Fingerprinting AI Attacks: Detection Every SOC Needs

We put together a blog revisiting a conversation between our co-founder Christopher Luft and Chris Cochran (Field CISO & VP of AI Security at SANS Institute) on The Cybersecurity Defenders Podcast. Worth a listen if you haven't caught it: https://youtu.be/zFsHqDKKkeo?si=41CLnbOchvTHPcnL

The core topic: How to strengthen cyber resilience in an AI era.

Major takeaway: Most detection frameworks weren't built to identify agentic attacks, and the behavioral gap is troubling.

A useful mental model from the conversation is that there are now three distinct attacker profiles in the wild, each with its own fingerprint. Human-paced attacks have a recognizable rhythm. Traditional automation is fast and mechanically clean. Agentic attacks sit in a strange middle ground: 

• Machine-speed execution with irregular pauses
• Non-deterministic path selection 
• Adaptive pivots when something doesn't work. 

The AI attack profile breaks most existing detections. Velocity thresholds were built around human or script baselines. Fixed-sequence signatures assume deterministic behavior. Neither holds against an agent that reasons about what it finds and navigates accordingly.

What's becoming clear is that AI behavioral analytics needs to become a real discipline: building detection logic around timing variance, adaptive lateral movement patterns, reasoning artifacts, and honeypot divergence. 

Cochran's team actually ran a hackathon to establish fingerprinting criteria for agentic behavior, which says a lot about how early-stage this work still is.

Full write up here if you want to dig in: https://limacharlie.io/blog/fingerprinting-agentic-attacks-soc-detection-guide