The Insider Threat That Doesn’t Sleep

AI now shows up twice in security operations: once as a tool, once as something to watch.

Detection engineers are already extending SIEM rules with machine learning, because real threats are too variable, subtle, or complex for a static threshold to catch. At the same time, autonomous agents authenticate, call APIs, access data, and complete multi-step workflows on their own. They are not applications issuing predictable requests. They hold credentials, act on their own initiative, and from a detection standpoint behave a lot like insiders.

Using AI for security and securing AI are usually separate conversations. Three of our upcoming sessions at .conf26 treat them as one: learn the detection method, meet the actor it has to account for, then apply it to an agent-driven attack. For the behavioral use cases connecting these sessions, the workflow is the one you already run: find the data source, learn what normal looks like, engineer features, pick a technique, test against reality. Only the entity generating the data is new.

All three sessions are led by the SMLS team alongside collaborators from across the company, drawing on their shared experience building and running these detections in production.

Session 1: Learn the Method

The Detection Engineer's Guide to the AI/ML Universe [SEC1438] is a 90-minute hands-on workshop for practitioners extending SIEM detections with ML. The hard part of adopting ML isn't choosing an algorithm but reframing the problem. A conventional detection starts with a known condition: a command, an IP, an event. An ML-based detection starts with a harder question: what does expected behavior look like, and which deviations deserve attention?

Answering that takes a full lifecycle: define the objective, understand the data, choose a technique, and decide how success is measured. Feature engineering sits at the center, because models don't grasp security context on their own. Raw timestamps, usernames, and status codes become useful only as signals: frequency, rarity, velocity, sequence, drift from baseline. Deliberately broader than any single threat, the workshop leaves attendees with a reusable skill: turning an unfamiliar data source into a working detection.

Session 2: Meet the New Actor

When the Agent Becomes the Insider: Preparing Security for the Agentic Era [SEC1371] picks up where Session 1 leaves off: what if the unfamiliar data comes from an unfamiliar actor? An agent can adapt later actions based on earlier results, making it a distinct network actor, not a faster script. It can hold legitimate credentials and still create risk: misconfigured, manipulated through malicious input, over-permissioned, or nudged outside its role. Identity tells us who or what acted; authorization tells us whether it was permitted. Neither tells us whether it was expected.

Agents also run at machine speed through workflows that may not fit existing human or automation baselines. Judge one by human standards and you risk a flood of false positives; treat it as automation and you risk missing the anomaly. The session covers how agents behave in real workflows and what teams must ask: which identity is it using, what can it access, and when has it drifted from its role or its peers?

Session 3: Apply the Method to the Threat

Agentic Risk, Familiar Techniques: Hands-On AI Agent Attack Analysis [SEC1812] closes the loop. Participants identify entities in raw agent telemetry, engineer features, establish baselines, and build detections. Same lifecycle, new actor. The data is agent telemetry: tool calls, resource access, and the sequence of steps taken toward a goal. Features built from it might capture unusual tool use, access to unexpected resources, shifts in action frequency, or behavior that breaks from the agent's established role. No single signal proves malicious intent, but together they reveal a pattern worth investigating.

It culminates in Splunk Behavioral Analytics catching a simulated attack, and that's the argument: behavioral analytics and entity modeling already do the heavy lifting, so there is no new discipline to invent. The detection engine exists. The challenge is giving it visibility into the agent, which is a telemetry problem before it is a modeling one.

New Actor, Familiar Discipline

AI agents aren't a reason to discard detection practice; they're a reason to aim it at an entity most organizations haven't modeled yet. They bring new identities and telemetry, but detecting threats from them runs on the discipline teams already use for insiders: collect the evidence, engineer the features, define the baseline, flag what breaks it. A new entity type, not a new paradigm.

Each session stands alone, but taken in order they cover the method, the actor, and the attack. You already know most of the method. Now point it at the agents.

Acknowledgements

None of this comes together without the people behind it. Sincere thanks to Glory Avina, Philipp Drieger, Abhinav Mishra, James Young, Ania Kacewicz, and Jud Dagnall, whose expertise, guidance, and hands-on work shaped all three sessions and the thinking that runs through them.