outrun any human response. Beckwith expects the model to shift: what ISACs will increasingly share, she argues, are detections, research, and TTPs. Not individual indicators. "We're really going to have to drive into the behaviors to be able to get ahead of this," she said.
More AI in security articles:
George V. Hulme
George V. Hulme
Bill Brenner
The Behavioral Turn
She's built an answer, called Apex. Apex is a framework that reorients detection logic around those behaviors and TTP-based signals rather than IOCs. The architecture uses MITRE ATT&CK techniques as the primary signal, applies time-boxing to account for both fast-and-loud and slow-and-low attack patterns, and layers in fidelity scoring based on technique clusters rather than individual IOC matches. Single alerts may route to threat hunters for investigation; clustered behavioral sequences at or below expected time thresholds generate high-fidelity alerts for incident response. "The signal is the TTP," Beckwith said. "I don't want to see a log-source-specific detection. I don't want to see an IOC-specific detection. The detection should be behavioral in nature," she said.
What does that mean in practice? It means that instead of writing a detection rule that triggers when it sees a specific malicious IP or file hash, one is written to trigger based on a cluster of MITRE ATT&CK techniques, such as credential dumping followed by lateral movement followed by data staging, and executed within an expected time window. The behavior pattern remains consistent even when every IOC associated with it changes for each victim.
That shift has implications beyond detection engineering. Beckwith argues that CVE velocity is the next pressure point: AI-assisted vulnerability discovery is accelerating the emergence of new CVEs, and traditional patch management workflows- manual triage, severity review, ad hoc scheduling are not built for that volume. "There's no way that a traditional vulnerability management team is going to be able to keep up," she said. "You're going to have to fight AI with automation."
Still, the risk of aggressive automated patching breaking production systems in complex enterprise environments is real: enterprise infrastructure has too many custom configurations to push patches indiscriminately, but the alternative of ad hoc human triage against an AI-accelerated CVE stream is worse.
When patching can't move fast enough, Beckwith contends that the answer is to tighten compensating controls: zero-trust architecture, role-based access controls, rigorous architecture review, and cloud configuration gold standards. The underlying logic comes from her background in forensics. In her experience responding to breaches in law enforcement, it was rarely a nation-state APT that caused the damage. "It was that somebody misconfigured something or left something exposed," she said. Getting those fundamentals right limits blast radius when the patch cycle inevitably lags.
Small and mid-sized businesses face particular exposure. Attacks at that scale are opportunistic, Beckwith said, and SMBs lack the enterprise-scale controls to absorb them. And they often serve as entry points into the larger organizations they supply or support. For most of them, the practical answer is managed security services; the talent market and infrastructure investment required to counter AI-accelerated threats will price out organizations trying to build it in-house.
