If you pay attention to vendor materials, whether online or in-person at events, you've almost certainly seen one or more products marketed as "agentic." This further feeds into notions that vendor buzzwords are sometimes deceptive and lends itself to jokes from practitioners during periods around major conferences with strong vendor presences. This begs the question: Is this any different from a GPT-wrapped chatbot presented as "AI-powered" within the past 18-24 months, or is it a system built on logic and workflows that make decisions with little human interaction?

The point I am driving toward is that marketing descriptions can be misleading. Absent from a standardized litany, we are at the mercy of what is publicly accessible, and the hope that the terminology used in your organization accurately describes what you are looking for. Perhaps more critically, we hope the vendor uses the same understandings and definitions as we do.

This is the first piece in a series highlighting the use of AI, specifically in Cyber Threat Intelligence (CTI) environments and settings. This article seeks to normalize and establish terminology and definitions for use in Information Security, and more narrowly, in CTI. A major reason for this series is the role of intelligence and the reality that successful intelligence relies on precision. In this case, precise vocabulary. Intelligence analysts seek to disseminate intelligence, not information and not data, but finished intelligence with a defined level of analysis, confidence, and explanation.

Successful and proper intelligence reports aren't hunches. They may start as a hunch but are built on applied hypothesis testing to prove or disprove the hunch or theory. Assessments aren't inherently facts, but they should be built upon facts. Assessments involve what is known, what is believed, and what is unknown, with disclosures about each assertion. Assertions must be defensible and, like a forensic chain of custody, the means of reaching conclusions and outcomes must be verifiable and auditable. Anyone who has had to explain their analytic decisions or assertions to a CISO or group of executives can certainly feel this pain.

What Does AI Mean in Cyber Threat Intelligence?

To start this demystifying process, let's begin with "AI" itself. AI is not a single technology; it is a category of technologies that includes concepts ranging from decision trees to elements of data science to large language models. To say that a product is "AI-powered" or that a product that uses AI is a buzzword is not an accurate description of its utility or function. Hearing the buzzwords above gives people no context around what the product does, failure points or consequences, or how to provide feedback when these "AI-Powered" solutions get it wrong.

My first question in conversations about AI is: what kind? How it answers this question is almost as important as the answer itself. If I get a response like ChatGPT or Claude, that tells me a lot about how the product is structured and the likely mismatch in terminology. Getting a response of “Generative AI” along with a description of its use is a more encouraging response.

Generative AI in Cyber Threat Intelligence

Generative AI has become the more mainstream definition of AI, especially among those who aren't at the forefront of the technology or its implementation. As the name implies, this flavor of AI generates new content based on patterns learned from training data. This seems simple enough, right? A few underlying pitfalls and concepts are worth considering: each Generative AI platform uses a different model. This is no different than conducting the same search on Google, Yahoo, and Yandex. The results are similar, but slightly different. In the context of search engines, this is because the platforms index differently, and the customer service algorithms vary.

Furthermore, each Generative AI model vendor uses different methods and sources for training. Imagine asking a medical or health-related question to a Generative AI platform and learning that the model was trained 4 years ago with Reddit as a primary input. Some models are trained on the internet at large, others on math knowledge bases, and others on literature and books. Generative AI algorithms use a simple tokenization model that produces relationships between words or sentences based on the provided context. What will differentiate the models and implementations is the training data set and the complexity of the level of assessed tokenization, for example, at a word tokenization level or a sentence tokenization level. Further complications could include industry- or region-specific lexicon and dialect.

Some Generative AI implementations, especially those from specific vendors, are trained against their knowledge base. Their repositories of reports, indicators, observables, and other campaign and threat-actor data provide training input. Just like any Generative AI platform, even these can hallucinate, or simply put, make things up and stick to them as indisputable truths. They rely on what is plausible, not always on what is factual. In the context of CTI, we will see organizations differentiate themselves by how well they manage hallucinations and plausibility rather than facts. It is a matter of how occurrences are managed, not how many occur, since occurrences are inevitable.

What Is Agentic AI in Cyber Threat Intelligence?

Beyond being the new rage, Agentic AI is where we start to see shifts in what we consider "AI." To set a foundation, Agentic AI uses agents to perform tasks. Both Agentic AI and Generative AI may use the same underlying models, but Agentic AI relies on the agents to orchestrate and perform tasks. In contrast, Generative AI leverages models to generate text, images, or video. There is specific value in being deliberate and precise in defining the implementation of an agentic product as opposed to a generative product. In this context of Agentic AI, agents will orchestrate responses and actions based on a goal. They will leverage one or more AI models to identify the problem, select the tooling, and ingest the data source used to perform the actions.

From a CTI perspective, you may query an indicator, and the Agentic platform may not only query an open-source threat intelligence platform but also pivot to investigate infrastructure enumerated by the initial agent simultaneously. The agents may also query a sandbox or detonate malware in a different sandbox environment and identify the MITRE ATT&CK Techniques for that indicator.

