Security does not usually change in clean, incremental steps. It changes in moments, often uncomfortable ones, when defenders are forced to adapt faster than their adversaries expect.
In a recent fireside chat, Craig Jones, Chief Security Officer at Ontinue, shared stories and insights from more than two decades in security operations. His experience includes tracking nation-state adversaries, responding to one of the largest firewall compromise campaigns ever observed, and building an AI-driven SOC designed for today’s threat landscape.
The conversation covered a wide range of ground, but three themes stood out clearly: how modern attacks really unfold, why identity and cloud are now the primary battlegrounds, and how AI, when used correctly, can fundamentally change security operations.
Nation-State Attacks Aren’t Loud; They’re Patient
One of the most striking parts of Craig’s story came from his time tracking Chinese advanced persistent threat activity targeting edge devices.
Contrary to the Hollywood version of cyberattacks, these campaigns were not flashy. They were quiet, deliberate, and deeply strategic.
The attackers focused on:
Long-term access rather than immediate disruption
Edge devices, particularly firewalls, as durable footholds
Credential harvesting and persistence instead of destructive malware
In one campaign, attackers leveraged zero-day vulnerabilities in firewall software and quietly maintained access across tens of thousands of devices. What ultimately exposed the activity was not a dramatic alert. It was a single, small artifact left behind by a typo in a script.
That tiny mistake triggered a response effort that escalated into one of the largest coordinated incident response operations of its kind. The effort involved rapid infrastructure changes, custom remediation tooling, and constant counter-moves as attackers attempted to regain access.
The lesson is an important one for modern defenders. Today’s most dangerous attacks often look boring until they are not.
Identity Is the New Control Plane
As the discussion shifted from historical campaigns to current research, a consistent pattern emerged. Attackers are increasingly targeting identity and cloud workflows instead of traditional endpoints.
Recent threat research discussed in the webinar highlighted campaigns that:
Use minimal malware or none at all
Abuse legitimate cloud features and authentication flows
Persist through session hijacking, token abuse, and privilege manipulation
This shift makes detection harder. When attackers behave normally inside cloud environments, traditional indicator-based approaches struggle to keep up.
From a defender’s perspective, this changes the game:
You cannot rely on malware signatures alone
Context matters more than volume
Investigation speed becomes critical
This is where AI enters the picture.
What Agentic AI Actually Does in a Modern SOC
AI in security is often discussed in abstract terms. At Ontinue, it is operational.
Craig described how Ontinue’s SOC now uses agentic AI to investigate every alert that enters the environment automatically, consistently, and within minutes.
Instead of acting as a black box, the AI:
Prioritizes alerts and builds investigation plans
Gathers context from identity, endpoint, and cloud data
Performs enrichment and historical analysis
Produces a transparent assessment that analysts can review
Every alert arrives pre-investigated, with evidence, reasoning, and supporting data already assembled. Human analysts focus on judgment and decision-making rather than manual data gathering.
The result is faster response times, fewer false positives reaching customers, and analysts spending time on meaningful work instead of repetitive triage.
This is not AI replacing analysts. It is AI doing the work analysts should not have to do anymore.
