ReliaQuest Blog - Threat Hunting, Security Operations, and More

Sorting the Agentic AI Hype From Black Hat 2026: 4 Things to Look For

Thu, 06 Aug 2026 09:00:00 GMT

At the Mandalay Bay Convention Center, you could measure how fast the market is moving by counting the signs that read "Agentic AI" over the booth. The label was everywhere. What it actually meant changed booth to booth—and that is the problem you carry home.

The stakes behind the noise are real. The fastest data exfiltration ReliaQuest tracked in 2025 took 6 minutes, and any actor with the right model can now run advanced, targeted attacks at enterprise scale. A human watching an alert queue cannot match that pace.

Now the badges are in a drawer and the follow-up emails are rolling in, every one of them promising agentic AI. The useful question to ask yourself as you filter through your inbox on the flight home is not "who said agentic?" All of them did. It's "how does this actually work, and will this strengthen my defense?"

Agentic defense is an approach to security operations where autonomous AI continuously understands the environment, reasons over risk, configures proactive measures, and coordinates defensive action across the tools and data already in place. Done well, it gives defenders more speed and scale, and the ability to operate effectively without being an expert in every tool or discipline. Identifying a comprehensive agentic AI solution from a repackaged claim comes down to a short list of criteria. Each one maps to a question you can tie directly to a vendor before agreeing to a second meeting.

1. Autonomous Execution, End to End

A complete solution runs the full range of SOC work autonomously—not just incident response, but detection engineering, threat hunting, threat intel research, and IT and OT coverage—across your tools and approved workflows, while defenders keep control of the decisions that matter. The tell on the floor was scope: many demos automated one scripted step in one discipline and handed the rest back to an analyst. The ones worth a second meeting ran continuously, and collaboratively, across every discipline and closed the loop without a human stepping in to finish the job.

Ask the vendor:

Does your AI run end to end across disciplines—investigating every alert, building and deploying detections, hunting proactively, and covering OT—or does it automate one step and hand the rest back to an analyst?

2. Knowledge of the Opponent

Autonomy without context is fast guessing. Real defense is shaped by threat intelligence, attacker behavior, known exposures, and the attack paths most likely to be used against a specific environment. On the floor, this showed up as a clean split: tools that score generic risk versus systems that reason over what an attacker would plausibly do next. The deeper question is where that intelligence originates—whether a vendor generates its own or resells someone else's.

Ask the vendor:

Where does your threat intelligence come from?
Do you run your own researchers—boots on the ground producing native intel and threat research—or are you repackaging third-party feeds?
Does your AI apply that intel to my environment continuously, or reason only over data inside your own platform?

3. Coverage Across Your Existing Architecture

A comprehensive solution works across your existing tools, clouds, SIEMs, and data stores without forcing everything into one platform. This is where the show floor divided. Many pitches quietly assumed you would centralize your data in their lake first, which resets your architecture on their terms and creates blind spots for data too expensive or too sensitive to move. The stronger model normalizes telemetry from any vendor at the field level without centralizing it, and runs detection at the source, at storage, or in motion as data moves—without requiring a SIEM.

Ask the vendor:

Does this require my data to land in your platform before detection can run, or can it normalize across my existing tools and detect at the source, at storage, and in motion without requiring a SIEM?

4. Plain-Language Operation for Anyone on the Team

Most security tools gate their power behind syntax: to run a hunt, you first have to know how to write one. A comprehensive solution understands a defender's intent in plain language and coordinates each request across the environment—build detections, run hunts, investigate alerts, and execute response without knowing SPL, KQL, or any vendor-specific syntax. This week reinforced how much of the "skills shortage" is really a syntax and tooling problem. When the interface is intent instead of query language, the pool of people who can do the work expands immediately.

Ask the vendor:

Can an operator who doesn't know query syntax build a detection, run a hunt, and execute a response entirely in plain language, or does your demo still require an expert to phrase the request?

Raise the Bar on the Follow-Up

The market adopted agentic language faster than agentic operation. That gap is normal for any inflection point, and it's the opening for security leaders to raise the bar as the follow-ups begin. Any vendor can demo one of these four in isolation. A comprehensive agentic AI solution answers all four at once—executing autonomously across every discipline, reasoning over intelligence it generates itself, covering your existing architecture without moving your data, and operating in plain language for anyone on the team. This combination set the bar. Take the four questions into every follow-up conversation, and look out to see them answered live, before a POC ever gets signed.

The Best Defense Is Proactive: GreyMatter Recognized by Forrester Among Proactive Security Platforms

Mon, 23 Mar 2026 07:00:00 GMT

For years, security operations has been defined by how fast a security team can identify and respond to threats. But AI changed the equation for both the adversary and the SOC. Responding faster is no longer enough.

At ReliaQuest, we’ve long viewed security operations as a journey that security leaders can follow to mature their operations:

Proactive operations is the new standard for getting ahead of modern threats. Predictive operations is the goal for staying ahead of threats as they evolve. We built our agentic AI security operations platform, GreyMatter, around this conviction.

In the Proactive Security Platforms Landscape, Q1 2026, Forrester formalized the industry shift—establishing the “proactive security platform” as a defined market category and recognizing ReliaQuest GreyMatter among notable platforms.

Security Operations Has a Response Problem

Most security teams are trapped in a reactive cycle. As alert volume grows, analysts are forced to spend more time triaging and responding, leaving less time for the work that actually reduces risk. The result is a constant state of firefighting that makes it harder to anticipate future incidents.

Meanwhile, attackers are moving faster. In 2025, attackers achieved lateral movement in as little as four minutes—85% faster than the year prior. At that pace, faster response is not enough to reduce risk.

Even mature teams that invest in proactive capabilities struggle to apply them continuously or at scale. According to Forrester, the primary challenge facing the proactive security market is that “fragmented security solutions and siloed data leave teams missing the right context.”

Proactive security operations solves this challenge by unifying fragmented data and tooling into a single operational model, giving teams the context they need to act on risk before it becomes an incident.

What Is Proactive Security Operations?

Proactive security operations is the practice of continuously reducing risk before an incident occurs. Reaching that state requires operational alignment across three pillars: visibility, prioritization, and remediation.

1. Visibility

Know what's in your environment and where risk lives across endpoints, cloud workloads, identities, applications, OT/IoT, and third-party systems. Forrester says a proactive security platform “must provide a depth of asset context, such as its business relevance, data stored or transmitted by the asset, and whether security controls are appropriate and effective.”

2. Prioritization

Visibility without prioritization is noise. But just because an exposure can be exploited doesn’t mean it should be prioritized. According to Forrester, “proactive security vendors must also incorporate business context, IT operations team capacity, and the impacts of risk event modeling to show why one exposure should be remediated over another.”

3. Remediation

Forrester is direct: “a prioritized list of problems doesn’t improve security posture.” Proactive security is only possible when teams act on that knowledge—fast, consistently, and at enterprise scale. That requires a platform that goes beyond opening tickets, integrating directly with patching, configuration management, and security controls to close exposures before adversaries reach them.

Each pillar is essential, but they’re only effective in achieving proactive security operations when all three work together.

The Journey from Reactive to Proactive—and Toward Predictive

We built GreyMatter on the conviction that the only way to outpace advanced adversaries is to proactively reduce risk.

