Fighting fire with fire is a known response. Fighting AI attacks with AI defense is a growing practice. But instant remediation is new and welcome.
Sevii has extended its Autonomous Defense & Remediation (ADR) platform with a new AI security module. As the speed and scope of AI driven attacks increases, it requires an AI defense. Since companies are rarely aware of all the shadow AI used within the organization, this defense needs to operate at runtime irrespective of source, with effectively immediate and autonomous remediation.
This is what the new module provides. As with Sevii’s wider ADR platform, alerts are received from the customer’s entire security detection stack. The new module ingests these alerts in real-time and then analyzes them. While existing tools can detect attacks, they tend to report them to the SOC. Sevii’s new AI module ‘intercepts’ this reporting and responds instantly and autonomously with its own AI-driven machine speed.
It uses AI agents (it calls them ‘cyber warriors’) to undertake a seven-day retrospective context hunt to determine whether the detected action is normal or abnormal. This is used to confirm a genuine AI attack. If genuine, the cyber warriors look for the possibility of the same attack occurring elsewhere within the customer’s infrastructure. This identifies whether the attack is broader than the initial detection and helps to determine if it requires immediate remediation.
“When we get the AIDR detection, we start the action to determine whether it is good or bad from policy, or is it acting in the fairest way,” explained Sevii’s CEO and co-founder, Curt Aubley. “We immediately collect all the data we need. We call it a hunt. We grab all that data and analyze it to be able reverse engineer the attack and take any necessary action.”
If remediation is necessary, it may be autonomous or triggered by a human defender in the loop. Being realistic, the ‘human in the loop’ option is a marketing comforter: companies like to have that option even if it is counterproductive. In reality, any defense against an AI attack must be able to react with the same machine speed as the attack itself. Requiring a human in the loop defeats this.
“Having a human in the loop may be required by today’s governance policy. But consider the damage and speed at which OpenAI rogue agents attacked Hugging Face,” commented Aubley. “Seventeen seven-minute actions. It’s mathematically impossible for a human to keep up with that.” The speed and process of remediation is essential to the success of any defense against an AI-driven attack.
Sevii’s remediation can be immediate. While it is gathering context for its next steps, it may detect a high volume of data leaving the customer. It performs an instant intelligence search. Is this a standard occurrence? Where is the data going? Is it going to a known command and control C2, or infrastructure that is known to be bad? Knowledge that a destination may be bad could have occurred within the last 15 minutes, but Sevii already knows it.