Cyber Frontiers Initiative

Case studies

Traditional manual threat modeling and security design reviews were time-intensive, difficult to scale, and limited in coverage and consistency. Rubrik sought to replace these processes with an intelligent, automated system for structured risk analysis, validation, and certification with full auditability. Solution: Rubrik developed an AI-driven security review platform that replaces manual threat modeling with a multi-agent workflow. Agent 1: Security Reviewer Analyst Ingests design documents and architectural diagrams, performing structured security assessments using Rubrik’s risk scoring matrix, STRIDE threat modeling, OWASP Application Security Verification Standard (ASVS) 4.0, and Rubrik-specific context (backup integrity, multi-tenancy, ransomware protection). It generates prioritized findings with Common Weakness Enumeration (CWE) classifications, MITRE ATT&CK mappings, and remediation guidance. Agent 2: Code Validation Inspector Fetches code from source control and cross-references findings against actual code changes. Using static and differential code analysis, it detects implemented remediations, identifies partial implementations, and flags unaddressed findings - providing code snippets as evidence. Agent 3: General Availability (GA) Certifier Aggregates Security Review findings and validation status, applies risk scoring, and generates certification reports with residual risk assessments, compliance attestations, and complete evidence chains from design through implementation, enabling data-driven GA sign-off decisions with a full audit trail.
USA | IT and Communications (ICT)
Scaling Security Review for Product Portfolio with AI Agents
Rubrik
KPMG’s threat intelligence team had a well-established data collection process, yet analysts spent long hours piecing together threat indicators, validating context and tracing attacks back to specific threat actors. Investigations progressed, but the effort required often meant extended analyst workloads during active engagement cycles. Solution A custom AI model was trained on the existing threat repository and was introduced as a chatbot within the intelligence platform. Analysts now query the system in plain language and receive relevant context, suggested links between attacks, sandboxing13 results and guidance on tracing attacks back to specific threat actors. The model supports forensic investigations, incident response, red team scenario design using mapped tactics, techniques and procedures (TTPs) and rapid intelligence reporting. When required, a controlled fallback enables external AI-assisted research with cited sources.
United Kingdom | Other
Enhancing threat intelligence through AI Driven Correlation and attribution
KPMG
Cybercrime fighters struggle to uncover hidden threat intelligence quickly within large volumes of data such as legal discovery responses and documents from hosting providers. Valuable threat indicators are often buried and difficult to find, which slows down forensic investigations and makes it harder to communicate risks to defenders and customers. Solution Microsoft’s DCU developed an AI-powered tool to address these challenges. Haystack is an AI application that automatically tags likely threat intelligence indicators and uses an Azure OpenAI-based chatbot to curate intelligence rapidly. This enables analysts to identify relevant information within seconds or minutes rather than hours.
USA | Technology
Microsoft’s Digital Crimes Unit (DCU) uses AI to curate and communicate threat intelligence data
Microsoft
Accenture’s information security team faced what could be described as a fundamental scaling challenge: the enterprise attack surface included hundreds of thousands of internet-facing sites. Manually reviewing each site for common security issues required 15 minutes per site, meaning that scaling this process across the entire attack surface would take years for a resource-constrained team. Solution Agent Oliver is an advanced AI capability that has transformed how Accenture manages its external attack surface. It combines two distinct toolsets into a single capability: - The Automated Site Crawler tool automatically scans the enterprise’s internet-facing sites, visits each site and flags compliance issues (e.g. missing multifactor authentication). – The Automated Web Application Tester tool tests web applications using four coordinated execution agents: crawlers map the application, configuration agents check settings, injection agents probe for vulnerabilities and a reporter consolidates the findings into a single report with recommendations for mitigating identified risks.
