AI vs Architecture: How to Win Against Machine-Speed Attacks

Summary

AI-driven attacks now move at machine speed, and detection and response can't keep up. By Zero Networks' math, the real-world odds of detecting and stopping an attack chain in time are about 1.7%. In this webinar, Zero Networks Field CTO Chris Boehm walks through seven steps to win on architecture instead: close the gap between AI visibility and control, stop trying to out-patch AI, contain lateral movement, govern AI agents with least agency, and deploy automated, identity-driven microsegmentation.

Key takeaways

• Detection alone fails. Even if every stage of security operations worked 90% of the time, the odds of detecting and responding in time would be 53%. With real-world numbers, they drop to 1.7%, and the median time to detect is nine days against a 29-minute breakout.
• One compromised host exposes most of the network. By Zero Networks' data, the first hop typically reaches 85% of the network, and the second reaches everything.
• You can't out-patch AI. Patch volumes have jumped from dozens to hundreds per release. Architecture that contains a vulnerable machine beats racing to patch it.
• Govern AI agents like employees, with least agency. Surface every AI tool and agent, sanction and control them like users, apply identity-based access controls, and contain each agent to only what it needs. "Least agency" is a term from OWASP.
• Don't let a probabilistic engine enforce. A 1% error rate in segmentation breaks applications. Zero Networks uses a deterministic policy engine, deploys in about an hour, and closes RDP, SSH, and WinRM from day one, with just-in-time MFA for access.

Speaker:  Chris Boehm, Field CTO, Zero Networks 

Moderator: Welcome to today's webinar, AI versus Architecture: How to Win against Machine Speed Attacks. Before we start, here are a couple of housekeeping items. All attendees are in listen-only mode. That said, we'd like to keep this session to be as interactive as possible. Please enter your comments and questions in the Q&A or chat window on the right side of your screen. If for some reason we run out of time in this thirty-minute session, we, of course, will get back to you offline. And with that, we'll hand it over to our speaker.

Chris Boehm: Hey, everyone. My name is Chris Boehm. I am the, uh, field CTO here at Zero Networks. Um, just a quick background about myself. For those who do not know, um, if you're joining my webinar, you're driving my conversation. But the main thing is, is what I've been doing in my, uh, past fifteen to twenty years. Uh, the focus has been more on cybersecurity operations, helping out some of the biggest companies in the world be secure and mandated, while pushing the forward needle forward, I should say, in the, uh, vendor space. I've been primarily in the vendor space for the past seven years. Uh, it's actually more like ten years. And then I've, uh, was a part of the enterprise space myself, and I've gone to small to medium to large, including state and local government. But the main point of this conversation is I'm gonna be talking about how AI and AI architecture is the challenge that we're facing today.

What happened in the Hugging Face AI incident?

Chris Boehm: So let's start with just the meat of it. What is really the challenge? And if you've been paying attention to the news, it really got hot around, um, in the cybersecurity industry around Black Hat, if you're familiar with it. And this incident on the left side popped up. If you've seen it before, uh, great. Maybe I'll be giving you a small recap. But what happened was autonomous AI actually occurred. Uh, so what we saw was, um, the Hugging Face incident, if you wanna call it, an autonomous AI action that was in a black box scenario, uh, broke out of its sandbox, took advantage of zero-day vulnerabilities, and then gained in, uh, a foothold by doing lateral movement within a second, by the way. So really, really quickly. So the mechanics of the attack were quite ordinary. Like, a standard story and standard scenario that we've been, been hearing throughout my career and before my career. But what the difference was, is, is the speed and scale on how it's done, and what it did to gain its access by a single vulnerability. Um, and that's, that's the thing that should be hitting home right now. Like, this is where AI is truly taking the needle forward when it comes to AI-driven attacks.

How far can an attacker move after one compromised host?

Chris Boehm: So what we did internally, we broke down, like, well, we are a lateral movement company. We understand Zero Networks. If you don't know us, I, I can tell you a little bit more about us later. But the main thing is, is you can focus on — we do east-west communication network traffic. And what I mean by that is, if someone gets into your network, how far can someone spread, and are they doing it appropriately? Well, we took it from our own information that after a compromised endpoint, you get one host. The first hop, you have access to typically 85% of your network. And by the second, you just have access to everything, because that's unfortunately how the networks are designed today. The, the goal and design of networks are to keep everyone interconnected and do what you need to do. But if you think about the scale and speed of an autonomous AI driving an attack, that's, that's a, a different scale and challenge altogether. So instead of you using your privilege access tools, or having proper posture and hygiene, if someone was able to get into a machine, how far could they move today? And that's what I would challenge you a little bit here: people are underestimating the value and power of AI when it comes to an attack exposure, not just a resource exposure for improving their business, but reverse it and go on to you.

