Already Inside: How Frontier AI Is Changing the Way We Hunt Hidden Attackers

The hardest attackers to stop aren't the ones trying to get in -- they're the ones already there. Threat actors with persistent access can move slowly, blend into normal traffic, and evade detection for months. Traditional security tooling was built to stop intrusion. It was not built to find someone who's been living in your environment since last quarter.

Drawing on two decades of incident response and DFIR work, this session covers how frontier AI is changing threat hunting for hidden and persistent attackers: how to detect lateral movement that looks like normal behavior, how AI is accelerating the identification of indicators that human analysts miss at scale, and what a modern detection strategy looks like when the attacker already has a foothold.