Break Free from Reactive Work

GreyMatter ingests and correlates telemetry across your entire security stack, then applies agentic AI to autonomously investigate and respond to 100% of alerts across 300+ technologies with 99.4% accuracy. Threats are contained in under five minutes—closing the window before attackers achieve lateral movement.

By eliminating Tier 1 and Tier 2 manual work, GreyMatter frees analysts to focus on higher-value, proactive initiatives.

Scale Proactive Operations Across the Enterprise

Getting out of reactive mode creates capacity that GreyMatter enables with native proactive capabilities most SOCs struggle to build and sustain on their own:

Dark web monitoring and digital risk protection to identify external threats before they reach your perimeter.
Continuous asset discovery to maintain a live inventory of every asset, entity, and exposure across your environment.
Threat hunting to proactively search for adversary activity across 300+ technologies.
Threat intelligence research that connects external risk from the open, deep, and dark web with your internal environment.

Agentic Teammates Make Proactive Capabilities Predictive

Forrester calls agentic AI the leading disruptive force in proactive security — but observes that for most vendors, AI "isn't yet changing how proactive security teams work." For GreyMatter customers, it already has.

GreyMatter's Agentic Teammates use over 200 agents and 400 AI tools to operationalize proactive capabilities at machine speed — autonomously executing threat hunts, generating and deploying detection logic, producing tailored intelligence reports, managing infrastructure health, and bridging OT/IT environments. Work that used to require dedicated teams running manual processes now runs continuously and without human intervention.

Together, these Teammates transform proactive capabilities into autonomous predictive operations.

GreyMatter's network effect amplifies this further. Threat intelligence and detection logic are shared across the full ReliaQuest customer base. When adversary behavior is observed in one environment, protections are applied across all.

Proactive Security Is the New Standard

For years, proactive security was treated as aspirational—a maturity milestone teams would reach once they cleared their alert queue. But AI has made that operational model obsolete.

To us, Forrester's Proactive Security Platforms Landscape reflects what we’ve seen across thousands of enterprise environments: breaches are rarely the result of a single missed vulnerability. They are the result of chained exposures, missed signals, and delayed response. Breaking that chain requires consolidated visibility, intelligent prioritization, and automated remediation working continuously and at scale.

Proactive security is no longer a theoretical future state. It is the required standard.

We believe ReliaQuest was recognized by Forrester as a proactive security platform because GreyMatter was built to enable exactly this shift—giving security teams the speed to move away from reactive operations, the capabilities to scale proactive programs, and the foresight to become predictive.

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. For more information, read about Forrester’s objectivity here.

Threat Intelligence Works Best When It’s Operationalized

Fri, 24 Apr 2026 09:00:00 GMT

GreyMatter Recognized by Forrester Among Notable External Threat Intelligence Providers

Threats are accelerating, and AI is making it easier for adversaries to launch more sophisticated attacks at scale. At the same time, security teams are challenged to cover more ground—fraud intelligence, brand impersonation, exposed credentials, and supply-chain risk—with the same headcount and tooling. Raw IOC feeds and standalone intelligence platforms were never intended to power defense for that reality.

At ReliaQuest, we’ve long believed that threat intelligence only delivers value when it’s embedded into how your SOC operates—powering detections, driving hunts, and triggering threat response. We built GreyMatter around that conviction.

In The External Threat Intelligence Service Providers Landscape, Q1 2026, Forrester describes an external threat intelligence market evolving toward an operationalized, AI-enabled approach—and recognized ReliaQuest among notable providers in this space.

External Threat Intelligence Can't Stay Idle

Most security teams aren’t short on threat intelligence, but they often lack ways to operationalize it. The problem is where the intelligence lives and how it’s used. When it’s consumed in a standalone platform separate from the tools and workflows where detection, hunting, and response happen, it’s harder to act on.

According to Forrester, "gaps in operationalizing intelligence and aligning it to business context are the primary challenge" in the external threat intelligence market. That challenge plays out in SOCs every day. Analysts end up manually translating intelligence into detection rules, cross-referencing IOCs across alerts and tools, and contextualizing findings for their specific environment. Every handoff adds delay. That manual translation layer kills speed.

In 2025, the fastest data exfiltration ReliaQuest tracked took just six minutes. Average SIEM detection time remained at 51 minutes. At that pace, intelligence that isn't operationalized is already too late.

Consider this scenario—a dark web forum is discussing new ransomware TTPs targeting the manufacturing industry. In a siloed model, that intel might sit in a report until it’s pulled for a quarterly analysis. Meanwhile, threat actors move forward with plans shared in the forum, and a manufacturing company on the receiving end of the attack doesn’t find out about it until the incident unfolds in real time. As attackers increasingly use AI to find and exploit vulnerabilities across the open, deep, and dark web, security leaders need to drastically reduce the time between collecting intelligence and acting on it.

Threat intelligence has to be embedded into the operational core of the SOC so it can continuously inform detections, hunts, and response.

How GreyMatter Operationalizes Integrated Threat Intelligence

Within GreyMatter, threat intelligence is continuously collected from deep, dark, and open web sources through proprietary collection systems and human-led research. That intelligence is correlated against assets, identities, vulnerabilities, and IOCs in a unified model—the foundation GreyMatter's Agentic Teammates use to take action.

Forrester notes that "usable intel data is rich in context and delivered in machine-consumable formats that map directly to detections, response playbooks, and threat-hunting workflows." That's how GreyMatter delivers intelligence to the SOC.

Because threat intelligence is embedded at the platform level, the Agentic Teammates can autonomously:

Build and tune detections as new IOCs and TTPs emerge, updating rules across your SIEM and EDR tools without waiting for manual engineering cycles.
Kick off targeted threat hunts based on emerging threat actor activity, campaign patterns, or newly exposed infrastructure relevant to your environment.
Execute automated response playbooks that scope impacted identities, contain compromised assets, and initiate remediation within minutes of a signal surfacing.

GreyMatter also natively converges threat intelligence with digital risk protection and attack surface discovery. When executive credentials appear in a stealer log or a fraudulent domain impersonating the brand is identified, those signals feed directly into the same operational model—triggering detection, investigation, and response through integrated workflows. That kind of convergence is where the threat intelligence market is headed—GreyMatter was built to operate this way from the start.

What Forrester’s Market Perspective Highlights

Forrester's report highlights three dynamics shaping the external threat intelligence market.

1. Main trend: Agentic AI being embedded into threat intelligence workflows to improve effectiveness and efficiency.

How we believe GreyMatter fits in: GreyMatter's Agentic Teammates leverage over 200 agent skills and 400+ AI tools to operate across threat intelligence workflows autonomously. The Threat Intel Teammate conducts research across the open, deep, and dark web and 57+ threat intelligence feeds to generate real-time threat reports tailored to a customer's specific environment. Together, the Agentic Teammates autonomously investigate and respond to 100% of alerts across 300+ technologies with 99.4% accuracy—more than 74 million times a year.

