Why intelligent detection, automated response and unified security platforms are redefining enterprise cyber defence
Artificial intelligence (AI) has fundamentally changed the cybersecurity landscape. While organisations are harnessing AI to improve productivity, automate workflows and accelerate digital transformation, cybercriminals are using it for faster and highly targeted attacks.
With AI, hackers are able to send more personalized and convincing phishing emails to unsuspecting users. Hackers are also using AI to create malware that can evade traditional detection methods. AI helps hackers to automate attacks and exploit vulnerabilities at unprecedented speed.
According to a report co-authored by Oxford University, Cambridge University, OpenAI, the Electronic Frontier Foundation and the Center for a New American Security, Artificial intelligence and machine learning (ML) are altering the landscape of security risks for citizens, organizations, and states.
“Malicious use of AI could threaten digital security (e.g. through criminals training machines to hack or socially engineer victims at human or superhuman levels of performance), physical security (e.g. non-state actors weaponizing consumer drones), and political security (e.g. through privacy-eliminating surveillance, profiling, and repression, or through automated and targeted disinformation campaigns),” it reads.
The report, dubbed the Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation, adds that as AI capabilities become more powerful and widespread, there will be expansion of existing threats, introduction of new threats, change to the typical character and intensity of threats.
“It is often the case that AI systems don’t merely reach human levels of performance but significantly surpass it. It is troubling, but necessary, to consider the implications of superhuman hacking, surveillance, persuasion, and physical target identification, as well as AI capabilities that are subhuman but nevertheless much more scalable than human labour,” said Miles Brundage, Research Fellow at Oxford University’s Future of Humanity Institute.
For enterprise security teams, this marks a turning point. Traditional security strategies built around prevention cannot keep pace with modern threats. With AI, cyberattackers are able to automate vulnerability discovery, launch sophisticated cyberattacks, improve target selection, evade detection, and creatively respond to changes in the target’s behavior.
Despite the efficiency, scalability, and ease of diffusing AI technologies, the dual-use nature of AI means the same characteristics of AI that enable large-scale and low-cost attacks also allow for more scalable defenses. AI-enabled defenses such as spam filters and malware detection, as well as others that are being developed and widely deployed. With AI, cybersecurity is shifting from simply blocking threats to continuously detecting, investigating and responding to suspicious activity.
This evolution has placed Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) at the centre of modern enterprise security.
Why Traditional Antivirus Is No Longer Enough
Conventional antivirus solutions remain an important component of enterprise security, but they were designed for an era when most attacks relied on known malicious files. Today’s threat actors increasingly employ fileless attacks, credential theft, ransomware, insider abuse and “living-off-the-land” techniques that use legitimate operating system tools such as PowerShell and Windows Management Instrumentation (WMI) to carry out malicious activities.
Because these techniques often involve trusted applications rather than recognisable malware, signature-based detection alone is no longer sufficient. Security teams require visibility into how systems behave, not just whether malicious files exist.
This shift has made behavioural analytics one of the most important advances in modern cybersecurity. Instead of asking whether a file is malicious, AI-powered security platforms now monitor anomalies in the process, device or user behaviour. Using AI, cybersecurity analysts can track and purge unexpected privilege escalation, unusual PowerShell execution, abnormal data transfers or suspicious authentication attempts before ransomware is deployed or sensitive information is stolen.
How EDR Changes Endpoint Security
Using AI, Endpoint Detection and Response extends endpoint protection by continuously collecting telemetry from laptops, desktops, servers and virtual machines. It monitors, records and analyzes every significant event such as process execution, registry modification, network connection, user authentication and application activity to identify any malicious behavior.
Unlike traditional antivirus, EDR provides security teams with a detailed timeline of an attack. Analysts can trace where a compromise began, understand how an attacker moved through the environment and identify every affected endpoint.
An EDR platform detects the unusual activity, correlates it with outbound network connections and flags the behaviour as suspicious. Rather than generating isolated alerts, it reconstructs the attack chain, enabling analysts to isolate the endpoint, terminate malicious processes and prevent the attacker from moving deeper into the network.
This level of visibility dramatically reduces investigation time while improving incident response.
Why XDR Represents the Next Evolution
While EDR focuses on endpoints, modern attacks rarely remain confined to a single device. A compromised user account may access cloud applications, authenticate through identity platforms, communicate via corporate email and interact with multiple servers before security teams realize an attack is underway.
Extended Detection and Response (XDR) addresses this challenge by bringing together telemetry from endpoints, email systems, cloud workloads, identity providers, servers and network infrastructure.
Instead of forcing analysts to investigate separate alerts across multiple security products, XDR automatically correlates related events into a single incident.
A phishing email, suspicious Microsoft 365 login, abnormal endpoint behavior and unusual cloud activity may appear unrelated when viewed independently. XDR links these events together, providing analysts with a complete picture of the attack and enabling faster, more informed response decisions.
This ability to correlate events across the enterprise is becoming increasingly valuable as organizations adopt hybrid and multi-cloud environments where visibility is often fragmented.
As enterprise cyberattacks become faster and more sophisticated, organizations are looking beyond standalone security tools toward platforms that can consolidate prevention, detection, investigation and response. This is the philosophy behind Kaspersky Next, the company’s flagship enterprise cybersecurity portfolio that combines enterprise-grade endpoint protection with EDR, XDR, cloud security and AI-assisted investigation in a single platform. Designed as a scalable solution, organizations can begin with advanced endpoint protection and progressively adopt more sophisticated EDR and XDR capabilities as their security maturity grows.
According to Kaspersky, one in three organizations plans to integrate EDR or XDR into their Security Operations Centres (SOCs) as businesses seek better visibility, faster investigations and more proactive defense against increasingly sophisticated attacks. Kaspersky Next also reflects a growing industry shift towards integrated security operations.
Kaspersky uses predictive algorithms, machine learning, neural networks, clustering techniques and statistical modelling to improve threat detection accuracy, prioritize incidents and accelerate both Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). These AI capabilities help reduce alert fatigue by identifying the threats that require immediate attention while automating routine investigation tasks.
Download this Whitepaper to find out how Kaspersky Next can help your organization to cut infrastructure resource requirements by up to 30% with Kaspersky Next EDR Expert deployments and by up to 60% with Kaspersky Next XDR Expert deployments. Kaspersky Next EDR Expert is trusted by more than 600 enterprise customers protecting over 2.5 million endpoints worldwide, while its detection engine is supported by more than 1,900 detection rules developed and continuously maintained by Kaspersky’s global Security Operations Centre. At the XDR level, the platform includes more than 2,700 preconfigured detection rules and over 300 integrations with third-party technologies.