{"id":8086,"date":"2026-05-11T10:00:00","date_gmt":"2026-05-11T10:00:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=8086"},"modified":"2026-05-11T10:00:00","modified_gmt":"2026-05-11T10:00:00","slug":"ai-security-is-repeating-endpoint-securitys-biggest-mistake","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=8086","title":{"rendered":"AI security is repeating endpoint security\u2019s biggest mistake"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

The security industry is experiencing d\u00e9j\u00e0 vu, and most teams haven\u2019t recognized it yet.<\/p>\n

If you were in the trenches during the early 2000s, you remember the antivirus arms race. IT teams buried under signature updates. Configuration baselines checked obsessively. Patch cycles treated as the primary defense. Meanwhile, attackers pivoted. They wrote malware that matched no known signature and walked through the front door while the guards were checking outdated IDs.<\/p>\n

The posture-first approach revealed its limitations as the endpoint attack surface exploded. The industry faced visibility gaps and realized you cannot harden what you cannot fully see. The posture-first approach wasn\u2019t wrong. It was incomplete. As the endpoint attack surface exploded, the industry realized that you cannot harden what you cannot fully see. Limited visibility hindered effective hardening, driving the shift toward behavioral detection as an operational necessity.<\/p>\n

AI security is at the beginning of that same arc. The teams that recognize it now get to skip the painful middle chapter.<\/p>\n

The endpoint era\u2019s hard-won lesson<\/h2>\n

The first generation of endpoint security asked answerable questions: Is antivirus installed? Are patches current? Does the configuration match the baseline? For a while, answering those questions felt like enough.<\/p>\n

Then the surface expanded. Laptops left the perimeter. Zero-days made signatures irrelevant at the moment they mattered most. The industry responded by building tools that stopped asking \u201cdoes this file look bad?\u201d and started asking \u201cwhat is this process actually doing?\u201d.<\/p>\n

That reframe changed everything. Instead of matching against lists of known bad, defenders began watching process trees, API call sequences, lateral movement patterns and privilege escalation chains. Behavior became the signal. Posture checks tell you what should be true. Behavioral detection tells you what is actually happening.<\/p>\n

Most AI security is still at the posture phase<\/h2>\n

Look at where most organizations are with AI security today. Model cards, AI-specific SBOMs, input and output filters, prompt injection guardrails and access controls around model APIs. These are valuable controls, but they reflect a posture-based approach. To truly enhance security, organizations must recognize the importance of shifting to behavior-based strategies that monitor actual system actions.<\/p>\n

They\u2019re brittle in the same ways, too. The AI surface is expanding faster than any team can harden it: open-source LLMs deployed without procurement review, third-party AI APIs embedded inside SaaS tools, autonomous agents granted broad system access, RAG pipelines sitting on top of sensitive internal data. The phrase \u201cshadow AI\u201d exists for the same reason \u201cshadow IT\u201d did before it. People adopt capabilities faster than policy can follow.<\/p>\n

The OWASP Top 10 for Agentic Applications<\/a> 2026<\/a> is a welcome and necessary framework. But read it carefully and you\u2019ll notice that most of its controls are posture-oriented: constrain scope, validate inputs, enforce least privilege. These are the right first steps, but they\u2019re not a complete strategy. We know this because we\u2019ve already lived through a version of this story.<\/p>\n

The core tension is identical to what endpoint defenders faced two decades ago. You can\u2019t patch your way out of a system you don\u2019t fully control. With AI, the surface is more dynamic, more opaque and more deeply embedded in business logic than endpoints ever were. An AI agent doesn\u2019t just sit on a device. It calls APIs, retrieves internal data, takes actions across systems and generates outputs that ripple downstream. The blast radius of a compromised or misbehaving agent is a problem entirely different from that of a compromised laptop.<\/p>\n

