Security 3.0: How AI-Powered Reasoning Is Transforming Security Operations

Beyond Detection: The Shift Toward AI-Powered Reasoning

Signature-based detection has long been fundamental to malware defense, but new variants and sophisticated evasion techniques have exposed the limitations of relying on signatures alone. Endpoint Detection and Response (EDR) expanded detection and investigation capabilities by analyzing process execution, file operations, registry changes, and other endpoint activity. Extended Detection and Response (XDR) broadened visibility further by correlating security telemetry across endpoints, networks, email, and other security domains.

These advances have increased the amount of evidence available to analysts without necessarily reducing their workload. Security teams must still investigate alerts from multiple tools, distinguish genuine threats from false positives, and assess their severity. The challenge is particularly acute in Security Operations Centers (SOCs), where limited resources must contend with large volumes of security events.

Advanced defense evasion techniques add to this complexity. Attackers can exploit vulnerable drivers through Bring Your Own Vulnerable Driver (BYOVD) techniques to terminate EDR processes. They may also delete logs and telemetry to conceal evidence of compromise. Credentials and session cookies stolen by infostealers can enable attackers to impersonate legitimate users, making unauthorized access harder to distinguish from normal activity.

[Figure 1] Impersonating Legitimate Users with Stolen Credentials and Session Cookies: Limitations of Rule-Based Detection

Legitimate administrative tools present a similar challenge. PowerShell and PsExec, for example, are routinely used for system administration but can also facilitate malicious activity. Their execution alone is insufficient to establish malicious intent. Analysts must examine process execution chains, account access patterns, and external network communications to determine whether these activities are part of a broader attack.

This is where contextual analysis becomes essential. Rather than evaluating events in isolation, security teams need to establish how suspicious activities are connected and what they reveal about an attacker's objectives.

AhnLab AI PLUS addresses this need by integrating AI-powered reasoning with existing security capabilities. Instead of replacing antivirus (AV), EDR, or XDR, it uses data collected by these technologies to support threat investigation and response decisions. Analysts remain responsible for validating the findings and determining appropriate actions.

[Figure 2] The Evolution of AhnLab Security Technologies: From AV and EDR/XDR to AI-Powered Reasonin

AhnLab AI PLUS applies this approach through four core capabilities: Natural Language Threat Search, AI-Powered Threat Analysis, AI-Guided Response Recommendations, and AI-Generated MDR Analysis Reports. Each addresses a distinct stage of the security workflow, from identifying suspicious activity to documenting investigation and response outcomes.

Natural Language Threat Search: Simplifying Security Investigations

Security investigations typically begin with searching logs and collecting evidence of suspicious activity. In conventional query-based environments, analysts must understand database schemas, field names, and query syntax to retrieve relevant information. Incorrect conditions or missing parameters can require repeated query revisions, delaying the investigation.

Natural Language Threat Search simplifies this process by allowing analysts to describe what they want to investigate in plain language. AI interprets the request, generates appropriate search conditions, retrieves relevant security events, and organizes the results.

For example, an analyst might ask:

The system can retrieve matching script execution records and summarize their behavior and associated risk levels. Figure 3 illustrates an example in which a natural-language query identifies two suspicious script execution events, presenting their execution sequences, risk assessments, and potential false positives.

[Figure 3] Natural Language Threat Search: Suspicious Script Execution Events and AI-Generated Analysis Results

Analysts can then ask follow-up questions to examine the evidence behind a particular threat assessment. The results may include related process execution chains and mappings to MITRE ATT&CK techniques, allowing investigators to examine suspicious behavior in greater detail.

With less time spent constructing queries or navigating database schemas, analysts can concentrate on verifying the evidence and pursuing leads that warrant further investigation.

AI-Powered Threat Analysis: Interpreting Malicious Behavior and Attack Context

Identifying a suspicious command is only the first step. Investigators must also determine its underlying functionality and potential impact.

Attackers frequently obfuscate PowerShell commands using Base64 encoding or XOR operations to conceal malicious behavior. When combined with fileless techniques that execute code directly in memory, these methods complicate analysis by obscuring execution logic and limiting evidence written to disk.

AI-powered script analysis helps decode obfuscated code and interpret its behavior.

Figure 4 demonstrates how scripts obfuscated with Base64 and XOR can be analyzed and translated into natural-language explanations. In this example, the analysis identifies additional payload downloads, in-memory loading of dynamic-link libraries (DLLs), and attempts to establish persistence through registry modifications.

The identified behaviors can also be mapped to MITRE ATT&CK techniques, helping analysts understand their significance within established attacker tactics and techniques.

[Figure 4] AI-Powered Script Deobfuscation and Malicious Behavior Analysis

Instead of manually decoding each layer of obfuscation, investigators can examine the underlying execution logic, review supporting evidence, and assess whether the observed behavior indicates a threat.

AI-Powered Event Correlation: Reconstructing the Attack Chain

Analyzing individual commands reveals what occurred on a particular system. Understanding a broader intrusion requires connecting those findings with activity elsewhere in the environment.

A single attack may generate separate records across email, endpoint, identity, and network security systems. When thousands of alerts are involved, manually tracing relationships between events can become a substantial investigative burden.