2. Primary challenge: Gaps in operationalizing intelligence and aligning it to business context.

How we believe GreyMatter fits in: GreyMatter closes the operationalization gap by correlating external intelligence against a customer's assets, identities, vulnerabilities, and IOCs in a unified model—then acting on it. The Detection Engineering Teammate reduces time spent on manual detection engineering by 70%, building, tuning, and deploying rules from natural language prompts.

3. Top disruptor: AI systems and applications that meaningfully enhance threat intelligence capabilities.

How we believe GreyMatter fits in: AI enhances every stage of the intelligence lifecycle within GreyMatter, from collection through response. GreyMatter customers contain threats in less than 5 minutes, and in a commissioned Total Economic Impact™ study of ReliaQuest GreyMatter, Forrester Consulting found that GreyMatter reduces Mean Time to Resolve by 75% for a composite organization based on interviewed ReliaQuest customers.

In one case, when Scattered Spider TTPs emerged, GreyMatter deployed seven detection rules across all customers in a matter of days—turning isolated threat research into network-wide protection.

To us, Forrester's market perspective confirms what we've seen operating across enterprise SOCs: the future of threat intelligence is operationalized, AI-driven, and embedded into the security operations lifecycle from collection through response.

GreyMatter makes that operational reality possible—giving security teams the foundation to detect, investigate, and respond before adversaries can execute.

Read the full Forrester report to see how the external threat intelligence market is evolving.

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here .

ReliaQuest Named a Visionary in the Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies

Mon, 04 May 2026 11:00:00 GMT

ReliaQuest Recognized as a Visionary in the 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies

At ReliaQuest, we've built GreyMatter on a clear belief: threat intelligence delivers the most value when it's operationalized across security operations for stronger, faster defense. That belief shapes how we approach every part of the platform.

We’re seeing how AI is accelerating attackers. In 2025, the fastest data exfiltration we observed was six minutes—down from over four hours the year before. Simply collecting intelligence for periodic review is no longer enough. Security teams need to go beyond collecting intel. They need to use it to power action.

Our approach starts with collecting and unifying threat intelligence into a single operational view within GreyMatter. In the 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies, Gartner recognized ReliaQuest as a Visionary for this approach.

For security teams, that recognition signals a shift: the future of threat intelligence is not simply in gathering more data, but in operationalizing it to help teams detect, investigate, and respond before adversaries can execute.

Threat Intelligence Is Too Valuable Not to Operationalize

Most organizations treat threat intelligence as a research function. Intelligence reports are skimmed during quarterly briefings as valuable intelligence that could have been used to autonomously update detection rules or trigger containment actions is instead filed away.

The reality is that threat intelligence is the foundation of proactive security operations. Without it, detection rules stagnate, investigations lack context, and response actions are generic rather than environment specific. The missed opportunities to leverage threat intel are often the difference between staying ahead of threats and falling victim to them.

When exfiltration happens in minutes and detection takes nearly an hour, intelligence that isn’t operationalized is just documentation.

How GreyMatter Operationalizes Threat Intelligence

Within GreyMatter, threat intelligence is continuously collected from over 50 feeds spanning deep, dark, and open web sources, combined with proprietary collection systems and human-led research. By correlating intelligence with assets, identities, vulnerabilities, and IOCs in a unified model, GreyMatter turns intelligence into direct operational context for detection, investigation, and response.

For example, when GreyMatter identifies a customer’s executive credentials in a stealer log, that signal doesn’t sit in a queue waiting for manual review. GreyMatter immediately triggers a detection update across your SIEM and EDR tools, scopes the impacted identities, and initiates containment actions. From there, teams can investigate and respond directly within GreyMatter, rather than switching between fragmented tools and workflows.

This is what it means to operationalize threat intelligence.

That shift from intelligence as reference material to intelligence as an operational driver is what moves a SOC out of reactive, into proactive—and ultimately predictive operations.

What Gartner Recognized In GreyMatter

Gartner's evaluation identified four core strengths in GreyMatter:

1. AI-orchestrated decisioning.

GreyMatter embeds agentic AI and automated workflows directly into the platform, enabling analysts to move from intelligence discovery to investigation to response in a single operational environment.

2. Integrated data fabric.

Rather than requiring centralized data ingestion, GreyMatter executes detection logic, enrichment, and response actions natively across your existing security tools.

3. Automated detection engineering.

GreyMatter supports automated rule creation, tuning, back-testing, and false positive reduction— streamlining workloads that traditionally consume significant analyst cycles.

4. Proprietary dark web intelligence.

Intelligence is aggregated through proprietary systems designed to surface malicious indicators, infrastructure, and threat behaviors, including exposed credentials, stealer-log data, ransomware signals, and activity across criminal forums.

In the 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies, Gartner recognized ReliaQuest as a Visionary. This placement validates what we've built in GreyMatter: a platform where threat intelligence functions as the connective tissue between detection engineering, alert triage, and response orchestration. And the impact is measurable. GreyMatter Agentic Teammates autonomously investigate and respond to 100% of alerts across 300+ technologies with 99.4% accuracy—more than 74 million times a year—while GreyMatter customers contain threats in under 5 minutes.

Our placement as a Visionary reflects more than strength in threat intelligence alone. It signals that the future of security operations lies in operationalizing intelligence across the entire lifecycle—from detection engineering to investigation and response.

That’s what GreyMatter customers already see in production: a platform where threat intelligence powers every detection, every investigation, and every response action autonomously, and at scale. That operational reality is what we'll continue to build on.

Gartner does not endorse any vendor, product, or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.

Attackers Have Gone Agentic. Defense Must Do the Same.

Mon, 15 Jun 2026 05:00:00 GMT

Cyber defenders are fighting a new kind of offense. Attackers have gone agentic. AI has given them speed, scale, and sophistication that removes the skills needed to execute advanced, widespread attacks that was impossible just a few years ago. What once required deep expertise and significant resources can now be done by anyone with access to the right AI tools.

Anthropic's Mythos model autonomously discovered thousands of zero-day vulnerabilities across every major operating system and browser—flaws that survived decades of human review and millions of automated security tests. Work that once took a specialist team weeks now happens in hours. AI is compressing the window between vulnerability discovery and weaponization to near zero. Multiple frontier AI models—including OpenAI's GPT-5.4-Cyber and Google's Big Sleep—already possess comparable capabilities and more will follow. The era of AI-accelerated attacks at scale is here. AI has given attackers three structural advantages:

Speed: AI-powered tools automate full attack cycles in minutes. The fastest exfiltration time recorded in 2025 was 6 minutes, based on ReliaQuest threat research.
Scale: AI allows simultaneous targeting of thousands of organizations. What once required an army now runs on a single prompt.
Skills Barriers Removed: Any actor with access to the right AI model can launch advanced, adaptive, targeted attacks at enterprise scale. AI tools like Mythos are clear demonstrations of this being a reality.

Meanwhile, the attack surface keeps expanding, and enterprise data is scattered across EDR, email, network, cloud, and SIEM. It exists in the hands of VIP employees traveling across the globe, partners, contractors, and customers. It lives on the open, deep, and dark web. It grows with every new acquisition, new business unit, new geography, and every new software the enterprise adopts—especially AI software.

