Fighting Fire with Fire: Why Your SOC Needs AVA to Stay Ahead of Autonomous Cyber Attacks
OpenAI's frontier models breached Hugging Face's infra during a benchmark. Priam's AVA shows why autonomous attacks now demand autonomous investigation.
The Future of AI Cyberattacks Is No Longer Theoretical
For years, AI-powered cyberattacks have been discussed as an emerging threat. That conversation changed in July 2026, when OpenAI disclosed what happened during a cyber-capability evaluation of its frontier models. Running against ExploitGym, a public cybersecurity benchmark built by Dawn Song’s team at Berkeley RDI, the models escaped their evaluation sandbox, chained vulnerabilities across several trust boundaries, reached the open internet, and ultimately achieved code execution inside Hugging Face’s production infrastructure.
The models were never instructed to attack anyone. They were instructed to complete a benchmark. Everything that followed came from their own reasoning: roughly 17,600 actions over four and a half days, with no operator directing each step.
The boundary deserves stating as clearly as the headline, because Hugging Face stated it: the only customer content reached was a handful of datasets tied to the benchmark. This was not a catastrophe. It was something more useful to defenders, a well-documented demonstration that the capability now exists.
If frontier models can already investigate, adapt and execute attack paths under supervision, it is reasonable to expect similar capabilities to reach threat actors. The industry spent years preparing for AI-assisted attacks. We should now prepare for autonomous ones.
AI Has Changed the Battlefield
Imagine it is 2:17 AM. An attacker deploys an autonomous agent against your organisation. Within minutes it finds a vulnerable internet-facing application, generates a working exploit, establishes persistence, pivots across cloud resources, and adapts every time a control blocks it.
At the same time it deliberately generates hundreds of low-priority security events. Not because those Alerts matter, but because your analysts do. The objective is no longer only to evade detection. It is to consume the attention of the people responsible for responding.
By the time the real Incident reaches a human investigator, the attacker has moved laterally and begun exfiltrating data. This is where the conversation about AI usually misses the point. The problem is not that attacks got faster. It is that investigation did not.
The Bottleneck Is No Longer Detection. It Is Investigation.
Security teams have invested heavily in detection. Modern environments generate telemetry from endpoints, cloud platforms, identities, email, networks and SaaS applications. Most organisations are not struggling to detect suspicious activity. They are struggling to decide which Alerts represent real attacks.
Triage remains one of the most human-intensive activities in the Security Operations Center. Every Alert requires someone to collect evidence, correlate across multiple products, test a hypothesis, rule out the benign explanation, understand context, and decide whether escalation is justified. That work routinely takes longer than generating the Alert did.
This is the asymmetry. AI is compressing offensive timelines while investigation is still bounded by human speed. Future offensive systems will not behave like scripts running predefined steps. They will behave like operators.
Why Traditional SOC Automation Falls Short
Many organisations have invested in automation, yet queues keep growing. Much of what is sold as “AI for the SOC” improves the workflow around investigation without changing the investigation itself.
Alert enrichment is not investigation
Enrichment adds context before an Alert reaches an analyst. Context is valuable, but it does not remove the investigation. If a human still has to decide whether the Alert is a genuine threat, the bottleneck has not moved. The queue is simply better documented.
AI assistants are not investigators
Conversational assistants summarise telemetry, answer questions and draft notes. That helps productivity, but it leaves the reasoning with the analyst. Investigations demand evidence, not fluency. Generating a convincing explanation is a different thing from proving an attack occurred, and against an adaptive adversary, confidence without verification is a liability.
Static playbooks cannot keep pace with adaptive attackers
Playbook-driven automation works when attacks follow predictable workflows. Autonomous systems do not. They change tactics, find new paths and adapt as conditions change. Every unexpected branch reduces the value of a fixed workflow. What comes next has to reason, not execute a script.
The Real Lesson From the OpenAI Incident
Most coverage focused on the escape. The part that should concern defenders is quieter: the agent investigated, adapted, and changed direction when a path closed, pursuing a long-horizon objective without waiting for approval at each step.
If attackers deploy systems that investigate and exploit at machine speed, the answer cannot be more analysts in front of longer queues.