AI-powered event correlation examines timestamps, affected systems, process activity, and network communications to identify related events and infer connections between attack stages. These records can then be consolidated into incidents, allowing analysts to investigate the sequence as a whole.

In an internal simulation, AhnLab demonstrated how AI analyzed 19,412 raw security alerts collected over four hours and consolidated them into 17 incidents identified for action.

The analysis reconstructed an attack chain that began with spear phishing targeting employees and progressed toward an attempted exfiltration of financial data. By correlating evidence across security domains, the system traced the sequence from the initial phishing email to fileless loader execution, credential theft involving LSASS, and lateral movement across internal systems. It also identified an upload of 1.4 GB of data to an external cloud storage service.

[Figure 5] AI-Powered Alert Correlation and Attack Chain Reconstruction

Threat intelligence provides additional context for interpreting these findings.

AhnLab draws on extensive threat analysis data collected from endpoint environments in South Korea, together with proprietary indicators of compromise (IoCs) and attack behavior patterns identified by the AhnLab Security Intelligence Center (ASEC).

ASEC's research into threat groups such as Kimsuky, Lazarus, and Andariel, which have been associated with targeted attacks against South Korean organizations, provides reference intelligence for comparing newly observed activity with documented threats.

The significance of event correlation extends beyond reducing alert volume. A reconstructed attack chain gives investigators a basis for tracing the initial compromise, identifying lateral movement, and determining which systems and accounts may have been affected. This broader view is critical to assessing the scope of an incident and directing further investigation.

AI-Guided Response Recommendations: Prioritizing Containment and Remediation

Once an attack chain has been established, the next challenge is deciding how to contain the threat and prevent further compromise.

AhnLab demonstrated AI-guided response recommendations using 47 EDR events recorded over approximately 24 minutes. The analysis correlated these events into a single attack chain involving Excel macro execution, PowerShell commands, persistence establishment, LSASS credential access, and indicators of attempted ransomware encryption.

Based on the reconstructed sequence, the system recommended isolating the affected endpoint from the network and terminating malicious processes as immediate containment measures.

Additional recommendations included removing persistence mechanisms established through Windows registry Run keys, scheduled tasks, and services, as well as resetting potentially compromised account credentials.

A subsequent investigation using the same IoCs identified the same malicious file on two additional endpoints.

[Figure 6] AI-Guided Response Recommendations and Action Prioritization

These recommendations do not automatically trigger response actions. Security analysts must review the evidence, evaluate potential business impact, and follow organizational security policies and approval procedures before taking action.

By grounding response priorities in investigation findings, this approach can help reduce inconsistencies arising from differences in analyst experience and support more consistent incident handling.

AI-Generated MDR Analysis Reports: Streamlining Incident Documentation

Security investigations also require accurate documentation. Incident timelines, malicious behaviors, affected systems, response actions, and recommendations for preventing recurrence must be recorded and communicated to relevant stakeholders.

Traditionally, analysts compile this information from multiple security consoles, organize relevant events and IoCs, and prepare separate reports for technical teams and management.

AI-generated MDR analysis reports help reduce this manual effort.

The reporting process normalizes EDR telemetry covering processes, files, registry activity, memory, network communications, and scripts. Using the reconstructed attack chain and MITRE ATT&CK mappings, the system generates structured reports containing incident overviews, attack timelines, key malicious behaviors, IoCs, expert assessments, response outcomes, and remediation recommendations.

The same investigation evidence can be used to produce detailed technical reports for security practitioners and executive summaries for management. This allows different stakeholders to receive information suited to their needs without requiring analysts to assemble separate reports from scratch.

[Figure 7] AI-Generated MDR Analysis Report Powered by AhnLab AI PLUS

Measuring the Operational Impact of AhnLab AI PLUS

How do these capabilities affect the time required for security investigations?

Using the previously discussed scenario involving 47 EDR events, AhnLab compared the time required to complete four security workflows before and after applying AhnLab AI PLUS.

The total time decreased from 160 minutes to 16 minutes, representing a 90% reduction in this scenario.

[Figure 8] Security Workflow Time Before and After Applying AhnLab AI PLUS (Based on a Specific EDR Investigation Scenario)

These results are based on a specific investigation scenario and do not guarantee equivalent performance across different environments or incident types.

Nevertheless, reducing the effort required for repetitive searches, threat analysis, response assessment, and documentation can allow security teams to devote more attention to proactive threat hunting, identifying additional affected assets, and strengthening security controls.

Security 3.0: Turning Detection into Informed Action

The two investigation scenarios illustrate what AI-powered reasoning can contribute to security operations.

In the first, thousands of fragmented alerts were correlated into a manageable set of incidents, revealing an attack sequence that would be difficult to establish from isolated events. In the second, the reconstructed chain provided the context needed to prioritize containment, investigate additional endpoints, and document the findings.

Together, these examples demonstrate a shift in how security data is used. Detection technologies provide the evidence; AI helps connect that evidence into a coherent account of the attack and supports decisions about what to investigate and how to respond.

Human expertise remains central to this process. Analysts must verify the relationships identified by AI, assess the operational consequences of proposed actions, and determine the appropriate response.

The defining shift in Security 3.0 is not simply faster analysis or fewer alerts. It is the ability to move from isolated detections to evidence-based decisions, enabling security teams to understand what happened, identify what is at risk, and respond with greater speed and confidence.