Understanding the AWS agentic AI security scoping matrix

In the disclosed GTG-1002 espionage campaign, attackers directed Claude Code to execute an estimated 80 to 90 percent of a multi-target espionage operation autonomously, compressing reconnaissance, credential abuse, and lateral movement into a fraction of the time a human-driven intrusion would take. GTG-1002 was an attacker-directed AI system used against outside targets, not a case of a victim organization’s own enterprise agent being hijacked, but the operational tempo it demonstrated is now the baseline defenders plan against. Your SIEM correlates the events. Your EDR raises the alert. The detection is accurate, but by the time your team receives it, the attacker has already moved laterally.

AI security can mean protecting AI systems, or using AI to strengthen defense. This piece addresses a third, increasingly urgent problem: defending enterprise environments against attackers that use AI to accelerate reconnaissance, credential abuse, and lateral movement.

Reactive security tools remain foundational, but they depend on enough observable evidence to distinguish malicious behavior from legitimate use, and when attackers use valid credentials or familiar administrative tools, that confidence can take time to build. As autonomous attacks execute reconnaissance, credential abuse, and lateral movement at machine speed, that time is exactly what defenders no longer have. Modern AI cybersecurity has to move beyond observing attacks after the fact to exposing malicious activity as it unfolds, so defenders can disrupt attacks before adversaries reach their objectives, not just after.

At a glance

• AI-powered attacks move too quickly for reactive detection alone; effective AI security exposes attackers before they reach critical assets.
• Reactive AI security tools detect attacks after enough evidence accumulates: known patterns, threshold breaches, or logged anomalies.
• AI-assisted attacks can move quickly through legitimate tools, credentials, and workflows, making malicious intent difficult to distinguish from authorized activity.
• Preemptive AI security changes the control point by making every attacker action inside the environment a potential exposure event, rather than waiting for post-compromise indicators.

AI-powered attacks test the assumptions reactive security platforms are built on. SIEM platforms correlate logs, EDR identifies suspicious endpoint behavior, and XDR combines signals across multiple controls to improve visibility, and each of these can use behavioral detection, threat intelligence, and correlation beyond simple signature matching. What they still depend on is observable activity and enough context to distinguish malicious behavior from legitimate use. When attackers use valid credentials or familiar administrative tools, that confidence can take time to build, and autonomous attacks are increasingly designed to exploit exactly that delay.

That delay gives attackers the advantage. Rather than relying on obvious exploits, they inherit trusted access and blend into routine enterprise activity as they quietly expand their reach. By the time reactive defenses detect the intrusion, attackers may already be deeply embedded in the environment, making the breach far more difficult to contain.

Reactive detection creates an inherent delay. By the time enough evidence exists to trigger a detection, AI-powered attacks may already have compromised critical systems.

Preemptive AI Security is Acalvio’s approach to shifting detection from post-compromise observation to the early identification of malicious activity. Rather than relying on accumulated behavioral evidence, it identifies unauthorized activity through interactions with strategically deployed deceptive assets, credentials, identities, and attack paths, after an attacker has gained a foothold but before they reach their objective.

Acalvio delivers Preemptive AI Security through 360 Deception, which shifts detection from a reactive to a preemptive model. Interactions with deception generate high-confidence detection signals early in the attack lifecycle, enabling defenders to investigate and respond before attackers can advance further.

Unlike traditional honeypots that require ongoing manual deployment and maintenance, 360 Deception operates autonomously at enterprise scale, continuously adapting across the environment to support early, high-fidelity detection.

The strategy is built on three complementary vectors. Because these resources serve no legitimate business purpose, any interaction with them is a high-confidence indicator of malicious intent: why did anything touch an asset no legitimate process should need? Each vector supports that objective in a different way:

• Fake Looks Real presents convincing decoys that divert attackers away from production systems.
• Real Looks Fake obscures critical assets with deceptive context, making it more difficult to distinguish legitimate targets.
• Intentionally Suspicious Artifacts are strategically placed items that invite unauthorized interaction, generating immediate detection signals.

Together, these techniques expose AI-powered attackers early in the attack lifecycle, giving defenders the opportunity to investigate and respond before attackers achieve their objectives.

Selecting AI cybersecurity solutions requires a shift in perspective. As AI-powered attacks compress intrusion timelines, CISOs should evaluate platforms on what an alert actually proves, not on feature count alone. Six criteria give a practical, technology-neutral framework:

• Signal confidence. Does an alert come with enough investigation context to act on immediately, or does it still require analysts to build a case from indirect evidence?
• Coverage. Does the platform span identity, endpoint, network, cloud, and OT from a single management fabric, or does it require stitching together separate point products?
• Independence from known signatures. Can the solution detect unauthorized activity without prior knowledge of the specific attack technique or tooling?
• Realism and placement. How convincingly do deceptive assets blend into the real environment, and are they placed along the attack paths that matter?
• Integration. Does the solution feed alerts into the SIEM, EDR, IAM, PAM, and SOC workflows analysts already use, or does it add a separate console to check?
• Deployment and operational overhead. What does it take to deploy, scale, and keep current as the environment changes, including whether it requires endpoint agents?

Deception-based detection is not the only way to score well against this framework, but it is built to answer several of these criteria directly: independence from known signatures by design, and signal confidence through interactions that have no legitimate explanation. Reactive controls remain essential for the criteria deception does not address on its own, particularly deep endpoint telemetry and response execution, which is why the strongest programs combine both rather than choosing one.

Here is how to build enterprise AI agent security around the AWS agentic AI security framework, in four steps.

1. Audit. Check your enterprise layer and your current controls. 

Work through your access control for agent credentials, monitoring, anomaly detection, and incident response. Mark which of the four you have running against agent activity specifically rather than against users and workloads generally (be honest for best results).

2. Map where each agent actually acts, not where it was designed to act. 

Do not assume how much autonomy an agent has, as this can be easy to underestimate. Play it safe, and make sure (for example) your simple chatbot does not hold writing access that nobody remembers granting.

3. Place decoy assets in a path a straying agent would reach. 

Any interaction here is a high-confidence signal of intent, and warrants immediate investigation.

4. Route those signals into whatever your team already uses for alerts. 

Whether that is AWS Security Hub or an existing SIEM, detection should not be a separate system someone has to remember to check.

Acalvio’s ShadowPlex deploys agentlessly across AWS environments, so none of this requires touching the agent itself. It also holds FedRAMP Ready status in AWS GovCloud, which matters for federal teams working under stricter deployment rules.

Preemptive defense strengthens the existing security stack rather than displacing it. 360 Deception complements SIEM, EDR, XDR, IAM, PAM, MFA, and other controls by transforming ambiguous telemetry into high-confidence attacker signals. These platforms continue to provide the visibility and response capabilities organizations rely on, while deception improves detection fidelity and accelerates containment.

360 Deception changes what analysts are working from. Instead of building a case for whether an attack is underway from indirect evidence, they start from a direct signal: an interaction with an asset, credential, or attack path that legitimate users and processes have no reason to touch. That signal provides immediate context about attacker behavior, lateral movement, and attack paths, enabling security teams to investigate incidents and contain threats more quickly. Acalvio’s recognition as a GigaOm Leader and Outperformer for four consecutive years, including 2026, reflects that same track record of high-fidelity detection at enterprise scale.

Selecting an AI security solution requires more than comparing feature lists. As AI-powered attacks become faster and more autonomous, many organizations continue to evaluate security using criteria built for traditional threats. These four questions surface the gaps that matter most.

The question is no longer what a platform can detect. It is when it can detect it, and how much a security team can trust the alert once it fires.