Why is AI visibility not enough without control?

Chris Boehm: So what are some of the challenge that we're being faced as an industry? Well, I'd say first off, when it comes to the architecture and AI, is we need to close the visibility gap between the control, uh, for AI. So as an example, on the left side, 80% of enterprises have AI tools and agents running. That hopefully doesn't surprise you. Most companies are utilizing AI in some form or fashion. So we're having hundreds and thousands of calls to AI services. And this could be enterprise-grade services, like the, the tools you may be familiar with. This could be Anthropic, OpenAI, uh, Microsoft's tools, the Gemini, like the, the for, for Google — like, the list is wide. Or it could even be a localized open-weight LLM. Uh, so to be clear, like, this is just that hundreds of thousands of calls. It's, it's a lot of communication. What's interesting is, after you look at these businesses, most, or I would say that mostly all of them, are not being blocked. There might be a visibility scope, but enforcement control is something that's not being done at scale. So if a rogue AI agent could delete a company's entire database, or do an action that might bring down of, of your main communication server, or something of that degree, that's where some of the challenges are starting to pop up. And you can hear more and more of these stories are occurring, even with more governance that have been put into place by these large enterprise co-companies I mentioned a little earlier, versus what's being done today. So, again, I believe the gap is really between the visibility and control of where AI lives. That's the main key focus on step one: how can you control, and what is actually being done with your AI, and do you know what's actually happening within your company and organization, uh, when AI is involved.

Why can't teams out-patch AI-speed vulnerabilities?

Chris Boehm: Number two, I would highlight on is the patch problem. It's quite interesting. I've been paying close attention to the key results when it comes to patching. Uh, and patching has been through my, my career. I, I remember doing control maintenance and control, and making sure that it's being done appropriately based on my business outcomes, or staying up late weekends. Everyone's been through this approach. Now, with the enablement of AI, things have been shifting. So think of it as your, maybe your company works today. Um, you, your teams may play, uh, plan on changes for Windows that may be in, in a few weeks. You have to test out your applications. You did do regression testing to make sure it's manageable, it's predictable, so you don't bring down your business operations while keeping yourself secure. That's great. But because of the acceleration of AI, and what these major organizations are doing, and the forces that are being done, it's not 20 patches or 15 patches. It's hundreds of patches, uh, or almost a thousand patches. Even in September, Microsoft released a thousand — oh, uh, I think it was, like, 970 patches in one single day. That's a lot. And I think, if I remember correctly, a 100 and something of them were critical patches, critical patches. And I, and then, and then the list goes down to even narrower, actively being abused patches, and I think they had a handful. So out of those thousand patches — my, my organization used to handle this, twenty, thirty, just fine. Now, from one company that I use across my ecosystem, they had about a thousand patches. Linux did one months ago. It was about 500 patches in a day. Microsoft had the same, same month, I believe. That was in June or July. It was about 500 patches a day. So it's just continuously growing in that direction of massive scale of patching and vulnerability. Now we're having that avalanche.

So I kinda skipped ahead a little bit before there, but that's exactly the problem we're facing, is this scale of operations for our teams is — well, maybe we'll just hire more people. Maybe we will look into another solution to, uh, absorb and op—, and operationalize this in some profession. We'll start using AI. That might be the approach and answer. We'll use AI to patch, uh, what is found, and hopefully does the right job. Well, that is a volume that you have to put at scale and understand itself. So I would say trying to out-patch this volume is gonna be a, a outreach risk and a problem risk for your organization. So really understanding the mindset of where things are going, when it comes to how to handle your business and absorb this impact, is something I would really recommend you to address. So that's the second step when it comes to architecture and design: learning how to safely deploy and manage your ecosystem with this avalanche of patches.

How fast does lateral movement happen?

