The conversation about AI in cybersecurity has recently centered on capabilities like vulnerability discovery, exploit generation, and automated proof-of-concept development. It’s easy to see why: These tasks produce binary outcomes; a vulnerability either exists or it doesn't. That makes them useful for measuring model progress and demonstrating increasingly sophisticated cybersecurity capabilities.
Vulnerability discovery matters to defenders. According to the Verizon 2026 Data Breach Investigations Report, vulnerability exploitation is now the most common initial access vector, accounting for 31% of breaches in the reporting dataset. This is a meaningful and growing share of the problem and a strong reason to continue advancing AI capabilities in this area.
But it also means 69% of breaches begin through other paths. Credential abuse, phishing, social engineering, trusted relationships, and other forms of access remain central to the adversary playbook. A comprehensive evaluation framework should therefore measure not only whether AI can discover and exploit vulnerabilities, but also whether it can help defenders detect identity abuse, investigate suspicious activity, engineer effective detections, hunt for adversaries, and respond across the broader attack lifecycle.
We believe effective AI for defense must be evaluated against the operational reality of security teams: the range of techniques adversaries use to gain initial access, the work required across the kill chain, and defenders’ most time-consuming tasks. Here, we explore some of these use cases.
Detecting Adversary Behavior After Initial Access
Once an adversary is inside, the defender’s work becomes more complex. Security teams must detect and triage suspicious activity across massive alert volumes, balancing signal and noise. Speed here determines whether the adversary is contained in minutes or operates on a network for a longer period of time.
When suspicious activity is found, the focus shifts to investigation, which requires significant effort and expertise. Analysts must reconstruct events across endpoints, identities, cloud environments, and other systems to determine what happened and how far the adversary has progressed. This is where attackers gain time: The longer an investigation takes, the greater the opportunity to move laterally, escalate privileges, and achieve their objectives.
Detection engineering powers these investigations by translating adversary behavior into durable detections, yet it remains a specialized and often under-resourced discipline. Effective defense also requires proactive threat hunting to find adversaries operating below existing detection thresholds. This depends on skilled analysts and accurate models of real-world behavior.
None of these disciplines produce clean binary outcomes or are easily benchmarked. However, they all depend on grounded, accurate models of real adversary behavior that public benchmarks lack.
Evaluating AI Against Adversary Tradecraft
Proactive defense requires knowing exactly how adversaries operate: the tools they use, the sequence of actions they take, and the ways their activity appears in telemetry. Adversary emulation translates that knowledge into realistic activity, making it foundational to detection engineering, threat hunting, and security validation.
The critical factor here is being grounded in reality. AI red teaming based on hypothetical scenarios or synthetic data has limited value if it does not reflect the techniques, artifacts, and operational patterns observed in real intrusions.
A key question for AI is whether it can reproduce adversary behavior with enough fidelity to test detection coverage, expose engineering gaps, and improve defensive readiness. For most defenders, that is a harder and more consequential test of AI capability than vulnerability discovery alone.