Telling Real Security AI From the Label

Every security vendor now says they have AI. For the person deciding what to buy, that isn’t information. In Vectra AI’s 2026 State of Threat Detection and Response, a study of 1,450 security practitioners and leaders, 95% already use AI assistants or agents, yet 58% are frustrated with vendors’ empty promises.

This ebook by Lucie Cardiet, Cyberthreat Research Manager at Vectra AI, starts with what’s inside the box. It explains the spectrum behind the word “AI,” from fixed rules to agents that act on their own, with a short glossary and no math. It then follows what attackers do with AI, using documented cases:

• Malware that asks a language model for its next commands.
• A state-sponsored campaign (GTG-1002) in which Claude Code ran an estimated 80 to 90 percent of the tactical work.
• Attacks on the AI services your own team deploys.

The ebook draws on Anthropic’s June 2026 analysis of 832 banned accounts. The loud, AI-heavy preparation happens on the attacker’s machines, where you can’t see it. The dangerous part happens inside your environment, as behavior you can detect.

That shapes the test you take to your next vendor call:

• Does the AI reduce my team’s work, or add to it?
• Does it connect network, identity, and cloud, or watch one corner?
• Can you measure it, and will you prove it in my environment?

You also get a one-page AI vendor test to screenshot, and two extra questions for judging an agentic SOC claim: can the agent show its reasoning, and does a human stay in control of consequential action?