Chris Boehm: The third thing I would highly encourage you to work on and consider is the focus on lateral movement. I brought it up a little bit earlier because it is a key element when it comes to lessons learned in the industry. And I have some sources in the bottom left. I know they're kinda small font, but this is from CrowdStrike. This is from IBM. This is even from our own analytics. There, there's a bunch of different resources here on when I'm giving you data points. But the main threshold — before the Hugging Face, by the way — the main threshold, if you don't wanna listen to that one, because that was a scenario that may not be super common, was the initial access took twenty-seven seconds. And after those twenty-seven seconds, they had lateral movement within an hour of compromise. That's, that's — think about that. So after initial access, they got in, less than an hour, they had lateral movement, initial compromise of majority of their environment. I would say more than 50% is the majority. Well, okay. Well, that's the movement of. The exfiltration and disruption, that took seventy-two minutes. That's the, the mean and average, I should say. Where, if you look at the, the potential impact that has of the Fortune 2,000 companies, or just overall, that's about a $400,000,000,000 a year downtime cost, which is incredible to think about. This is an estimation from IBM, by the way. 

Well, you're not done yet. Typically, you had to go one step further. How long do you have to work on this and resolve this problem? Well, it takes quite a bit of time. So it took seconds to hours to actually cause massive damage and disruption, but then you have to work on recovery over a long period of time. I mean, I, I look at a lot of different organizations that have been having their own attacks that are publicly facing. Of course, you don't hear about those private ones, but there's some — uh, even the EU pushed out a regulation saying, look at the impact of, um, Land Rover, for example. It, it was billions of dollars. I think it was 2,200,000,000, uh, of either those euros or in dollars. I can't remember the exact amount, but it's close to the same. [Editor's Note: The estimate for the 2025 Jaguar Land Rover attack is about £1.9 billion according to the UK's Cyber Monitoring Centre] So think about the potential impact of recovery and outage, and it's just a widespread, especially when you look at the supply chain scale of recovery and, and getting yourself up and running. So things are getting a lot faster when it comes to attack vectors, footholds, understanding and gaining access, and causing disruption, compared to years before, and then it's still taking us just as long to recover through the whole entire process that I just described.

What are the real odds of detecting and responding in time?

Chris Boehm: So I, I broke it down. I wanted to do some research. I worked with my marketing team. I worked with a lot of the industry experts in our field. So we wanna say, if this is the case, like, let's look at the hypothetical probability that everything worked from end to end. So let's walk through security operations. And this is kind of the scale we went through. So let's start first. First off, um, I'm making a hypothetical approach. 90% of all the threats that I receive are detected. Um, let's, let's just go from there. And then we go to a no false positives, because every tool works most of the time, I'm, I'm assuming. 90% of the time, you have another 90%. Let's go to the next one. We have fully staffed operations. So everything that we've been detecting and we're responding to, the SOC operations is now fully staffed most of the time, and so we never miss anything due to human error or human timescales. Well, the other part is, every analyst has every skill that you're looking for. Right? Let's say 90% of my team knows exactly what they're talking about. Because I have one of the best teams on the planet, and they are specialized in what they do, and they have the right skill set, 90% of them. And then I have the analyst has time, because they're focused on everything that they're supposed to be doing on the left I just showed. So operation, threat, detection, and response. And by the way, we respond 90% faster than the attacker. Well, I just kinda gave you an example earlier. It could be seconds to hours, so we'd have to be responding pretty quickly. Even if you did this same math I just showed you right here — ninety, ninety, ninety, ninety, into the sixth power — that's actually a 53% best-case probability that we're gonna detect and respond to what just happened. Kinda, kinda sink that in for a second there. Like, think about how your operations works today. You might even know your own statistics. Like, is all your tools as positive as they are? So I was just thinking, like, wow. We don't even — as an industry, as a whole, we're already having a problem at a 90% scale of detecting and responding to something that occurs. That just really hit me home when I, when we did this math.