Ireland | Other
Agent Oliver, Accenture cybersecurity AI innovation
Accenture
Repsol identified the need to strengthen its cybersecurity posture across a complex enterprise environment. It faced challenges managing SOC activities, migrating security, information and event management (SIEM) platforms and processing large volumes of threat intelligence from multiple sources. Manual processes limited the speed and scalability needed to address evolving threats. Solution Repsol positioned AI as a strategic pillar, deploying an enterprise-grade agentic AI platform and expanding the use of large language models (LLMs). Within cybersecurity, AI was integrated into SOC operations and governance. Key initiatives included: – Accelerating SIEM migration using AI-driven agents, enabling faster transitions – Enhancing threat intelligence by using predesigned and optimized AI prompts, automating the selection, extraction and refinement of data on vulnerabilities and threat actors from multiple sources
Spain | Energy
Optimizing security operations centre (SOC) activities with AI integration
Repsol
Security organizations need standardized threat intelligence workflows for consistent outputs. Manual research can be slow, inconsistent and difficult to scale. Threat indicators may be incomplete, contextual enrichment can vary in quality and turning analysis into actionable guidance for protection, response and recovery can take weeks. This creates duplicated effort and hinders intelligence sharing. Solution Check Point Research – the threat intelligence and research division within Check Point – developed Universe, an AI-powered research cycle that converts expert investigative knowledge into repeatable automation. Universe uses AIdriven multi-agent workflows and curated prompts that reflect Check Point Research’s analytical standards. It reverse engineers samples at scale, extracts and validates indicators of compromise (IOCs), enriches them with internal and public data and supports telemetry hunting14 by generating and executing hunting queries to confirm prevalence and expand the intelligence picture. It generates standardized outputs, including IOC context, relationships and confidence levels alongside detection rules, threat patterns, concise analyst reports and remediation recommendations. Governance is strengthened through consistent structure, a clear evidence trail and a closed-loop system that feeds validated outcomes back into future investigations
Israel | Technology
Automating and standardizing threat intelligence with agentic AI
Check Point Software Technologies
Google needed to secure large, complex software codebases, where manual review could not keep pace with the speed and scale required to detect and address vulnerabilities. Rapid identification and remediation of unknown security flaws was essential. Solution Google deployed AI agents to enhance software security by increasing the speed, consistency and scale of vulnerability detection and remediation. - Big Sleep is an AI-based security agent that actively searches for and identifies unknown security vulnerabilities in software, enabling security teams to act before flaws are exploited. Big Sleep has been deployed across Google’s products as well as on widely used open-source projects. – CodeMender, developed by Google DeepMind, is an AI-based agent that automatically improves code security by generating patches for identified vulnerabilities. To ensure reliability and safety, all CodeMender-generated patches are reviewed by human researchers before being submitted upstream.
USA | Technology
Operationalizing AI agents for large-scale vulnerability detection and remediation
Google
The AXIS Capital security architecture and engineering team wanted to embed security intelligence directly into application and cloud design, minimizing developer friction and reducing time spent managing alerts and backlogs. Traditional manual reviews could not scale to meet the demands of complex cloud environments. Solution The team applied AI to analyse code and cloud configurations, using static application security testing and cloud security posture management capabilities. Uninterrupted scanning within continuous integration and continuous deployment pipelines enables proactive risk assessment, identifying and addressing vulnerabilities before code reaches production. AI prioritized the risks based on exploitability and business impact, recommending actionable remediation. AI-generated guidance and fixes were delivered within existing workflows, accelerating remediation and reducing developer friction. Teams also use AI to correlate data across cloud environments to identify architectural weaknesses and surface misconfigurations that are difficult to detect manually. Through ongoing cloud security posture management, AI detects misconfigurations in real-time.
Bermuda | Financial services
AI-driven security architecture and engineering for scalable, secure-by-design systems
AXIS Capital
As Dubai's digital economy expands, individuals and businesses face growing volumes of sophisticated web-based threats, such as phishing and malicious URLs, which traditional security measures often fail to detect in real time. The smart city ecosystem has widened the attack surface, increasing exposure to data theft and financial fraud during everyday browsing. Static threat databases are no longer sufficient to counter evolving cybercrime. Solution: DESC developed RZAM, an AI-powered browser extension and mobile app providing a “fearless browsing” experience. Using machine learning trained on more than 1 million URLs, RZAM performs real-time webpage analysis to identify and block malicious content within milliseconds, acting as a seamless digital shield across platforms. It enables proactive protection without collecting or storing personal user data.
United Arab Emirates | Government
AI-Driven Resilience: Elevating Urban Cybersecurity with RZAM
Dubai Electronic Security Center (DESC)
Traditional cybersecurity operations face a critical scalability problem in autonomous threat detection. Collecting 10–20 GB/s per endpoint across 350,000 endpoints would generate 15 petabytes daily, making centralized data collection impossible. This creates dangerous gaps between alert generation and investigation, increasing the risk of missed threats and prolonged incident response times. Solution: Allianz developed a hypothesis-based AI analysis system that reimagined threat investigation. Rather than collecting all endpoint data centrally, the AI generates hypotheses when alerts are triggered, identifies the data points needed to validate them and retrieves them on demand using forensic application programming interfaces (APIs). The system iteratively refines its analysis, mirroring the on-demand data-processing approach used in autonomous vehicle technology. This enables targeted dynamic data collection, avoiding infrastructure overload.