This example makes it easier to differentiate between a platform implementing an Agentic AI approach and a simpler Generative AI implementation, such as a chatbot over a datastore. The agentic implementation can contribute to the body of knowledge and provide decision-making context. Generative AI is good at querying an existing knowledge base and assisting in performing QA checks on written reports.

Human-in-the-Loop and AI Autonomy in Cybersecurity

NVIDIA has defined 4 autonomy levels for implementations of Agentic AI. What is our organization's appetite for autonomous systems? You may hear the term "Human in the Loop." This refers to a process where the system may recommend an action, and a human must approve or deny it. This could range from deciding on every action to acting only at a specific threshold. Some systems may also implement this as a simple Thumbs Up or Thumbs Down after the fact, which I would disagree with this label and contend is "Human Adjacent to the Loop" or "Human out of the loop." The latter is often seen in retraining models and Reinforcement Learning from Human Feedback (RLHF) as a means to improve implementations and models to better align with purposes and preferences while improving safety and accuracy.

From a CTI perspective, it is important to understand which of the three possibilities the product operates within. As an example, if I am evaluating an Agentic SOC solution, how is it implemented? Is this Generative AI-based alert management? Where can the user intervene and direct actions? Are you operating in an MSSP or multi-tenant environment? Can you define multiple playbooks or action sets?

The Risk of “Agent Washing” in AI Security Tools

Using the Generative AI alert management product as an example, this is a major pitfall in the world of Agentic AI. Generative AI is being "Agent Washed," bundled into some automation, and called Agentic. The key questions to resolve between the two are, "What happens to the data between input and output?" and "What tools and decisions can the product make on its own?"

Going back to hallucinations, this also causes some additional issues and pitfalls. Thinking about what SOAR has been accomplishing via automations and playbooks for years, this is deterministic in nature, meaning that given the same or similar inputs, the output is identical. If a connection comes from a host on a list triggers a defined response or playbook of actions, the next time a connection comes from a different host on the same or similar list, the same actions will be triggered.

An agentic solution could also trigger different actions based on what is observed or encountered during the investigation. While this is more ideal than a hallucinated response or a chat bot response from a knowledge base, it can still be unpredictable and should be planned for. Planning for this should require explicit tests for accuracy, verification, assurance, and failure modes, in addition to benchmarking deterministic actions.

Why AI Hallucinations Matter in Cyber Threat Intelligence

I have mentioned hallucinations a few times now. Hallucinations should not be treated as bugs. Subsequent models may reduce or mitigate the impact of hallucinations but never eliminate them. This stems from the AI relying more on plausibility than factuality. Hallucinations could take a possible indicator, fail to find anything relevant to it, and still attribute it to a non-existent Threat Actor Group with a plausible-sounding name. Imagine the horror if this made it to a finished report, and a CISO was briefed on the actor as a current or relevant threat. This exemplifies the need for verification mechanisms in both Generative and Agentic AI implementations. It could save your reputation and the organization a large sum of money based on a response to a non-existent threat from a non-existent threat actor.

RAG, Traceability, and Source Verification in CTI

While not unique to AI, a major question is, "Where did this output come from?" Can we trace the sequence of events? Is the Chain of Custody intact? Leveraging a RAG (Retrieval Augmented Generation) system allows users to validate outputs against external, trusted, auditable data sources. While RAG is not without errors and failures, it adds another layer of verification and assurance, akin to traditional Defense in Depth. It is similar to an open-book exam, where a conventional LLM is more like a closed-book test, operating from memory.

In the context of CTI, this translates to source reliability and the ability to withstand analytic scrutiny. Claims without facts and supporting evidence are storytelling, not intelligence work. This is compounded when a story sounds plausible enough but isn't rooted in fact.

Why Consistent AI Terminology Matters in CTI

The final pitfall is central to CTI. A collision between vocabulary and labels creates friction between AI vocabulary and tradecraft vocabulary. Standards like ICD-203 establish confidence levels from the analyst's purview. Confidence in plausibility differs from confidence in the ability to audit and fact-check. Statistical probability assumes perfect, near-clinical conditions and often cannot account for unknown situations and variables. This is but one example.

In conclusion, none of the points addressed in this article argue against the use of Agentic AI in CTI. This article is intended to be cautionary in nature. This is intended to argue for ensuring that terminology and vocabulary are correct and agreed upon before the technology overtakes the organization's ability to govern it.

Exploring AI in Cyber Threat Intelligence?

If you’re considering how Generative or Agentic AI could support your cyber threat intelligence program, Kudelski Security can help you think through where it fits, the risks to consider, and the safeguards you may need.

Get in touch with Kudelski Security to learn more.

‍

‍