Mind Your Gaps in the Age of AI-Powered Attacks

Most security teams aren’t losing because they under-invested. Their endpoint tools work as designed, their logs are collected, and their logins are approved. The attacker is simply operating where no single tool is looking. In 2025, 82% of intrusion detections involved no malware at all¹.

This whitepaper by Lucie Cardiet, Cyberthreat Research Manager at Vectra AI, walks through four real intrusions: Scattered Spider’s helpdesk calls, Volt Typhoon’s use of tools already installed on the machine, an AI agent that took over an AWS account in eight minutes, and the July 2026 OpenAI-to-Hugging Face incident. It shows where each one slipped past the controls most organizations already run.

Three gaps explain why:

• Nothing looks wrong. The attacker uses your own admin tools, so each action looks like normal work.
• Authentication succeeds. The credentials are real and the second check passes, but the person isn’t who you think.
• Movement isn’t visible. The attacker moves from one system to the next through trusted connections that no tool was built to watch.

For endpoint, cloud, network, identity, and AI security, you get what each category misses, one check you can run today, and one change to make. The paper also explains Attack Signal Intelligence: detection built on observed behavior across network, identity, and cloud, with a human deciding what happens next. Every alert traces back to specific activity, so you can test any AI claim against the behavior behind it.

‍

^{1 CrowdStrike 2026 Global Threat Report}