AI is changing cybersecurity in a very practical way.
It is not only helping defenders automate investigation, analyse alerts or write detection logic.
Attackers can use the same technology to move faster.
Reconnaissance can be automated. Phishing can be personalised at scale. Malicious code can be generated and modified quickly. Fake identities and social-engineering scripts can be created with very little effort.
That changes the economics of an attack.
A recent article on jaizanuar.com makes a strong argument that if attackers become increasingly AI-native, deception technology may also need to become AI-native. The idea is worth paying attention to because traditional honeypots were largely designed around human attacker behaviour. (Jaiz Anuar)
The Old Honeypot May Not Be Enough
Classic deception was easy to understand.
Build a fake server.
Create a fake account.
Wait for someone to touch it.
That still has value, but an AI-assisted attacker may behave differently.
Automated reconnaissance can scan faster, prioritise targets and potentially recognise obvious decoys more efficiently than a human working manually. The original article argues that deception therefore needs to move beyond static fake infrastructure toward more adaptive environments. (Jaiz Anuar)
This is where honeytokens become especially interesting.
Fake API keys.
Fake administrator accounts.
Fake credentials.
Fake cloud secrets.
Fake database connection strings.
A legitimate user should never use them.
So when one of those assets is accessed, the signal can be extremely strong.
That is very different from an alert that simply says:
“This behaviour looks unusual.”
Instead, it says:
“Something interacted with an asset that should never have been used.”
AI Could Make Deception More Dynamic
The next step is obvious.
If attackers are becoming more automated, deception can become more adaptive too.
An AI-driven decoy environment could potentially respond differently depending on attacker behaviour. Synthetic users could generate realistic activity. Fake APIs could behave more like real production services. Decoys could adapt instead of remaining static.
The goal is not necessarily to keep an attacker entertained.
The real value is time and confidence.
Time for the SOC to investigate.
Time to isolate compromised identities.
Time to understand where the attacker has already been.
And confidence that the alert represents a genuine trust violation rather than another noisy anomaly.
Deception Still Does Not Replace Basic Security
This part matters.
AI-native deception does not replace MFA, EDR, PAM, vulnerability management, backups or proper monitoring.
It only becomes useful when the fundamentals already exist.
That is also one of the strongest points in the original article: deception works best as a force multiplier for mature security architecture, not as a shortcut around weak controls. (Source)
The broader idea is simple.
We have spent years designing cybersecurity around attackers behaving like people.
Increasingly, they may behave more like automated systems.
If that happens, our detection architecture has to evolve as well.
A deeper security-architecture perspective is available here:
Attackers Are Becoming AI-Native. Deception Must Become AI-Native Too.
