AI-Driven Attacks Shift Cybersecurity Focus from Inference to Ground Truth

The emergence of reasoning-capable artificial intelligence is fundamentally changing the cybersecurity landscape, shifting the advantage from probabilistic detection to the ownership of verified ground truth.

For decades, cybersecurity defences have relied heavily on inference. Systems have used anomaly scoring, reputation systems, and behavioural modelling to “read the stars”—attempting to calculate the probability that a specific action or communication is malicious based on past patterns.

The Limits of Probabilistic Detection

As attackers gain access to the same reasoning models used by defenders, the efficacy of inference-based security is declining. Modern attackers use AI to scrape organisational charts, mimic specific communication tones, and harvest historical data to create highly plausible lures.

When an attacker can use AI to generate a flawless business email compromise (BEC) attempt that clears every standard reputation and anomaly check, the contest is no longer about how “strange” a message looks. Instead, it becomes a matter of whether the message contradicts established facts.

The Advantage of Verified Facts

The most effective defence in the AI era is the ability to carry “ground truth”—hard, non-negotiable facts that an outsider cannot reliably guess or replicate. While an attacker can infer who might sign a wire transfer, they cannot easily know the exact, real-time internal process required for that specific account.

Defenders can gain a significant advantage by maintaining precise records of:

• Authorised approvers: Knowing exactly which individuals are permitted to move funds for specific accounts.
• Domain ownership: Maintaining a definitive list of all legitimate corporate domains to instantly flag even slight variations.
• Verified vendors: Distinguishing between established partners and fraudulent entities created to bypass reputation filters.

A system built on ground truth does not need to decide if an email looks unusual; it simply identifies if the message contradicts known operational realities.

The Challenge of Ground Truth Decay

Maintaining this factual advantage is a continuous operational challenge. Ground truth is subject to rapid decay as organisations evolve. Approvers change roles, business units add new vendors, and corporate domains can sprawl through acquisitions or shadow IT.

A fact that is no longer meticulously maintained quickly reverts to being a “confident guess” in better clothing. The modern security requirement is the equivalent of maintaining a highly accurate timekeeper on every vessel: the ability to ensure that internal records of identity, authority, and assets remain as accurate as the systems they are meant to protect.