So I said, well, wait a minute. I challenge — wait. We came up with the 90% scenario. Let's use real-world data. So I started doing my own research. I broke it down, and I gave it to the same team I was talking to. This is the information I found. If you look at the whole — and I have a lot of different, uh, resources I brought down there. So let's look at the same vector. We have 54%, uh, attack activity gets logged. That's, that actually feels more realistic, though. We might miss things. Right? We, we hope we have all the tools at our disposal, but let's just assume 54% of the time the attack actually gets logged. 20%, uh, 26% of the time, the log actually fires an alert. That doesn't surprise me. I've been in the SIEM world. You have to fine-tune it and operationalize it and make sure it works appropriately. So not just only the EDR tools and other tools out there, like, 26% — it makes, makes, um, me feel like that I wish I was higher. Uh, and this is averages, of course, based on the data points I, uh, have in the bottom left. The other one is, the alert gets investigated. This one is much lower than I hoped for: 37% that the alert actually gets looked at and investigated and looked into. Um, it's only 37%. And it, that, that was a little lower. The one that just surprised me as well is security operation, uh, staffing coverage. It was 80 — it's about 80%. Um, you — that's pretty high. And then if they had the right skill set — this one doesn't surprise me at all. There's so many different tools out there. I mean, you have to really know everything in order to really know all the alerts and scope and what's happening — was 41%. So most security teams would say 41% of the security operations have the proper skills for each alert that they get in. And then the containment of before breakout is twenty-nine minutes. So, breaking all that math together, it's not 90%. So it's a little bit lower, as you might see on the bottom left. It's a 1.7% real-world odds of detecting and responding to the chain that works, which is kinda crazy to think about. Uh, a much lower percentage than 50-something percent. And not to mention the average breakout time versus the median time to detect: the twenty-nine minutes versus nine days. So it's quite amazing to think about how our security operations are designed today. And based on the average, or the general information that you can find on the web — hopefully, your numbers are all better than this — but that's a 1.7% ratio that you're actually gonna determine if you, and you catch something through the chain itself, which just blew my mind, the, these numbers.

How do you contain AI tools and agents?

Chris Boehm: So I walked into the next stuff, like, okay. Well, we have to figure out how to solve these problems and give a guidance for everyone here. And then, hopefully, this is that, uh, you may take a screenshot or take something away from this presentation. But I would say you need to deploy in containment, especially due to artificial intelligence, even more so. I would have said it even years ago, but now it's becoming more and more of a threshold of understanding where artificial intelligence, or LLMs, or whatever you wanna call it in your ecosystem, is understood, contained, and isolated, and doing what it's supposed to do. So how do you do that? Well, first, usually in the cybersecurity industry, you need to understand what's going on in your environment. You need to surface every AI tool. The data flows, communication — is this SaaS? Is it shadow AI? Is it a local app or local agent on the network doing something in your ecosystem? You need to see this. That's the first step, and there's the two checkboxes, if you wanna have them. The next one is understanding what it could do. So when you look at the — like, we would call it a blast radius. There's other ways to look at it. The scope of operations. Make sure that the network is not traversable when, unless it's necessary. So microsegmentation down to every asset in your network. Sanction a user. Users should be sanctioned and controlled and isolated, just like you would normally a user. And then the machine access should be the same way.

It would not surprise me, by the way, if Microsoft doesn't make an approach in the next 2025 version of server. Heck, it could be, uh, the next version of whatever twenty-twenty, twenty-twelve. Uh, yeah, 2025, uh, version. I'm starting to show, show age there a little bit. Uh, the twenty-twenty, twenty-twenty-five version of Windows Server, that it actually has agents as a, a user profile within Active Directory, because it's going at such massive scale and volume. It's, it's one to five user to, uh, AI right now. And I think last I heard, it's moving up to one to eight. It's massively scaling us, uh, such a speed and volume, but we're not treating them the same way as we do an employee. But they have the same access, which blows my mind. You might have a agent doing a full workflow end to end, accessing your databases, your backups, your, your SharePoint sites, your whatever you wanna have, and then you're just letting it run rogue and wild. So if something did manipulate or got confused, it would just gain access. So you had to make sure that this is mitigated to what it needs to be done, and challenged along the way, so if someone doesn't abuse it, or something, uh, doesn't abuse it along the way, including its own AI service itself. And then the other part is, is the last bullet point is, you need to wrap that legacy stuff up. You, you just got — you have to, because there's too many patches, problems, operational, uh, operational issues you're gonna run into, especially when an AI tool can just assess it and understand and volumize what's happening, and, uh, use that to its advantage. And that's exactly what the Hugging Face scenario showed to us a little earlier. Um, if you want to try it yourself, use a open-weight model or a enterprise-grade model, and point it to a machine on your network, and say, "Hey, tell me what you can see here." It'll elevate itself naturally. It'll try to find things for itself. It'll continuously keep that persistence if you allow it, and then it'll do what it's — you just told it to do. That's how fast it can change within your ecosystem. You're a sanctioned user. You're, you're doing what you need to do. Imagine if you weren't the right person that's doing that. So definitely think about it from that scale of operations, of how you stop the blast radius of what AI, or even attacks as a, a whole, can happen in your ecosystem.