Why behavioral detection becomes the lever<\/h2>\n

While you may not control every AI surface, monitoring what these systems actually do empowers your team to stay ahead of threats and feel capable in managing AI risks.<\/p>\n

Behavioral signals are already being generated in environments that aren\u2019t instrumented to catch them. This includes unusual data access patterns from a RAG pipeline, prompt injection artifacts surfacing in model outputs, unexpected tool calls from an agent operating outside its intended scope, token velocity anomalies pointing to automated abuse, and output drift that suggests something upstream has changed.<\/p>\n

None of these is hypothetical. They\u2019re observable today. The parallel to EDR is direct: just as endpoint behavioral tools watch process trees and API call chains, AI behavioral monitoring watches action sequences, what data was retrieved, what tools were invoked, what was generated and in what order. A single anomalous output is noise. A sequence of anomalous actions is worth investigating.<\/p>\n

This is what gives SOC teams something to operate on. Posture is an audit checkpoint. Behavior gives you a triage queue. There\u2019s a real difference between telling an analyst \u201cThis agent has broad permissions\u201d and telling them, \u201cThis agent queried sensitive documents, formatted the output and initiated an outbound connection in a sequence it\u2019s never run before.\u201d The first is a finding. The second is an incident.<\/p>\n

A concrete path forward<\/h2>\n

The endpoint era offers a practical sequence, not just a cautionary tale.<\/p>\n

Don\u2019t abandon posture work. It\u2019s table stakes, not a strategy. Keep the model inventory current, enforce access controls and implement the OWASP guardrails. Just don\u2019t let posture become the ceiling of your program.<\/p>\n

Start logging AI system behavior now, even if you\u2019re not fully analyzing it yet. Data debt compounds and having behavioral history is essential for future detection logic. Building a behavioral baseline early helps close gaps and prepares your organization for proactive AI security measures.<\/p>\n

Prioritize your highest-agency surfaces first \u30fc autonomous agents with broad system access, RAG pipelines connected to sensitive internal data, any LLM feature that faces external users or triggers downstream automations \u30fc these are your highest-risk surfaces and the right place to start.<\/p>\n

Think in sequences, not just single events. That\u2019s the core lesson EDR already taught. An unusual API call is interesting, but an agent retrieving sensitive documents, formatting the output and making an unexpected outbound call forms a story. The sequence of actions provides the true signal for detection.<\/p>\n

Finally, close the gap between your AI security program and your SOC. Most AI security work today sits inside the AI governance function or the data team. That\u2019s the wrong home for behavioral detection. The SOC has the triage muscle, the incident response playbooks and the tool integrations. Getting AI behavioral telemetry in front of SOC analysts is partly a technology problem. It\u2019s mostly an organizational one.<\/p>\n

The signal is already there<\/h2>\n

The endpoint security story didn\u2019t end badly. It matured. The teams that invested in behavioral telemetry before they needed it built programs that held up when the threat model shifted. Those that doubled down on static controls had to rebuild from scratch when reality caught up with them.<\/p>\n

AI behavior is already generating signals in your environment. The question isn\u2019t whether the shift from posture to behavioral detection will happen in AI security. It will, for the same reasons it happened at the endpoint. The question is whether your team will be ready to act on those signals when it counts.<\/p>\n

The window is open. It won\u2019t stay that way.<\/p>\n

This article is published as part of the Foundry Expert Contributor Network.<\/strong>
Want to join?<\/a><\/strong><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

The security industry is experiencing d\u00e9j\u00e0 vu, and most teams haven\u2019t recognized it yet. If you were in the trenches during the early 2000s, you remember the antivirus arms race. IT teams buried under signature updates. Configuration baselines checked obsessively. Patch cycles treated as the primary defense. Meanwhile, attackers pivoted. They wrote malware that matched […]<\/p>\n","protected":false},"author":0,"featured_media":8087,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-8086","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8086"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8086"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8086\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/8087"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8086"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8086"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8086"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}