Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Are Using AI for Threat Detection
Transcript
- Lucas: So a mid-sized financial services firm — about 4,000 employees — recently published a case study that I think really crystallizes where ai based threat detection is right now. They had a mean time to detect of about 12 hours before they deployed a machine learning model on their network traffic. Luna: Twelve hours — that is a lot of time for an attacker to move laterally. Lucas: Exactly. After training a classifier on six months of benign traffic plus some injected attack data, they got that down to under three minutes. Now, that's a specific number from one deployment, but it mirrors what I'm hearing from a lot of SOC teams. Luna: Three minutes is practically real-time. What was the false positive rate? Because that's usually the Achilles' heel. Lucas: They reported about 0.1 percent false positives — which sounds great, but in absolute terms, on a network with millions of events per day, that's still hundreds of alerts. They had to tune the model over several weeks and eventually layer in a human review queue for anything above a 90 percent confidence score. Luna: So the AI acts as a triage filter, not a replacement for the analyst. Lucas: Precisely. And I think that's the honest picture right now. Vendors like CrowdStrike and Darktrace have been pushing AI for years, but the real-world deployments still depend on good data hygiene and human judgment. Luna: Let's talk about CrowdStrike specifically. They recently announced that their Falcon platform processes over 1 trillion events per day. How does a model even keep up with that scale? Lucas: It's a combination of edge inference and cloud-based retraining. The endpoint agent runs a lightweight model that flags anomalies locally, and then the full model in the cloud periodically retrains on new attack patterns. That way you get near-instant detection without overwhelming the network. Luna: And Darktrace takes a different approach with unsupervised learning, right? It builds a 'pattern of life' for every device. Lucas: Yes. Darktrace's Enterprise Immune System learns what normal looks like for each user and device, then alerts on deviations. The advantage is it can catch novel attacks without needing labeled data. The downside is it can be noisier — you get more context-dependent alerts that require a senior analyst to interpret. Luna: So you have two philosophies: supervised versus unsupervised. Which one is winning in enterprise? Lucas: I think a hybrid approach is emerging. You use supervised learning for known threats — malware signatures, known bad IPs — and unsupervised for anomaly detection. A company called ExtraHop actually combines both in their network detection and response platform. Luna: That makes sense. But I want to push back a bit — are we seeing real ROI from these systems, or is it still mostly hype? Lucas: That is the billion-dollar question. One concrete metric I like is dwell time — the time between initial compromise and detection. According to the 2025 Verizon Data Breach Investigations Report, the median dwell time for organizations using ai based detection was 8 days, compared to 24 days for those relying on traditional signatures. Luna: Eight versus twenty-four — that is a meaningful improvement. But I assume there are also cost savings from automation. Lucas: Absolutely. Gartner estimated last year that ai driven security operations can reduce Tier 1 analyst workload by 40 to 60 percent. That's huge for a field with a chronic talent shortage. Luna: Speaking of talent — if AI is handling triage, does that change what skills we need in SOC analysts? Lucas: It does. The junior analyst role is shifting from 'click through alerts' to 'validate and escalate AI findings.' The real value moves up the stack — incident response, threat hunting, model tuning. Companies are starting to hire data-literate security pros who can understand why a model flagged something. Luna: So the AI doesn't replace the analyst, it changes what the analyst does. Lucas: Exactly. And that's actually a more optimistic story than the usual 'AI takes jobs' narrative. It makes the work more strategic. Luna: I want to bring up one more angle — the adversarial side. Attackers are also using AI to generate polymorphic malware that changes its signature each time it runs. How do defenses keep up? Lucas: That's the arms race. The same unsupervised learning approach I mentioned actually helps here because it's not looking for a static signature — it's looking for behavioral anomalies. So even if the malware's code changes, its behavior — say, encrypting files at scale or unusual outbound traffic — still gets flagged. Luna: But attackers can also use AI to mimic normal behavior. There was that research from MIT where an ai generated phishing email fooled 90 percent of traditional filters. Lucas: Right, and that's where you need layered defenses. AI for email security, AI for endpoint, AI for network — no single model is a silver bullet. You have to correlate signals across layers, which is what platforms like Microsoft's Sentinel are trying to do. Luna: If these conversations are useful for what you're building or running, we should mention that we deliberately keep this show ad-free. It's a choice — we want to focus on the substance without interruptions. Lucas: Yeah, and it's possible because some of you who listen choose to support the show directly. If that's something you'd like to do, you can find us at buy me a coffee dot com slash fexingo. No pressure, just an option. Luna: Appreciate that. Now, back to the arms race — one thing I think is under-discussed is the cost of training these models. A financial services firm might spend $500,000 a year on GPU compute alone. Lucas: That's real. And it's not just compute — it's the data engineering pipeline to clean and label that data. Many organizations underestimate that overhead when they budget for AI security tools. Luna: So for a mid-market company, is there a viable entry point, or is this only for the Fortune 500? Lucas: I think there's a viable mid-market path through managed detection and response, or MDR. Providers like Arctic Wolf and eSentire offer ai powered threat detection as a service. You get the scale of their models without building your own pipeline. The average cost is about $10 per user per month — which pencils out for a 1,000-person company. Luna: That's interesting — so the AI is in the service, not on your premises. Luna: Let's zoom out — where do you see AI threat detection in three years? Lucas: I think we'll see more predictive capability — models that don't just detect but forecast likely attack paths based on current activity. A few vendors are already experimenting with graph neural networks that map relationships between entities and predict the next move. Luna: That sounds like something out of a Tom Clancy novel, but I can see the logic. If the model knows that user A has admin credentials and user B just clicked a phishing link, it might predict privilege escalation. Lucas: Exactly. And then it can automatically isolate the compromised account. That's the holy grail — detection plus automated response, all ai driven. Luna: But with that comes more risk of automated mistakes. One bad model update and you could lock out half your workforce. Lucas: That's why human-in-the-loop remains critical for now. The technology is powerful, but context is something we still do better. For instance, knowing that a spike in VPN traffic is because of a planned remote work day, not an attack. Luna: So it's augmentation, not automation. Lucas: Exactly. And that's a healthy framework for any CISO evaluating these tools. Ask: does this tool augment my analysts or replace them? If the answer is replace, be very careful.