Security Tools Don't Detect Attacks—Humans Do
summary
Claim: security tools produce observations not detections, and detection requires Inference-Driven Detection that chains alerts across identity, endpoint, network and cloud into a coherent attack narrative. Demonstrates a Monday-morning example where four separate alerts (login anomaly, PowerShell exec, Kerberos ticket anomaly, remote lateral move) only become high-confidence credential theft when probabilistic hypothesis-updating and a dynamic identity state are combined. Describes building an LLM-assisted system that synthesizes evidence into a human-readable evolving narrative (LLM-assisted narrative) to scale investigative reasoning without replacing analysts.
AI-written summary · about
chapters (6)
- 0:00Introduction by Kripa
- 1:48Tools vs human detection gap
- 3:34Observations vs conclusions
- 10:05Symptoms vs diagnosis analogy
- 17:27Investigative security systems
- 20:20Future of cybersecurity
related talks
49mFight Smarter: Accelerate Your SOC with AI Discovered Attacks
20mDynamic Defense: Crafting threat models with real-world Intelligence
34mYour Intrusion Detection Still Sucks (And What to Do About It)
29mDetection Engineering: Defending Networks with Purpose
20mCatch Attackers Before They Strike with AI-powered Threat Intelligence
35mThe Best Defense is a Great Offense: Leveraging Automated...
40mTotal Security: Investigative Perspectives from Public to Private Sector
45mHacking Heuristics