Using Deception to Halt Agentic AI Attacks
As AI has become more capable, attackers have begun using agentic AI to automate reconnaissance, identify vulnerabilities, generate exploits, and adapt their attacks at a pace that far exceeds what human operators could accomplish alone. The speed of these attacks is shrinking the time defenders have to detect, investigate, and respond. Traditional defensive approaches that rely on signatures, patch cycles, or manual investigation simply are not keeping pace.
As AI has become more capable, attackers have begun using agentic AI to automate reconnaissance, identify vulnerabilities, generate exploits, and adapt their attacks at a pace that far exceeds what human operators could accomplish alone. The speed of these attacks is shrinking the time defenders have to detect, investigate, and respond. Traditional defensive approaches that rely on signatures, patch cycles, or manual investigation simply are not keeping pace.
In this presentation, we’ll look at how deception changes that equation. Instead of trying to stop every attack at the perimeter, we’ll explore how strategically placed deception technologies can mislead, delay, and expose AI-driven attackers as they move through an environment. By feeding attackers false information, directing them toward decoy assets, and generating high-confidence alerts when those assets are touched, defenders can dramatically reduce an attacker’s effectiveness while gaining valuable time to respond.
The goal isn’t simply to use AI against AI. It’s to force agentic AI systems to waste time, consume resources, and make bad decisions while giving defenders the visibility they need to detect and stop attacks before they reach critical systems. We’ll discuss practical techniques for deploying deception technologies, how they integrate into modern security operations, and why deception has become one of the most effective ways to counter the speed and scale of today’s AI-powered attacks.
John Strand has both consulted and taught hundreds of organizations in the areas of security, regulatory compliance, and penetration testing. He is a coveted speaker and much loved SANS teacher. John is a contributor to the industry-shaping Penetration Testing Execution Standard and 20 Critical Controls frameworks.