AI-Based Zero Trust: From Risk Scores to Contextual Trust Assessment

As organizations adopt cloud services and SaaS applications, business resources become distributed across multiple environments, and access can no longer be trusted simply because it originates inside the network. If an account or session is compromised, even a connection authenticated through standard procedures can be exploited in an attack. Initial authentication therefore cannot ensure that access remains secure. Zero trust is a security framework that verifies users and devices, grants access only to the resources they need, and reassesses access privileges.

Zero trust systems evaluate user and device status and connection conditions when making access decisions and reassessing risk during a session. These decisions typically rely on predefined policy rules and risk scores. However, rules and scores alone may not capture relationships among signals from different security systems or changes in risk during a session. AI can correlate and analyze these signals to provide additional context for access-risk assessments.

This article examines how AI can support access decisions and ongoing risk assessment during active sessions in a zero trust architecture and our plan to apply XTG's AI capabilities.

Continuous Verification in Zero Trust

Perimeter-based security has traditionally placed greater trust in users connected to the internal network. Zero trust explicitly verifies user identity and device security posture regardless of network location, and limits access to the applications and data needed for work under the principle of least privilege. Because accounts and devices can be compromised, zero trust continues to assess changes in security posture and behavior after access.

[Figure 1] Comparing access decisions in perimeter-based security and zero trust

The policy decision point (PDP) and policy enforcement point (PEP) are the core components that apply these principles to access control. The PDP determines whether to grant access and what level of control to apply based on user permissions and authentication, device security posture, the connection environment, and threat information. The PEP enforces the decision through actions such as allowing or blocking access. If new risk signals emerge after access is granted, the PDP can reassess the connection and the PEP can enforce the updated decision.

[Figure 2] Policy decision and enforcement architecture and input signals in zero trust

Rules and risk scores are effective for quick and consistent evaluation of known conditions. However, they can not reveal how signals from different security systems collectively indicate elevated risk. As new signals emerge during an active session, the initial assessment may no longer reflect the current security conditions. AI can analyze these signals together to support access control decisions.

The Same Risk Score Can Lead to Different Access Decisions

A risk score summarizes assessed access risk based on information about users, devices, and the connection environment. Separate access requests can have the same score even when their underlying risk factors and the importance of the requested resources differ. The score alone may therefore be insufficient to determine the appropriate controls.

Consider two users with the same risk score. User A connects to a familiar business application from an approved location during an overseas business trip using a company-managed device and successfully completes multifactor authentication (MFA). The device's security posture, authentication results, and travel approval records justify allowing the connection as legitimate business access. User B, who has the same score, connects to a critical server for the first time from an unregistered device using an anonymous proxy IP address. Records also show an attempt to download a large volume of files. In this case, the device's security posture is difficult to verify, and both the connection path and data access behavior show signs of risk. Security operators can consider restricting access and investigating possible compromise.

[Figure 3] Different responses to the same risk score based on access context

Existing rule-based policies can also apply different controls to identical scores. However, investigating the reasons behind a score can require security staff to review and analyze authentication records, device security posture, connection conditions, and the importance of the target resource across multiple systems. This can be time-consuming. AI can correlate the signals behind the score with detections from other systems, helping security teams assess whether additional verification or access restrictions are needed and respond more quickly.

Reassessing Session Risk After Login

User behavior and device security posture can change after access, and new threat information can become available. Reassessing session risk requires determining how these new signals relate to the existing access.

Suppose a user connects from an unfamiliar IP address. An unfamiliar IP address itself does not establish elevated risk. But if the device's EDR subsequently detects anomalous behavior and DLP identifies a large download of sensitive data, further analysis is needed. The organization must determine whether these events involve the same user, device, and session and whether they are related signs of risk, then reassess the existing access privileges.

[Figure 4] Changes in security signals after connection and the session reassessment process

Assessing these events requires information from multiple security systems, including account information and authentication status, device security posture, connection location and IP reputation, the sensitivity of the target resource, and threat detections. AI can correlate information collected across these systems and identify relationships among events, giving operators the evidence they need to reassess session risk. The PDP can use the analysis to determine whether additional controls, such as reauthentication or download restrictions, are needed.

Reviewing AI Analysis and Applying Policies

A user can connect from an unfamiliar location for legitimate work outside the office, so logging in from a different location does not mean that the account has been compromised or whether access should be blocked. AI can analyze the connection location alongside related signals, such as device security posture, EDR detections, and threat intelligence, to provide evidence for risk decisions and propose policy options such as reauthentication, privilege restrictions, or session termination.

These proposed security actions can be automated under predefined conditions. Actions with significant business impact, or those involving exceptions, still require review and approval from the security team. They must compare the evidence provided by AI with the actual business context, assess the potential impact and the reasons for any exceptions, and decide whether to apply the policy.

Integrating AhnLab XTG and AI PLUS

AhnLab XTG, a zero trust access control solution, assesses access risk using authentication information from external IdPs, device security posture, threat detections and threat intelligence, the network connection environment, and session history. XTG uses this information to determine access policies as the PDP and enforce them as the PEP.

We are developing capabilities that integrate AI PLUS with XTG to analyze relationships among users, devices, behavior, and threat information. In this architecture, AI PLUS identifies the causes of risk and recommends response options. XTG incorporates the analysis to make policy decisions and enforce controls such as reauthentication, privilege restrictions, or session termination.

[Figure 5] Proposed integration of trust information analysis and access control in AhnLab XTG and AI PLUS

Assist, Analyze, and Reason

We are planning to expand XTG's AI capabilities for security operations in three areas: Assist, Analyze, and Reason. Assist answers operators' natural-language questions by searching product help content, operational documentation, XTG settings, and event logs. Analyze integrates XTG access information with AhnLab XDR, allowing information about users, devices, anomalous behavior, and threats to be analyzed together. Reason assesses risk based on the analysis and provides the rationale for its assessment and applicable policy options.

[Figure 6] Planned expansion of AI capabilities through Assist, Analyze, and Reason

Capabilities for configuring policies and querying event logs in natural language are also under development for XTG. When an operator requests that a service port be blocked between a specific source and destination, AI configures the required objects and policy conditions and prepares the API call. The operator then reviews or modifies the settings and approves the policy before it is applied.

We are also developing natural-language log queries. For example, when an operator asks for the most frequently occurring URLs in web filter events, AI searches the relevant logs and returns the results. If the operator then asks for the source and destination addresses associated with those events, AI uses the context of the previous query to provide the information.

Multi-signal analysis correlates authentication and access information by user account across devices, including PCs and mobile devices. This enables the analysis of relationships between changes in connection location and access to sensitive data that may not be apparent from individual events. It also helps identify situations requiring additional verification. Multi-signal analysis can also correlate attack indicators from current threat intelligence with connection information to reassess access risk.

AhnLab