How should you govern AI agents?

Chris Boehm: And then kind of shifting what I talked about earlier: govern AI agents like employees, enforce granularity, identity access-based controls, automate least privilege rules when it comes to AI agents, and contain each AI app and agent with least agency. And least agency, by the way, is a terminology used by OWASP. So look that up. I would highly encourage you to gain a little bit of insights there. This is the direction where governing bodies, or I should say more, um, the cybersecurity operational teams, uh, that are understanding AI, are suggesting for you: go more at least agency in the ecosystem of where the infrastructure of AI is going. So think of it from that speed of scale, of how are we treating our AI agents today. We've let them run rogue, wild, because we wanted to enable them, including we don't really know what all is being used in my organization. Hopefully, you solve that with the first two checkboxes. But you should go to the approach of, now we can least privilege them and contain them to do what they need to do, while they contain, contain the least agency.

Should you let AI secure AI?

Chris Boehm: The other step I wanted to bring up in the seven-step process of our presentation is, look at how AI vendors are securing AI. So on, on the, there, there's a terminology that is just typically used within the cybersecurity industry. It's defense in depth. This is one of those scenarios I don't feel, or hopefully you don't feel the same way, a 100% comfortable with letting AI secure AI. And there's, there's a conversation there about AI securing AI. For example, I may assume one of the top, uh, enterprise vendor solution, security solutions with AI backing, uh, on it, is doing the right thing. Well, it may have security policies in place. That's great. But let's just say someone released an open-weight LLM. It could be from China. It could be from another country. It doesn't really matter. It posted out there, and it has secure measures in it. But the thing is that anything could be slightly manipulated to degree. That's why they have variations of the same models come out very quickly. That's what Hugging Face was notoriously known for, of seeing, hey, look, here's the Qwen 3.8 Max that just got released. Now there's 58 different versions of that same model, based on the fine-set tools of what you wanted to do. So I don't personally feel like the direction is allowing AI to secure AI itself, because it doesn't take much time or effort. If you've been paying attention to anything when it comes to artificial intelligent models that are popping up, is there's a manipulation that happens on a regular basis. Heck, you can be working on something today; tomorrow, it's something very different. All it took was to the tomorrow doing something different that could possibly cause an error with your results going today.

Now, on the right side, we do bring up this. Zero Networks, uh, is a deterministic policy engine, that, what we do. That's the reason why I bring that up: we took this approach instead of being a 100% sure on the right side. Because we took an approach of learning everything that your machine is doing, breaking down the behavior, showing the communication patterns behind it, and building a policy around it. So that's the difference between a deterministic engine versus a "we believe this is 99% right" engine. I'm not saying the left side is wrong. I'm just saying, I don't feel comfortable letting my business run on a 1% probability. And that's exactly what my next statement is: even at a 1% error rate in segmentation, you can break applications and disrupt operations. The stakes are too high. We would not have customers ourselves if we had a 1% error rate. We had to make sure it worked, especially since it's a self-learning solution — just, like I mentioned, a deterministic engine. So one of the things to keep in mind when you're working with AI security solutions and patterns: make sure you understand what it's doing and how it's doing. And if it's changing on a basis that you don't feel comfortable with, consider options much like Zero Networks, that is deterministic, that doesn't change, and is consistent, and provides, uh, visibility and control of what's happening behind the scenes. So it's tied to real information, not just based on a "what we believe is this answer for you."

Why is automated, identity-driven microsegmentation the answer?