Defenders must secure everything, everywhere, all the time. Yet most businesses still treat their security as something a team does in a room by watching the alert queue. A SOC team, a set of tools, an MSSP on call—that sufficed when threats were slow, data lived in one place, and human analysts could be stationary and keep up. That world doesn’t exist anymore. Security teams are more mobile and spread out than ever, just like the businesses they defend. Organizations must understand that security operations is not a cost-center, it’s the defense layer of the business, defending them from constant attacks.

The Market's Failed Response

The security market hasn’t helped. Instead of giving defenders a real solution, it keeps offering options that add complexity without fixing the architecture underneath:

Option 1: Centralize in a SIEM: Too expensive, too slow, requires per-tool query language and syntax knowledge that prevents acquiring headcount and talent, and leads to coverage gaps because you cannot store everything. This model once worked when threats moved slowly and a handful of tools covered the perimeter. That is not the case today.
Option 2: Outsource to MDR / MSSP: You lose control, speed, and the ability to tailor defense to your business. They are single-threaded and only look at a single tool in your environment. It is a black box that only specializes in one specific type or brand of tool management, eliminating the network effect across a wide span of customers.
Option 3: Increase Headcount: More humans doing human-speed work against machine-speed attacks slows response time down. Analysts drown in mundane work, always feel behind, and burn out because their talent is being wasted.
Option 4: AI Tools: Siloed AI capabilities across DCIR, startups without the operational depth to accurately work in production, and AI within the more established platforms cannot act beyond their own data. Most are not truly autonomous, and none have a consistent pricing model. They charge per token, per query, per investigation—passing unpredictable and uncontrolled AI costs directly to their customers. As usage scales, costs spike. As new models emerge, defenders cannot take advantage without re-procurement or heavy integration management.
Option 5: Build vs. Buy: Requires the specialized expertise, infrastructure, and time most organizations do not have. Accuracy is unproven at scale.

Attackers have gone agentic, gaining speed, scale, and the removal of skills barriers. But the same benefits attackers gain from AI can be given to defenders. Agentic AI can make them defend faster across any environment with a lowered skills barrier. You must defend AI with AI.

Agentic Defense: Defending AI with AI

Security operations is the defense layer of every organization—the team, the processes, the technologies working together to protect the business. When facing AI-accelerated attacks, that defense layer must become agentic.

Agentic defense is the application of agentic AI to existing security operations people, processes, and technology to make the defense faster, more accurate, and more fortified against the AI-accelerated attacks coming at it. The same foundation, now powered by agentic AI, defends AI-accelerated attacks at machine speed with near-perfect accuracy across the entire environment.

This means making the work defenders already do—detection, investigation, hunting, response, intelligence research—operate autonomously at scale. Detections are built and deployed by AI as new threats emerge. Threat hunts are executed across the entire environment autonomously before an analyst has to ask. Every alert is investigated immediately, with no queue. Gaps in coverage are identified and closed before an attacker finds them. When the entire security operation becomes agentic, threat discovery and response initiates in seconds.

ReliaQuest GreyMatter: Agentic Defense for the Enterprise

ReliaQuest GreyMatter, the agentic AI security operations platform, is the agentic defense layer for the enterprise. It levels the playing field and gives defenders the same three structural advantages agentic AI gives attackers, plus an added cost benefit:

Speed: Lightning Fast with Near-Perfect Accuracy GreyMatter agentic AI detects threats in seconds and contains them in under 5 minutes at 99.4% accuracy—the highest in the industry, proven across 1,300+ enterprises.
Scale: Defend Across Any Environment GreyMatter operates across 300+ technologies—SIEM, EDR, cloud, network, email, OT, and AI applications—across multi-cloud, hybrid, and M&A environments simultaneously. The attack surface keeps expanding. GreyMatter scales with it without requiring data centralization or additional headcount.
Skills Barriers Removed: Any Defender Can Operate at the Highest Level GreyMatter removes the skill barrier that has always limited who can participate in security operations. Any defender can defend any threat in plain language. It has six autonomous agentic systems, called GreyMatter Agentic Teammates, that deliver 3X the output of the existing security team without adding headcount—working continuously across every discipline, 24/7, without burnout or shift gaps.
Cost Efficiency: $2 to $4 Back for Every $1 Spent GreyMatter’s AI Model Broker controls AI cost at the infrastructure level—selecting the most cost-effective model for each task. The result is flat, predictable, unlimited pricing. No tokens, no queries, no per-investigation charges. Customers consistently re-architect their security environment for efficiency and see $2 to $4 in return for every $1 they spend.

GreyMatter gives any defender the ability to harness AI to detect threats, run investigations, and execute response faster across their entire tech stack in plain language, without needing to be an expert in every tool they own. The result is an AI defense prepared for any AI accelerated attack.

The Time to Level the Playing Field

Attackers have gone agentic and the threat is not slowing down. AI has fundamentally changed the rules. The window between vulnerability discovery and exploitation has collapsed. The volume of attacks is increasing. The sophistication is accelerating.

Organizations that transform their defense layer now—while attackers are still learning how to use these same AI capabilities offensively—will have a structural advantage.

ReliaQuest is an agentic AI cybersecurity company whose platform, GreyMatter, serves as the agentic defense for the enterprise—defending organizations against AI-accelerated attacks.

Agentic Attacks Have Already Hit Finance. The Defense Architecture Hasn't Caught Up.

Wed, 27 May 2026 04:00:00 GMT

Phishing infrastructure targeting financial services has tripled in a single quarter—now accounting for half of all observed threat activity against the sector. Brand-impersonating domains have overtaken credential exposure as the dominant digital risk signal, feeding account-takeover pipelines at scale.

Nearly 150 financial organizations hit by ransomware in 90 days, with Clop and DragonForce demonstrating deliberate sector specialization above all-industry baselines.

These campaigns share a structural characteristic: they're multi-vector, machine-speed, and low-skill to execute.

What AI Offense Looks Like in Practice

Actor	Technique	Fraud Vector
Lazarus Group	Fake developer recruitment pipelines, fabricated repositories	Credential theft at scale
APT42	Spearphishing via .lnk files with Dropbox C2	Executive account takeover
UNC1069	Deepfake Zoom calls + ClickFix lures	Authorized push payment fraud

Each operates with an automation layer that removes the skills barrier—what required specialized teams three years ago now scales with commodity AI tooling.

For a sector where minutes of service disruption carry regulatory exposure, fraud loss, and brand damage, the math is stark: mean time to contain rose 49% last quarter to 2 hours and 34 minutes per incident.

Every one of those minutes is active exposure—funds moving, credentials being monetized, lateral movement progressing.

Why the Current Architecture Can’t Match AI Offense

Current defense models share a structural failure—they leave the underlying architecture intact:

Centralize in a SIEM—too expensive, too slow, creates coverage gaps the moment ingestion costs force tradeoffs
Outsource to MDR—single-threaded visibility into one tool, no network effect across the environment, no tailoring to your business logic
Add headcount—human-speed work against machine-speed attacks, burnout for the people you can least afford to lose
Siloed AI tools—can't act beyond their own data boundaries, no unified picture to operate on

That world is gone. Enterprise data now lives across EDR, email, network, cloud, SIEM, and in the hands of executives traveling globally. It grows with every acquisition, every new geography, every AI tool the business adopts. Defenders must secure everything, everywhere, continuously—and they're doing it with architectures that force analysts to pivot between six disconnected tools per investigation, manually re-querying across incompatible schemas.

