How it works
Adversaries can be outsiders, insiders, careless users, automated bots, or people misusing legitimate access. AI can amplify both attacks and defensive analysis.
Treat AI output as a draft, not an authority. Verify recommendations and do not paste sensitive configurations into untrusted tools.
Common error
Do not assume every suspicious action requires a sophisticated attacker. Ordinary misconfiguration and leftover access are common causes.
Worked example
A contractor account downloads an unusually large set of files after its engagement ends. Distinguish evidence from motive.
Evidence
Account: former-contractor
Transfer: 2 GB
Time: outside scheduled work
Role end date: previous weekThe activity and stale access justify investigation and proportionate containment, but do not establish a motive by themselves. Preserve access and transfer logs, validate whether any approved work explains the event, and remove access that is no longer authorized.
Exercises
1.4.1
An AI assistant confidently calls one failed login an insider attack. Why is that conclusion unsupported?
Show solution
A failed login can arise from an ordinary typo, an automated attempt, or several other causes. One event does not establish actor identity or intent; correlate additional evidence.
1.4.2
What data-handling precaution applies before using an external AI tool to summarize incident records?
Show solution
Use an approved tool and share only the permitted minimum. Remove secrets and unnecessary personal or confidential data, then verify the summary against the original records.