MW. Résumé / CV

SOC advisory white paper

Human, script or AI? Spotting AI-driven attacks in the SOC

Version 5, evidence cut 23 September 2026.

A SOC advisory paper on telling AI-driven attack activity apart from human and automated activity, and what that means for detection and response.

From logs alone, a security operations centre is unlikely to prove an attack is AI-driven. The evidence supports confidence-based assessment, not definitive attribution. AI-driven activity usually reuses familiar tactics, techniques and procedures. The observable difference is more often tempo, adaptation, sequencing and breadth across telemetry.

Rewritten in my own voice and updated with evidence to 23 September 2026.

The stronger indicators

  • Compressed kill-chain timing
  • Rapid troubleshooting
  • Environment-specific payloads
  • High command variation
  • Cross-domain progression

What it covers

  • What changes for a SOC and what does not
  • Observable indicators, and whether AI-driven attacks are noisier
  • Emerging methods, including defensive prompt injection, command lexical fingerprinting, canary tripping rates and semantic diversity measurement
  • Detection principles and a confidence score in place of attribution
  • Response implications, and the limits of the evidence

19 references, with confidence language throughout. Where a source was not read in full, the reference says so.

More projects