Centralizing everything in a SIEM is too expensive, too slow, and creates coverage gaps the moment ingestion costs force tradeoffs. Outsourcing to MDR providers means single-threaded visibility into one tool—no network effect across the environment, no tailoring to your business logic. Adding headcount puts human-speed work against machine-speed attacks and burns out the people you can least afford to lose. And siloed AI tools can't act beyond their own data boundaries—they have no unified picture to operate on.

The consistent failure across all of these: they leave the underlying architecture intact. Detection still happens after centralization. Correlation still requires manual field mapping. Response still waits for a human to connect signals across tools.

What Agentic Defense Actually Requires

If offense is automated, multi-vector, and operating at machine speed across distributed infrastructure—defense must match it structurally. That means:

Detection before centralization. Applying correlation logic in-transit closes the gap between telemetry generation and threat identification to seconds.
Schema-native correlation from day one. Automatic field-level normalization at ingest eliminates the manual translation bottleneck across every connected technology.
Autonomous, multi-disciplinary response. Parallel investigation across identity, endpoint, network, and email simultaneously—matching the multi-vector structure of agentic attacks.
Cost architecture decoupled from usage. Defenders should never face a choice between investigation thoroughness and budget.

GreyMatter: Agentic Defense in Production

ReliaQuest built GreyMatter's architecture around these requirements. The Universal Translator maps every field from 300+ connected technologies to OCSF at the moment of integration—schema-native correlation from day one.

GreyMatter Transit applies multi-event detection logic to data in motion, firing correlation rules before anything is parsed or stored—5 seconds from telemetry event to validated alert.

Six autonomous agentic systems decompose security disciplines into hundreds of single-task agents. The IR Analyst teammate breaks every investigation into parallel component tasks—email metadata, identity anomalies, endpoint telemetry, domain reputation—each routed through an AI model broker that selects the optimal model per task.

Across ReliaQuest's finance customer base, Automated Response Playbooks execute containment in 4 minutes 46 seconds. The sector average: 2 hours and 34 minutes.

The 5 Stages to Common Finance Fraud Attacks—and How to Stop Them

Tue, 07 Jul 2026 09:00:00 GMT

Attackers targeting financial institutions have moved up the stack. Instead of attacking infrastructure head-on, they go straight for identity, trust, and human behavior—the layer where a stolen credential becomes a wire transfer. What looks like five separate fraud types is usually one operation moving through stages, each setting up the next. Under each stage are the named attack types it covers—the fraud your team likely already tracks, shown in the order a full operation tends to move through. Follow it from the outside in, and the places to break the chain come into focus.

Stage One: Harvesting Credentials Outside the Perimeter

Credential theft · brand and domain impersonation · dark-web credential exposure

The operation starts where internal tools have no visibility. Adversaries register lookalike domains, clone login pages, and harvest customer and employee credentials at scale before validating them against real authentication surfaces. In Q1 2026, impersonating domains overtook credential exposure as the dominant external risk signal against finance.

This is the cheapest point to interrupt the chain, because no valid session exists yet—and interrupting it means looking outward, not just inward. Monitor domain registrations for lookalikes of your brand, watch dark-web and paste sites for leaked credentials, and pursue takedowns on spoofing infrastructure before it goes live. Phishing-resistant MFA such as FIDO2 or passkeys does the rest: even harvested credentials don't yield a usable session.

Stage Two: The AI-Generated Lure

AI-generated phishing · spearphishing · business email compromise (BEC)

Phishing-for-information was the single top MITRE technique against finance last quarter. Commodity AI tooling stripped out the skill and time these campaigns used to demand, so volume and quality climb together—and they move faster than most pipelines can keep up. If detection logic only runs after data lands and indexes in a SIEM, you're measuring response in hours while the attacker measures it in minutes. Closing that gap is mostly about proximity and automation: run detection as close to the event as possible, automate phishing triage so analysts aren't hand-reviewing every reported email, and enforce DMARC, DKIM, and SPF so spoofed senders fail authentication before they reach an inbox.

Stage Three: Impersonation That Turns Access into Approval

Executive impersonation · deepfake fraud · authorized push payment (APP) fraud

A foothold isn't a payout. To move money, the operation needs authority, so it escalates to the people who have it. The target is a finance leader who can approve a transfer, reached through a channel no perimeter tool watches.

Technical controls alone won't stop a convincing deepfake; process will. Require out-of-band verification for payment approvals above a threshold, using a known callback number rather than contact details supplied in the request itself—the single most effective control against authorized push payment fraud.

Detection has a role too, but only when the signals combine: an anomalous executive login means little on its own and a great deal alongside a payment approval request arriving through an unusual channel or at an odd hour. Threat intelligence that maps these actors' known techniques to your environment is what turns "unusual" into "recognized.”

Stage Four: Moving Like an Insider

Account takeover · privilege abuse · insider threat

Once the operation holds legitimate credentials and executive cover, it stops looking like an attack. A permission change in identity, a data pull in SaaS, an access pattern in cloud—each event looks ordinary in its own tool, and surfaces as a threat only when all three are read as one sequence.

This is a correlation problem before it's a detection problem, and teams lose here when their signals sit in incompatible schemas that force manual stitching. Normalize telemetry across identity, SaaS, endpoint, and cloud so behavior reads as a single sequence. Enforce least privilege and just-in-time access so one compromised account can't roam. And baseline normal behavior per identity, so the abnormal data pull stands out against that user's own pattern rather than a generic threshold everyone trips.

Stage Five: The Payout

Wire fraud · ransomware · data exfiltration

The operation ends in a transfer, an exfiltration, or ransomware—and finance ransomware surged 44% quarter over quarter. Much of that pressure is opportunistic: Clop’s mass exploitation of managed file-transfer tools like MOVEitand Cleo hit the sector hard precisely because finance relies on them, while groups like DragonForce show more deliberate sector focus. Every minute here is active loss, which makes two things decisive:

Detect on behavior rather than payloads, because these operators live off the land with signed binaries that signature tools wave through; the tells are the actions, such as mass file access, unusual outbound transfer, and credential dumping.
Contain automatically. A human connecting signals across tools is too slow at this stage, so isolating a host, disabling an account, or blocking a destination has to happen without waiting on manual triage.

Where GreyMatter Fits

Every stage above describes defense that should happen. The hard part is doing all of it, across every tool, fast enough to matter. That's the agentic defense layer GreyMatter is built to be.

GreyMatter detects at source, at storage, or in transit, running multi-event correlation on data while it is still streaming, before it is parsed, indexed, or stored—which takes mean time to detect from hours to seconds. The Universal Translator maps every field from 300+ connected technologies into a unified OCSF schema the moment each tool connects, so identity, endpoint, SaaS, and cloud activity correlate as one sequence without centralizing the data first; that is the stage-four correlation problem, solved at ingest.

Six agentic systems cover the disciplines a lean team can't staff: the IR Analyst Teammate investigates every alert autonomously at 99.4% accuracy, while threat intel continuously maps finance-sector actor behavior to your environment. For financial services, that adds up to containing identity-based attacks at machine speed and producing a full audit trail for DORA and SEC compliance.