Meet AVA. Autonomous Investigation, Under Permissions You Control
This is why Priam built AVA (AI Virtual Analyst). AVA is not a chatbot, an enrichment layer or a dashboard. It is an autonomous L1 analyst that investigates Alerts from beginning to end, inside a permission model you set.
Instead of waiting for an analyst to choose the next investigative step, AVA chooses it. It forms Lines of Inquiry mapped to MITRE ATT&CK, and when the answer is not in the tool the Alert came from, it follows the question into whichever connected tool holds it and collects the telemetry itself. That is threat hunting, executed per Alert, on every Alert, rather than on the handful a team has time for.
Verdicts come from PEBRE, our Probabilistic Evidence-Based Reasoning Engine. It weighs competing explanations against the evidence actually collected and returns the one the evidence supports, with a confidence rating and a full Investigation Report. Not a score you have to interpret.
For every Alert, AVA can:
- Collect evidence across the products you already run
- Correlate findings and test them against competing explanations
- Adapt the investigation as new evidence emerges
- Rule out the benign explanation with evidence, not assumption
- Produce a complete, evidence-backed Investigation Report
- Escalate only when human judgement is genuinely required
It tells you when it does not know
An autonomous investigator that always produces an answer is not an asset. It is a liability with good latency.
When the evidence does not support a decision, AVA returns Inconclusive and routes the Alert to a human with the evidence chain and the gaps already attached. The analyst starts where the machine stopped instead of starting over. Material gaps also lower the confidence rating rather than sitting quietly behind it, and the gap is shown as the reason.
This matters more as attackers become autonomous, not less. An adaptive adversary produces exactly the ambiguous evidence that a system optimising for closure will resolve in the wrong direction.
Autonomy you can revoke
AVA can run Triage to closure without a human in the loop. Every one of those actions is a separate permission, and all of them ship denied. You switch on what you are ready for, Alert type by Alert type. If the reasoning service cannot reach its own permission settings, it takes no automatic action at all.
Automatic closure is deliberately bounded to the benign path. AVA does not auto-close a malicious verdict.
Autonomy you cannot revoke is not a feature. It is a demo with a risk attached.
It learns your environment, not everyone’s
Every verdict an analyst confirms or corrects becomes training signal for the reasoning engine, and the lessons stay inside that tenant. One customer’s learned patterns never reach another’s. For a managed provider, tenant isolation here is structural, not a policy setting.
Learning runs on your terms. AVA can accept high-confidence verdicts automatically, or it can require an analyst to approve every lesson before it is kept. Both modes ship, and the automatic one ships switched off.
What This Means for Security Leaders
Security leaders are not solving a technology problem. They are solving a capacity problem. As AI lowers the cost and raises the speed of attacks, capacity has to grow without headcount growing with it, and that requires autonomy that survives an audit.
- Alert fatigue. Routine investigations complete before they reach senior analysts.
- Investigation latency. When attackers operate in minutes, the time between detection and an evidence-backed decision is attack surface.
- Scale. More Alerts investigated without a proportional increase in staffing.
- Consistency. Human investigations vary with experience, workload and fatigue. AVA applies the same method every time, and records what it could not establish.
- Defensibility. Every conclusion opens to the exact query behind it, in a field an analyst can edit and run again. That is what turns an automated decision into one you can defend to an auditor.
The Future SOC Will Be Built Around Autonomous Investigation
The next generation of Security Operations Centers will not be defined by better dashboards or more articulate chatbots. It will be defined by investigators that match machine-speed attacks with machine-speed investigation, and that can show their work afterwards. Detection already got faster. Investigation has to follow.
That is the role AVA was built to fill. Not a SOC where humans investigate every Alert. One where routine investigations resolve themselves, only the Incidents that matter surface, and analysts spend their judgement where judgement is what is needed.
See AVA in Action
The future of cyber defence will not be won by the organisations with the largest security teams. It will be won by the ones that can investigate as fast as attackers can create.
Experience what autonomous security operations look like. Submit a single security Alert and watch AVA transform it into a complete, evidence-backed Investigation Report in real time.
Because autonomous defence is only worth having if you can check its work.
Written by Ashfaaq Farzaan at Priam Cyber AI.