Chris Boehm: Step seven. So, uh, you've sat through six steps. Thank you so much for that. But the last one is understanding how deployed automated identity-driven microsegmentation is the solution that were, that's being suggested by, uh, Gartner, Forrester, and other analysts. I use Gartner here as an example, because when I start talking about microsegmentation, it's not a new terminology. It's been around for twenty-plus years now. Uh, there's founders, and there's multiple that would, uh, are behind it. But the main thing is, is when it comes to micro-isolations and microsegmentation in a network, whether that's identity-driven or not, usually, this is exactly what Gartner says. They've had troubles doing this in the past. The failure rate's very high. Most projects are longer than the average tenure of the CISO. Um, it's the right idea, but the tools at the time were not there.

So if I walk you through a different scenario — I've kinda highlighted it through this whole, in our presentation, uh, uh, because you're sitting through a Zero Networks presentation — I wanna highlight what is being done differently. So, for example, what if day one, you deploy an as—, uh, you, you, you get an asset access of — let me rephrase this. Day one, you look at closing a port by day one when it comes to high-risk internal access, like RDP, SSH, um, WinRM. Like, the main things that are relevant on high risk within internal access, we just close it right away, because we know that that's what's being abused. But what we can do instead is allow you to multifactor authentication elevate it. So it's just-in-time access with MFA verification with internal access. Boom.

The second one is, usually the challenge is getting things going, rolling it out, understanding your environment, understanding your ecosystem. You kinda learned we don't have to know everything about your ecosystem, because we learn automatically for you. With a no-agent design, no redesign — we don't have to have a firewall. We don't have to have a switch. We don't have to have anything done differently. We deploy into the ecosystem you have today. And if you have a, "Well, ours is different," that's great. We actually have a hybrid approach of how we understand this. We say no agents right there, because we don't have to have agents. We can have an agent. If you're like, "Well, there's nothing that talks to — it's a laptop in the middle of nowhere," great. We can add something on there. But the thing is, we make it fast, easy, and scalable. Most of our customers, by the way, deploy in about an hour. That's how fast it takes. It's just this connect, integrate, and it scans and, uh, gains access and starts learning, if you wanted to. So we put it into a monitored state, ready for it to be monitored and learned.

We don't break applications. Like I mentioned, we, we have, we — most of our customers, um — I think I just read a study yester—, just a few days ago — 95% of our automation is left alone. So most customers use our automation. They may add some things. That's great, because they may know before we know. So they go in there and add in, and add a policy, and says, "Here you go. This is, needs to be allowed and learned." But most of our automation is just utilized. So we don't break applications, because we learn exactly what that application or that machine is doing. And then we reduce the complexity of changes, because your business doesn't stay the same. This is something that has been a problem for years. You implement it, you get it locked down and tightened. Well, things change. A new application, new company, new people. Uh, the person that was let, uh, let go six months ago is no longer here to explain how this application works. So we had to figure out, well, how do we reduce that operational challenge? Well, it's a dynamic policy, and we have, uh, day-two operations. So we can understand things change, and we can provide that insights for you, saying, maybe you should open this up based on the communication you're trying to do here, because you keep elevating or keep moving it.

How do you out-architect AI instead of out-patching it?

Chris Boehm: So instead of trying to outrun, out-patch, and out-design AI, I would say out-architect it. That's what I would argue here: instead of having something that's trying to speed a scale of patch operational over, overhead that you can't keep up with — those thousand patches in one Tuesday — um, I would say design it so your ecosystem is secure and locked down to a microsegmented layer, so you can still do what you need to do to get your operational overhead done.

Now, just don't always listen to me. There's other feeds and other insights out there. I would encourage you to look into our Mythos Resilience Readiness Pack. Um: know the reach, cut the path, and prove it. This is something that we are just released. Hopefully, you, you enjoy it and, uh, look into it a little bit more. What's in it is about AI threat briefs, uh, the breach map tool. This is a really cool, powerful free tool, by the way. It lets you scan and understand your whole ecosystem and how much a lateral movement would occur. So if AI did get in there, or whoever got in there, you could see exactly how it, they gain access in your ecosystem. It's — and it's free. We provided it for you by Zero Networks. And then we gave a board presentation template. So this is a customized presentation for reporting on AI readiness. So you, you can architecture the metrics, uh, that damage, uh, that is being measured by damage, not just the damage done. So the main goal here is, hopefully, this will enable you and get things going forward when it comes to AI enablement and our architecture, the design of what's happening in our ecosystem today within cybersecurity. Hopefully, you enjoyed this presentation. I, I, it was a pleasure talking with everyone here, and have a great one. Thanks.