ReliaQuest's finance customers have reached average mean times to contain of under 5 minutes; Donnelley Financial Solutions cut its own from two hours to three minutes. Your existing tools stay where they are. GreyMatter reads them as one defense instead of six.

Infrastructure Health, Now Agentic: The IT Engineer Teammate Is Here

Wed, 29 Jul 2026 09:00:00 GMT

Healthy Tools Are the Foundation of Every Investigation

Technology and infrastructure health is the foundation of the SOC. Investigations, threat hunts, and detection engineering all assume the same thing: the tools underneath are up, generating telemetry, and functioning as intended. When that assumption breaks, the rest of the SOC breaks with it.

The failures are rarely loud. A log source stops sending data. A connector drops. A parser silently degrades. Each one generates a health alert, and each one opens a blind spot in detection—coverage the team believes it has but no longer does. A ransomware rule that stops firing looks identical to a quiet environment. A threat hunt that returns zero results looks like good news—until someone learns the endpoint sensors feeding it went offline 7 days ago.

Meanwhile, every new tool adds operational drag. Engineers spend hours manually triaging health alerts—pivoting between consoles to answer basic questions about cause, urgency, and recovery—time that gets pulled directly out of real security work.

Meet the IT Engineer Teammate

GreyMatter's IT Engineer Teammate is a persona-based agentic system built into the platform, purpose-built to monitor, triage, and investigate the health of your security stack. It autonomously investigates every health alert, answers questions in chat, runs connection and credential tests, surfaces chronic issues, and learns your environment over time through Agentic Memory. It also adds firewall configuration analysis in chat and coordinates directly with the Detection Engineer, Threat Intel Analyst, and Threat Hunter.

It is one teammate in the multi-agentic system GreyMatter orchestrates—alongside the IR Analyst, Threat Hunter, Threat Intel Analyst, Detection Engineer, and OT Engineer—each decomposed into hundreds of single-task agents so accuracy holds as work spans disciplines. Each system owns its discipline end-to-end but collaborate across disciplines without being asked, delivering agentic defense-in-depth.

Core Capabilities

Autonomous Investigation and Enrichment.

Every health alert is investigated end-to-end before it reaches you—historical baseline drawn from the past 8 weeks, real-time state from GreyMatter, cross-alert correlation, and severity assessment. The alert arrives with an answer attached, not a data point to chase.

Conversational Triage and Support.

Ask follow-up questions in plain language without re-explaining context. Get step-by-step troubleshooting, field definitions, and integration setup guidance directly in chat.

Proactive Validation and Diagnostics.

On a failure, the Teammate executes connection tests against direct source connections and log sources, validates authentication, and returns tailored remediation guidance.

Predictive Monitoring and Pattern Recognition.

Instead of surfacing 20 identical alerts across weeks, the Teammate distinguishes one-off failures from systemic problems and flags degradation trajectories—"EDR sensor failures recurring on the same host group"—so the team can act at the root.

Agentic Memory.

The Teammate learns maintenance windows, baseline log volumes, and escalation preferences, then applies them automatically. Tell it "expected during Sunday 2 AM maintenance—don't alert," and it recognizes future Sunday failures as expected, confirms connections restore afterward, and only alerts if something fails outside the window.

Firewall Configuration Support.

Upload a configuration in chat and receive prioritized, line-referenced recommendations, a complete updated configuration file, and—on request—a side-by-side comparison explaining the security and performance impact of each change.

How It Works

The IT Engineer Teammate builds on the connections GreyMatter already has to the technologies in your stack. There is no separate install. It leverages those existing API connections to the sources it monitors, watching their health and triaging the alerts they generate—the same way the IR Analyst Teammate triages a security detection.

When a health alert fires, the Teammate investigates and enriches it autonomously, then shows its work. Agentic Steps Transparency exposes every step on the alert—which tools ran, what was queried, and why the Teammate reached its conclusion.

Health also stops being a separate silo. As one of the teammates in GreyMatter's multi-agentic system, the IT Engineer Teammate collaborates with the Detection Engineer, Threat Intel Analyst, and Threat Hunter across disciplines without being asked—so an infrastructure problem surfaces as a coverage problem the moment it matters.

Ask in Plain Language, Get an Answer Grounded in Your Environment

You can also work with the Teammate directly in natural language—no dashboards, no query syntax. Ask the IT Engineer Teammate:

"What caused this connector failure and how do I fix it?" The IT Engineer identifies the root cause, runs a connection and credential test against the source, and returns step-by-step remediation guidance you can execute immediately.
"Is this log source outage urgent?" The IT Engineer scores severity against the source's expected volume and the detection coverage that depends on it, so urgency reflects operational impact rather than alert volume.
"Has this alert fired before, and how often?" The IT Engineer pulls the historical baseline from the past 8 weeks and reports recurrence, frequency, and whether the pattern is trending toward failure.
"Show me chronic issues that need strategic attention." The IT Engineer surfaces recurring problems and degradation trajectories that warrant infrastructure-level action instead of another one-off ticket.
"How is this SIEM parsing failure impacting my detection coverage?" The IT Engineer coordinates with the Detection Engineer to map the failure to the specific rules and coverage at risk.
"Review this firewall configuration and recommend improvements." It returns prioritized, line-referenced changes and a complete updated config, with a side-by-side impact comparison on request.

Answers that once took 30 minutes of console-hopping arrive in about 2 minutes, grounded in your environment.

Use Cases

Collapsing Chronic Noise Into One Root Cause.

An EDR sensor fails on the same host group every few days. Handled as isolated alerts, it produces 20 near-identical tickets across a month and never gets prioritized. The IT Engineer Teammate recognizes the pattern, collapses the noise into a single finding—"EDR sensor failures recurring on the same host group, recommend infrastructure capacity review"—and points the team at the cause instead of the symptom.

Closing a Silent Detection Gap.

A ransomware detection rule stops firing. On its own, that looks identical to a quiet environment. The Detection Engineer Teammate asks the IT Engineer Teammate whether a data problem is behind it. The IT Engineer traces a configuration error that broke processing 36 hours earlier, monitors restoration, and notifies the Detection Engineer to replay the affected detections. The customer receives one clear notification and closed coverage rather than a silent gap.

Hardening a Firewall Configuration on Demand.

A network engineer uploads a firewall configuration directly into chat. The IT Engineer Teammate returns prioritized, line-referenced recommendations, a ready-to-paste updated configuration, and a side-by-side comparison that explains the security and performance impact of each change. Config review moves from a periodic manual chore to an on-demand check.

Availability

GreyMatter Health is delivered to all GreyMatter customers automatically, with no customer action required—core visibility and triage of health alerts. The IT Engineer Teammate and cross-Teammate coordination is live with an active Teammates package.

Shadow AI Is a Non-Human Identity Problem Wearing a Different Name Badge

Wed, 22 Jul 2026 00:00:00 GMT

Shadow AI hunting does not start with employees pasting data into ChatGPT.

That is where most security teams start, which is not a bad instinct, just an easy one. Consumer chatbot use is visible, the services are known, and blocking unauthorized traffic is easily solved.

Spend more time thinking about the AI tooling used by engineering and data teams.

