Positive Technologies has introduced a new concept for an AI-driven agent designed to protect endpoints. The system is capable of adapting its behavior based on attacker actions and situational context, moving away from traditional, pre-defined security logic that is susceptible to reverse engineering.
Data from the company indicates that AI is currently utilized in 10% of attack techniques listed in the MITRE ATT&CK matrix, up from 5% two years ago. Researchers have also confirmed that AI can be applied to an additional 26% of these techniques, particularly for social engineering, malicious code generation, and vulnerability exploitation.
The agent features a hybrid architecture. Lightweight ML models operate locally on endpoints for immediate threat detection, while resource-intensive analysis is handled in a secure Positive Technologies cloud. Users can trigger security tasks, such as isolating a device, using natural language commands that the system converts into executable scripts.
The concept includes proactive threat hunting, OS hardening, and integration with backup systems to ensure data integrity by preventing the inclusion of malicious code. This development aligns with the company's strategy to enhance its MaxPatrol Endpoint Security solution, making it more adaptive to evolving cyber threats.