Germany | Financial services
Hypothesis-Based AI Analysis for Autonomous Cyberthreat Detection
Allianz
The Canadian Centre for Cyber Security, like many other organizations, faces an escalating volume of increasingly complex malicious files, placing pressure on cybersecurity teams to conduct rapid and accurate analysis at scale. Efficiently processing and prioritizing large inflows of files while minimizing manual reporting and cognitive load is critical for maintaining effective cyber defence. Solution: To address this, the Canadian Centre for Cyber Security developed Assemblyline, an open-source automated malware analysis and triage system used by defenders across government, industry and academia. It integrates more than 50 analytic services and offers a scalable infrastructure capable of handling millions of files daily. Since 2024, the Cyber Centre has added AI-driven summarization enhancements to Assemblyline, making this capability available to the broader open-source user community. This feature streamlines manual reporting and helps translate technical findings into actionable intelligence.
Canada | Government
AI-Enhanced Malware Analysis Efficiency through Assemblyline
Canadian Centre for Cyber Security
Phishing is one of the most prevalent cyberthreats, increasingly relying on social engineering rather than technical exploits. Modern phishing campaigns are often targeted, multilingual and fast-evolving, exploiting behavioural and psychological tactics including false urgency, authority impersonation and the imitation of trusted sources. Traditional detection approaches based on signatures, sender reputation or static rules struggle to identify these novel attacks, particularly when infrastructure and content are previously unseen. Solution: An AI-driven phishing detection solution was deployed as an augmentation layer into email security operations at Santander Global SOC. The solution combines multiple analytical capabilities, including domain analysis, brand and visual inspection and advanced semantic analysis. A key differentiator is an internally trained, multilingual LLM designed to identify psychological persuasion traits embedded in phishing messages, such as scarcity, authority, reciprocity and commitment. By focusing on semantic intent and human-centric manipulation patterns, the system improves detection of previously unseen, highly targeted phishing campaigns that evade traditional controls.
Spain | Financial services
AI-Driven Phishing Detection through Persuasion Analysis
Banco Santander
Adversaries increasingly use automation and AI to move faster and operate at scale, placing sustained pressure on security operations. IBM needed to expand its 24x7 threat investigations without adding headcount or compromising governance or quality. At the same time, it aimed to reduce manual effort, investigation time and analyst alert fatigue. The challenge was to automate investigations at scale while maintaining trusted, explainable and auditable outcomes across global managed security services. Solution: IBM implemented ATOM as the central investigation and triage engine within its managed security services. ATOM autonomously investigates, enriches and scores alerts at scale using agentic AI, with human analysts focusing on oversight and escalation. Today, ATOM handles about 95% of daily investigations, delivering consistent, explainable and auditable results. IBM operates as Client Zero, running its global managed security services on ATOM. ATOM enables automation, improving speed, accuracy and investigation quality. ATOM applies deep context, correlation and explainable AI to strengthen detection while ensuring human-in-the-loop governance.
USA | IT and Communications (ICT)
Threat Detection and Response with Autonomous Threat Operations Machine (ATOM)
IBM
Traditional static controls often fail to distinguish between legitimate team activity and malicious mass downloads, leaving organizations vulnerable to insider threats, corporate espionage and confidential information leaks. The rise of shadow AI has created new pathways for intellectual property theft, and the gradual accumulation of excessive access privileges increases the risk of attackers moving across systems within the network and of regulatory non-compliance. Solution: Using agentic AI, Cybervergent implemented real-time monitoring of the speed and volume of data access across its intellectual property channels. This solution automates governance and secures IP by continuously analysing the speed and volume of data movement. Key features include: – Source code/proprietary information exfiltration detection: Real-time monitoring distinguishes between normal developer activity and suspicious mass downloads, identifying potential insider threats. – Shadow AI leak prevention: Tracking data egress to public AI platforms prevents proprietary code and information from entering external training sets, safeguarding sensitive assets from exposure. – Managing access privileges: Identifying and responding to the use of expired or escalated permissions, which may signal account takeover or unauthorized movement across systems. – Regulatory compliance: Automating controls ensures that data is not transferred to unvetted AI tools, thereby reducing the risk of regulatory fines and legal liabilities.