These teams connect tools to source code, CI/CD pipelines, cloud environments, databases, APIs, and production systems. Some tools have no separate account in the corporate identity provider. Others operate through credentials assigned to a human user.

A security team can monitor every visit to ChatGPT and still miss the activity that creates the greatest Shadow AI security risk: AI tooling with access to production.

For more on agentic architecture and non-human identity, our guide on AI Agents vs. Agentic Systems in Security Operations covers the underlying concepts.

Why the Shadow AI Conversation Starts in the Wrong Place

Ask security teams about Shadow AI, and most will talk about user input. They want to know whether employees are pasting customer records into ChatGPT or uploading confidential documents to public models.

This fear is common. According to a study by Gartner, 69% of companies suspect that their employees are using unauthorized public GenAI technology. However, focusing on public tools can pull attention toward the activity that is easiest to spot.

Detection from the engineering team’s side is harder. A developer integrates a coding tool with a repository, or a data scientist calls an external model within an analytics flow. A development team might integrate an AI service into an application via an API without creating a new SaaS account that can be easily detected by security.

Look there before assuming browser activity says much about your organization’s real exposure.

Most people adopt these tools with good intent. The risk depends heavily on the access surrounding the tool. An AI service that helps rewrite an email presents one set of concerns. A tool connected to systems that build and deploy software presents another.

Where Shadow AI Actually Surfaces First

Engineering teams work with repositories, build systems, deployment pipelines, cloud infrastructure, secrets, and production applications. Data teams may work with customer records, proprietary business data, analytics environments, and production data stores.

When either team adds AI to an existing workflow, the tool can gain access to sensitive systems, expanding the AI attack surface.

Analysts need to establish what it can read, what it can change, which credentials support it, and what other systems trust those credentials. A low-privilege experiment against synthetic data deserves a different response from an unsanctioned service connected to production code.

We would prioritize according to blast radius. Understanding that blast radius is what allows real risk-based decisions.

Why It Spreads Faster and Hides Better Than Traditional Shadow IT

There is a distinction between Shadow IT and Shadow AI. Traditional Shadow IT often leaves something concrete behind: an application, cloud service, account, network connection, or expense.

Sometimes, Shadow AI is already embedded in your workflows. A developer connects a third-party model to an approved application through an API, or adds AI capabilities to engineering tools already in use. The tool may then operate with an employee token or existing service credential.

Nothing has to appear as a new AI account in Okta or Google Workspace.

Security operations centers (SOCs) may see legitimate credentials interacting with legitimate systems and have no obvious indication that an unsanctioned AI tool sits between the person and the action.

Experiments can also become permanent before governance catches up. By the time security finds the tool, colleagues may already depend on it.

The Visibility Gap: Why “We Monitor ChatGPT” Isn’t an Answer

Browser monitoring shows which AI services users access through channels that are monitored. It does not show every model called through an API, all AI components inside an engineering pipeline, or each tool operating through an existing credential.

Often, telemetry is the first limitation.

If you do not gather relevant identity events, API activity, repository changes, credential use, pipeline behavior, and cloud actions, you will be unable to piece this activity together later. There is no detection solution that can recover data that was never collected.

It becomes even more difficult when this activity is carried out under a legitimate identity. A known user, valid token, and expected permissions can still give an analyst the wrong impression about who, or what, performed an action.

What’s Actually at Risk: Source Code, Pipelines, and Credentials

Within engineering environments, pay particular attention to source code, credentials, and CI/CD pipeline security.

Source repositories hold the company's intellectual property and operational knowledge. Pipelines link development and deployment. The credentials used for these processes could grant access beyond the system where the investigation starts.

The time available to investigate that access is also shrinking. Recent threat research recorded the fastest lateral movement at four minutes, the fastest data exfiltration at six minutes, and an average breakout time of 34 minutes.

An AI tool connected anywhere in that chain may influence more than its immediate task.

Data teams face a similar issue. A third-party AI service connected to an analytics environment or production data store may gain sensitive access without creating the visible footprint security teams expect from Shadow IT.

The practical question is how far an action can travel if the tool, credential, or workflow behaves unexpectedly.

The Identity Problem Underneath It All

Consider a user called Bob.

Your logs show Bob modifying code, calling an API, or interacting with a production system. Bob may have performed the action himself. An unsanctioned AI tool may also have performed it using Bob’s credentials or through a workflow he initiated.

The identity record cannot settle that question, which is one of the trickiest problems in AI identity management.

The AI tool may never receive its own account. Bob is still the authenticated identity even when software makes decisions and takes actions on his behalf.

This is becoming an increasingly important identity issue as AI systems become more autonomous. The National Institute of Standards and Technology (NIST) has advocated for adaptive identity and access controls that account for the growing role of non-human identities.

Security teams cannot work without behavioral context. Sudden changes in repository activity, API sequences, credential use, access timing, or velocity may warrant investigation.

With GreyMatter, we correlate activity from current security solutions and environments, enabling analysts to view identity activity alongside other telemetry and potentially gain insight into permissions, behavioral context, and blast radius without having to reconstruct activity across disconnected console environments.

Security teams also need to know who has the means to influence, push, or chain together internal systems built on top of AI.

Inside GreyMatter, Agentic Teammates inherit the permissions of the user who initiated the request. In other words, if the user cannot access a resource or perform an action, neither can the agent.

Building Detection from Scratch: The First Three Signals

We recommend starting with:

Behavioral baselines. Monitor significant shifts in velocity, time, access patterns, and behaviors of identities who have the ability to change code, pipelines, production systems, or sensitive data.
Credential vaults and approved tooling. Monitor the credentials used by approved tools to connect to important systems, which may indicate compromise of the visibility layer itself.
Error-handling and retry behavior. Look out for processes that interpret errors, tweak inputs, select a different tool, or try an alternate path to achieve the same goal.

The third signal deserves attention. Scripted automation tends to fail according to predefined logic. AI-driven activity can adjust after failure.

Do not treat that pattern as proof of AI; use it to identify activity that warrants closer investigation.

Response Without Becoming the Department of No

We do not believe security teams can prohibit their way out of Shadow AI.

Most employees who introduce these tools are just trying to get their work done. If every new AI use case meets an automatic block, engineering and data teams will continue experimenting without involving security. The organization loses the cooperation it needs to understand access and risk.

The RACI needs to be explicit about who can authorize an AI application, who evaluates access to the application, who takes responsibility for the risks produced by the application, who observes behavior, and who intervenes in case of an anomaly.

Shadow AI does not fall under any particular function; security, engineering, IT, compliance, and data management functions may all play some role. The problem is when each thinks the other will handle the issue.

Closing perspective: Shared Ownership is a Challenge

Shadow AI reveals that several teams may own parts of the problem without clear boundaries between them.

Consumer chatbot monitoring still has value, but it does not tell you which AI tools can modify source code, use trusted credentials, influence deployment pipelines, or connect to production data.

The CISO must understand who has approval authority to introduce an AI application into production, who changes the AI application's guardrails, and who is responsible for investigating activity performed by a legitimate identity that does not fit the user.

If these questions hinge on assumptions, risk decisions become a guessing game. CISOs need evidence of who can influence these systems and how far that influence can travel, rather than relying on what they have been told.

