Real-Time Adaptive Defense: AI, Data, and the Future of Security Platforms

Timor Sherf, field CTO for Cato Networks, argues that static, signature-based security appliances cannot keep pace with AI-weaponized attacks and makes the case for a converged, AI-driven security platform. He opens with Pliny the Liberator, a self-taught researcher who publicly documents breaking every new LLM's safety guardrails, to show that if one individual can do this, threat actors can too; recent examples include deepfake helpdesk impersonation via Microsoft Teams, the Salesforce Drift AI chatbot breach, an attacker abusing Anthropic's Claude, and EchoLeak, a zero-click attack tricking Microsoft Copilot into exfiltrating SharePoint data. He contrasts this with point solutions (firewalls, IPS, CASB, DLP, SIEM) that see only narrow context and react too slowly, then lays out architecture principles for a next-generation platform: cloud-delivered, elastic, built on a single shared data context that every real-time and offline AI engine reads from and writes to. He walks through how Cato implemented this over roughly ten years, illustrated with a cyber-squatting detection example, and closes with a Q&A on model choice, protecting the protection layer, and deployment options.