[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 1 · 1.5.b
AP Cybersecurity · Introduction to Security
AI-Enabled Threat Detection and Response
The bottleneck was never seeing events. It was deciding which ones deserve a human.
key ideaThe bottleneck was never detection. It was deciding which of millions of events deserves a human.
What to look for
A network generates millions of digital events a day. Some of them are an adversary. No team can examine them all, so the practical question is not ‘can we see it?’ but ‘can we find it in time?’
| Stage | What happens | Why AI helps |
|---|
| collection | logs from devices, network, applications | volume is not the problem; reading it is |
| triage | sort likely-malicious from harmless | a trained model classifies faster than humans can read |
| alerting | notify security personnel | analysts see a short list rather than a firehose |
| automated response | take a pre-approved corrective action | contains an attack in seconds, not hours |
| intervention | a human investigates and contains | the goal: prevent loss, harm, damage, destruction |
Rows 2 and 4 are where AI acts. Everything else was already automated — what changed is the quality of the sorting, and therefore the speed of the human response.
| Response type | Example | When it is appropriate |
|---|
| alert only | notify a tier-1 analyst | ambiguous activity; a wrong call is costly |
| automated containment | disable a session, isolate a host | high-confidence detections with a reversible action |
| automated blocking | drop traffic from a source | clear-cut cases; outages if the confidence is wrong |
| no action | log only | known-benign patterns, kept for later correlation |
Automation is chosen by confidence times reversibility. Disabling a session is easy to undo; blocking a supplier's whole network at 3 a.m. is not.
four properties of good detection
- Volume is the problem: millions of events against a team that can read thousands.
- A model's job is triage — sorting likely-malicious from harmless, not deciding outcomes.
- Automate only what is high-confidence and reversible; alert on everything else.
- A deployed rule carries its tuning evidence — how many alerts a day it produced on real history.
Reading the evidence
Each stage narrows the field. The value is not in the model's cleverness but in what it enables: a human intervening early enough to matter.A tuned rule states its condition, its action, and the evidence it was tuned against. That last part is what separates a deployed rule from a suggestion.
a tuned detection ruleconditions, action, and the tuning evidence
alert if:
user.failed_logins >= 20 within 5m
and source.asn not in [known_office_asns]
and user.last_login older_than 30d
then: notify tier1, disable_session
priority: high # tuned on 90 days of history: 3-6 alerts/day>= 20 within 5ma rate, not a raw count — humans do not fail twenty times in five minutesnot in known_office_asnsadds origin so ordinary staff activity is excludedolder_than 30da dormant account being probed is far more suspiciousdisable_sessionreversible containment — safe to automate3-6 alerts/daythe tuning evidence; without it the rule is untested
Worked analysis
EX 1
Why humans cannot do the triage
A mid-sized network logs 4 million events a day. A team of six analysts works eight-hour shifts. Show why manual review is impossible.
1
Compute the workload
4,000,000 events across 48 analyst-hours.
2
Convert to a rate
About 83,000 events per analyst-hour, or 23 per second.
3
Compare with human reading speed
An analyst can meaningfully assess perhaps a few events a minute.
4
State the conclusion
Manual review is off by four orders of magnitude — not understaffed, structurally impossible.
5
Name what changes this
Automated triage reduces the human queue to the handful of events that plausibly matter.
EX 2
Alert, or act?
A model flags a login from an unusual country for an account that also just downloaded a large archive. Should the system alert, or act?
1
Assess the confidence
Two independent signals agree — high confidence.
2
Assess the potential loss
Bulk download suggests exfiltration in progress; minutes matter.
3
Assess reversibility
Disabling the session is easily undone if it turns out to be a traveling employee.
4
Choose the response
Act and alert — contain first, notify simultaneously.
5
State the rule of thumb
Automate what is reversible and high-confidence; alert on everything else.
EX 3
The model that learned the wrong thing
After a quiet holiday week, a model begins flagging normal Monday-morning login volume as malicious. What happened?
1
Identify what it learned
It treated the holiday baseline as normal.
2
Identify the consequence
Ordinary activity now exceeds the learned norm and is flagged.
3
Name the failure mode
False positives from a baseline drawn over an unrepresentative window.
4
Give the correction
Train across a full seasonal cycle and re-check the alert rate after deployment.
5
State the general point
A model is only as good as its baseline. Detection needs monitoring too.
Check yourself
Why can humans not examine all network events themselves?
Show answer
Networks produce millions of events daily. Even a large team can assess a few thousand, so the gap is measured in orders of magnitude rather than in headcount.
What are the two things an AI detection tool can be programmed to do when it finds likely malicious activity?
Show answer
Alert human cybersecurity personnel, or take specific corrective actions matched to the type of activity detected.
What is the actual benefit of faster detection?
Show answer
It lets teams intervene quickly — preventing loss, harm, damage and destruction to infrastructure and data. Speed matters because it shortens the attacker's working time.
When should a response be automated rather than alerted?
Show answer
When confidence is high and the action is reversible — disabling a session, isolating a host. Irreversible or disruptive actions should wait for a human.