Request a GreyMatter demo to see how identity and behavioral context can support security investigations across your environment.

Data Poisoning: What Threat Hunters See That Governance Frameworks Miss

Wed, 22 Jul 2026 00:00:00 GMT

AI data poisoning rarely starts in a training set. For most organizations, it starts in the vendor, package, or pipeline that delivers the model.

In practice, we spend more time looking upstream, at the vendors, packages, datasets, software components, and CI/CD pipelines that deliver AI capability. An attacker who compromises one of those dependencies may influence what an AI system trusts before the organization using it realizes anything has changed.

For many organizations, the immediate exposure sits in the supply chain and in the identities that can influence it.

For readers who want the foundations of agentic architecture first, our guide on AI Agents vs. Agentic Systems in Security Operations discusses the underlying concepts.

Why Data Poisoning Discussions Start in the Wrong Place

The textbook explanation of data poisoning attacks talks about bad data entering a training set. An attacker manipulates examples, the model learns from them, and its behavior changes as a result.

The conversation tends to focus on “AI slop” ending up in training data. But the real exposure for most organizations is in the systems and pipelines delivering these components, not the training data itself. Most organizations use frontier or open-source models rather than training their own, then build scaffolding on top of them.

MITRE ATLAS is indicative of the wider AI attack surface. The knowledge base includes the use of poisoning training data, the publication of poisoned data sets and models, and the publication of poisoned AI agent tools.

We also draw a clear line between poisoning and tampering. Poisoning actively manipulates the data used to shape a system. AI model tampering changes how data or model output gets interpreted without necessarily altering the training data itself.

The distinction affects the investigation. Label every unexpected change in AI behavior as poisoning, and threat hunters may start from the wrong evidence.

The Highest-Value Targets Right Now

We start with anything pulled from public libraries, third-party packages, off-the-shelf software, and quickly assembled or vibe-coded applications.

Every dependency introduces another trust decision. Packages change. Vendors get compromised. Components can arrive with behavior the organization never reviewed.

NIST’s AI Risk Management Framework asks for policies and monitoring of third-party software and data. This approach seems appropriate. It’s also where things end. Policies and monitoring confirm that the vendor was checked at the point of onboarding. However, they don’t provide much insight into whether the model or component behaves differently now compared to a few months ago.

That’s what the threat hunter focuses on: confirming that the policy exists or catching the exact moment when the system deviates from its normal baseline behavior.

We also pay particular attention to LLM-as-a-judge systems.

Organizations increasingly use one AI system to grade, check, or validate another AI system’s output. This can improve quality and support autonomous AI guardrails, but it also creates an authoritative decision point.

If an attacker compromises the system trusted to evaluate AI output, downstream controls may continue accepting decisions from a judge that can no longer be trusted. That makes LLM-as-a-judge poisoning a particularly useful target for an attacker.

Supply Chain or Insider Threat? A False Distinction

Many governance frameworks view insider risk as separate from external compromise. In an investigation, the route into the environment may be less important than what the attacker or insider gained access to.

External attackers often compromise vendors or packages, while insiders use their sanctioned access to influence datasets, components, or pipelines. Both actors can reach systems that build, approve, and deliver AI capabilities.

Knowing who can influence the pipeline is the starting point for assessing blast radius.

AI supply chain security depends heavily on identity, including non-human identity security. Teams need to know who can approve training data, modify evaluations, introduce models or components, and connect systems.

Without that information, any assessment of blast radius relies on assumptions alone.

What Poisoning Looks Like to a Hunter Who Isn’t Looking for It

A poisoned system does not have to look broken.

A hunter may first see a change in behavior. An evaluation starts passing output it previously rejected. A model responds differently under a familiar condition. A guardrail continues to run but stops producing the expected result.

Detection isn’t possible without a reliable picture of normal behavior.

Since most organizations use frontier models rather than training their own, the real place to hunt is the scaffolding and wrappers built around those models, wherever guardrails live (code repositories, evaluations).

Any deviation from a known-good evaluation result is the signal to chase.

The Months-Long Blind Spot, and Why There’s No Clean Playbook Yet

A poisoning event may not produce an obvious incident when it happens. The affected component can remain inside a workflow until a particular condition causes the altered behavior to surface.

Organizations need the ability to investigate by extracting away the model layer and focusing on intended outcomes, but a true incident response playbook for this specific scenario doesn't really exist yet.

It comes down to observability: the telemetry built around a system, and understanding where and how an intended outcome would manifest in production or client-facing infrastructure if something went wrong.

IBM’s 2025 breach research gives some context for the wider supply chain problem. Third-party vendor and supply chain compromise carried an average breach cost of $4.91 million in its study.

Agentic AI Turns One Compromised Node into a Compounding Problem

Agentic systems create a compounding effect, and that is where agentic AI security risk looks different from risk in a standalone model. They are a mix of disparate systems chained together, whether through hard-coded paths or the agentic layer calling the right things at the right times. If one node in that chain is compromised, the input or behavior passes from node to node to node, and the problem compounds.

That can make agentic systems more lucrative targets than a standalone large language model because the blast radius through dependencies is wider.

The dynamic has flipped. Historically, security teams pushed the business toward better practices and investment. Now the business is pushing security teams to adopt AI faster, with pressure from the board level to avoid “falling behind.” Security is on the other side of the table, trying not to block innovation while still figuring out how to enable it safely. It has created what amounts to a reverse fire drill.

Security teams need to address approved components, permission boundaries, evaluation baselines, and limits on autonomous action before deployment.

Building Detection from Scratch: The First Three Signals

Three things come first. Provenance verification maps where every dataset, model, and component came from, tracing the dependency chain step by step. Behavioral monitoring catches a downloaded model doing something unexpected at load time. And identity controls log who can touch or influence the model, who approves training data and samples, and who can build agentic systems on top of it, with least privilege applied throughout.

As complexity grows and more people become involved, there are more opportunities for things to fall through the cracks.

GreyMatter's Universal Translator normalizes telemetry from disparate tools into a common schema at ingest, mapping identity and behavioral signals from every connected environment into one investigative view. An analyst can then trace whether a change in model or evaluation behavior lines up with activity from a specific identity, component, or dependency.

That context does not prove poisoning happened, but it arms investigators with evidence to test whether changed behavior connects to something in the surrounding system.

Closing Perspective: Don’t Let This Eclipse the Real Question

We think AI data poisoning gets more attention than its current risk warrants for many organizations.

The current risk varies sharply by environment. Organizations building agentic systems have more reason to prioritize it because dependencies widen the potential blast radius. Most companies, at a macro level, are still consumers of models rather than builders of complex agentic systems.

For the average organization, the bigger concern is whether the partners and providers they rely on are asking the right questions and taking poisoning risk into account on their behalf. That may matter more than whether the organization itself is a direct target.

Internally, CISOs should be able to answer quickly and continuously who has the means to influence, push, or chain together systems built on top of AI. That is the starting point because it defines the blast radius. Without that understanding, risk decisions become a guessing game, with CISOs relying on what they have been told rather than demanding evidence.

If you’d like to see how identity and behavioral context can support security investigations across your environment, request a GreyMatter demo.