In a world where digital adversaries operate at the speed of light, Matilda Bailey stands at the front lines of the architectural shift in networking and cybersecurity. As a networking specialist with a sharp focus on cellular and next-gen wireless solutions, she has observed a fundamental change in how threats manifest within corporate perimeters. With machine-driven attacks now accounting for the vast majority of malicious activity, the traditional methods of manual defense are no longer sufficient to protect sensitive assets. We are exploring the nuance of modern defense in an era where AI-generated campaigns have effectively blurred the lines between human and machine interaction, requiring a total rethink of the security operations center.
The discussion covers the escalating velocity of AI-enabled operations, which have surged by nearly 90% in the last year, and the specific mechanisms of modern reconnaissance and phishing that leverage high-quality prose. We take a look into the technical nuances of identifying non-human behavior, from analyzing keystroke cadence to spotting anomalies in API traffic. Finally, we address the growing crisis of confidence in identity verification caused by high-fidelity deepfakes and the necessity of maintaining human-centric backstops in an increasingly automated landscape.
We are seeing reports that state-sponsored campaigns now rely on AI for up to 90% of their operations. How has this shift fundamentally changed the timeline and scale of the threats you are monitoring?
The shift toward machine-led operations has completely broken the traditional escalation procedures that most companies rely on. In a landmark case from late 2025, we saw a state-sponsored espionage campaign where an AI model handled 80% to 90% of the heavy lifting against roughly 30 separate targets. What makes this terrifying for a defender is that human operators only had to step in at four to six decision points throughout the entire campaign. When the AI is in control, it can issue thousands of requests, sometimes hitting several per second, which means the attack moves much faster than a human analyst can even triage an alert. This is why we saw an 89% year-over-year rise in AI-enabled adversary operations in the 2026 Global Threat Report; the efficiency gains for the attacker are simply too large to ignore.
The precision of modern phishing seems to have reached an unprecedented level of success. What is driving this massive increase in click-through rates, and why are traditional filters failing to catch these messages?
The jump in effectiveness is staggering, with Microsoft reporting that AI-assisted phishing has hit a 54% click-through rate, which is a 450% increase compared to the 12% we used to see with traditional campaigns. This isn’t happening because attackers are sending more emails; it is happening because the quality of the prose is now fluent, personalized, and virtually indistinguishable from a legitimate business reach-out. These AI models can scour public data to build highly accurate target profiles and then write messages that mimic the specific tone and vocabulary of a trusted colleague. Because the AI can generate fresh obfuscation and different wording for every single message, static signatures and basic keyword filters are effectively useless against them.
We are seeing new families of malware like PROMPTFLUX that seem to behave differently than anything we have dealt with before. How does runtime code generation complicate the job of a security operations center?
Malware has evolved into a polymorphic nightmare where the code never looks the same twice, rendering traditional signature-based detection obsolete. Families like PROMPTFLUX and PROMPTSTEAL are designed to query a large language model at runtime to generate new collection commands or fresh obfuscation layers on the fly. This means that if you analyze a sample in a sandbox, the version that actually runs on your network minutes later will have a completely different structure. For a SOC, this moves the goalpost from identifying a specific file hash to needing to understand the underlying behavior and intent of the process. You are no longer looking for a known “bad” file; you are looking for a process that is communicating with an LLM API to rebuild itself in real-time.
With machines getting better at mimicking human behavior, how are you using behavioral biometrics to distinguish a script from a real person?
Behavioral biometrics are becoming the bedrock of identity protection because they focus on how a session behaves rather than the credentials it presents. We look at incredibly granular data points like mouse curvature, the rhythm of a person’s scroll, touch pressure on a screen, and even the cadence of their keystrokes. Humans are naturally inconsistent; we pause to think, we make slight errors in mouse movement, and our typing speed fluctuates. Scripts and automated agents, on the other hand, often display a mechanical regularity or a level of precision that is physically impossible for a human to achieve. While advanced tools can try to “replay” recorded human traces, the continuous monitoring of these patterns throughout a session helps us catch account takeovers and fake account creations that look legitimate at the login screen.
You’ve mentioned that anomaly detection is the most direct counter to machine speed. What are the specific red flags that tell you a machine is moving through your network?
The primary indicator is the sheer pace of the activity, which we now tune our detections to flag immediately. For instance, if we see 200 API calls per second coming from a single service account, that is a clear sign of automation rather than human interaction. We also keep a close eye on the speed of lateral movement; if an entity manages to move across the network and compromise multiple systems in just four minutes, no human analyst could be driving that. Other triggers include the enumeration of an entire directory in a matter of seconds or activity happening entirely outside of normal working hours. By focusing on the rate and sequence of actions rather than just the volume, we can spot an AI-driven intrusion before it has the chance to exfiltrate data.
There is a growing concern about the “death of trust” regarding video and voice calls. How should organizations adapt when 30% of enterprises are expected to stop trusting isolated face biometrics this year?
The threat of deepfakes is no longer theoretical; we have seen since April 2025 that attackers are successfully impersonating senior officials with synthetic voice and text to steal credentials. Gartner was right to warn that face biometrics used in isolation are no longer a reliable proof of identity because of how sophisticated these generated media have become. We are now advising companies to look for artifacts that AI still struggles to get right, such as unnatural blink rates, inconsistent lighting on the face, or spectral traces in the audio. However, the most important defense is a process change: you must pair any high-value request with an out-of-band callback. If a “CEO” asks for a wire transfer over a video call, the policy must be to call them back on a known, trusted number to verify the request.
Despite all this advanced technology, many reports still point to the “human element” as the primary weak point. How do we reconcile high-tech AI attacks with basic human error?
The human element remains a factor in 62% of breaches, according to the Verizon 2026 Data Breach Investigations Report, and AI is simply making it easier to exploit that vulnerability. Interestingly, mobile-centric attacks using voice and text are seeing a 40% higher success rate than traditional email phishing because people tend to be less skeptical of a text message or a phone call. An AI can craft a flawless pretext, but it cannot bypass a hardware-bound private key like a FIDO2 passkey that the user physically possesses. This is why we push for cryptographic controls and strict administrative processes as the last reliable backstop. No matter how convincing a machine-generated voice is, a rigid “call-back” procedure and phishing-resistant MFA can stop the attack in its tracks.
What is your forecast for AI-driven security operations?
I believe we are heading toward a landscape where “human-in-the-loop” will become a bottleneck that organizations simply can’t afford, leading to the rise of autonomous defensive agents. As machine-speed attacks become the standard, our defense systems will need to make sub-second decisions on isolating hosts and revoking credentials without waiting for a human to click “approve.” We will see a massive shift toward “identity for agents,” where every automated process has its own cryptographic identity that is monitored as strictly as any human employee. Ultimately, the winners in this arms race will be the ones who can baseline their “normal” operations so perfectly that any machine-driven deviation—no matter how subtle—is silenced before it can escalate.