Nigeria | IT and Communications (ICT)
AI-Enhanced Real-Time Intellectual Property Access Monitoring
Cybervergent
Aramco's cybersecurity landscape demands solutions that can keep pace with rapidly evolving threats. In several critical domains, no commercial technology existed to address the scale, complexity or specificity of the challenges facing the world's largest energy company. Solution: To bridge these gaps, Aramco Cybersecurity embedded AI at the core of its defensive ecosystem. Some 40% of its cybersecurity solutions use AI not as an add-on but as a foundational capability to detect malicious activity, automate response and enhance its incident response with operational efficiency. An example is the development of more than 50 patented AI solutions designed to identify sophisticated attack patterns, analyse massive volumes of telemetry and autonomously trigger containment actions. These solutions were deployed through a modular architecture that integrates seamlessly with existing security platforms, enabling real-time threat detection and automated workflows that previously required extensive manual effort.
Saudi Arabia | Energy
AI as a Force Multiplier: How Aramco Closes Cybersecurity Gaps through In-House AI Innovation
Aramco
ING, a global financial institution, has developed a machine learning solution built on top of its existing data leakage prevention (DLP) cybersecurity tooling to better process and prioritize alerts related to potential data leaks across multilingual email attachments, web uploads and metadata. Solution: The implementation provides a reproducible workflow that can be extended to other organizations to process multilingual email attachments, web uploads and metadata. ING uses an AI model to categorize related email attachments and combines it with a classification model to prioritize and identify potential leaks. ING has also implemented a “browser uploads” production pipeline that provides SOC analysts with very-near-real-time insights via easy-to-read dashboards, enabling them to handle issues promptly as they seek to protect more than 60,000 employees globally.
Netherlands | Financial services
ING's AI-Powered Data Leakage Prevention
ING Group
PETRONAS sought to elevate analyst effectiveness, eliminate repeatable manual work and accelerate response across its enterprise SOC. Solution: Advanced AI capabilities were integrated directly into analyst workflows, providing real-time incident summaries, guiding next steps, translating natural language to queries and automating context gathering. This standardizes investigation quality and enables junior analysts to contribute earlier in their career. Building on this, AI agents are being deployed that autonomously triage high-volume incidents, correlate alerts across telemetry and link anomalies with threat intelligence. These agents surface actionable patterns with structured recommendations, reducing manual correlation work. Integrated natural language intelligence look-ups provide context on threat actors, campaigns, malware families and IOCs, strengthening prioritization and proactive detection. The initiative was shaped through a six-month pilot in which use cases were prioritized based on analyst time spent, incident recurrence, task consistency and risk relevance, ensuring high-impact investment. Adoption considerations – including analyst mindset, workflow adjustments and change management needs – were addressed through continuous feedback loops. Deployment of AI agents required no new hardware, and it was scaled incrementally based on real-world performance metrics and analyst input, enabling safe AI adoption, operational continuity and value validation at each stage.
Malaysia | Energy
AI-Enabled Cyber Defence: Accelerating SOC Performance with Embedded Intelligence
PETRONAS (Petroliam Nasional Berhad)
At Standard Chartered, SOC and response teams face increasing pressure from growing alert volumes, complex investigations and rising expectations in terms of speed, consistency and auditability. Solution: To address these challenges, Standard Chartered implemented an AI hyper-automation strategy embedded into SOC and case management workflows, with a strong focus on analyst enablement and governed automation. The solution is an intelligent platform providing real-time situational awareness of users, applications and threats across the bank. The bank-wide solution applies machine learning and LLMs to dynamically score risk, prioritize alerts and cases and enrich detections with contextual intelligence. AI-driven triage automatically classifies events and averts duplication before case creation, while generative AI supports analysts by producing concise case summaries and drafting communications. An in-console AI co-pilot provides real-time guidance, similar-case recommendations and next-best actions, operating under a strict human-in-the-loop model.
United Kingdom | Financial services
AI Hyper-Automation for SOC and Case Management
Standard Chartered
As Dream's security operations encountered increasingly sophisticated malware linked to multistage attack campaigns, deep technical analysis became critical for response and eradication. Although detection flagged suspicious activity, producing remediation guidance often required multiday reverse-engineering efforts by specialists across multiple programming languages. This caused delays and limited how many complex incidents could be handled simultaneously. Scaling high-quality malware response without expanding specialist headcount became a priority. Solution: An internal AI-assisted malware analysis capability was developed and integrated into detection and response workflows. Designed and refined by Dream's cybersecurity AI researchers embedded in operational investigations, the system analyses malicious code to examine how it runs, remains active on a system, escalates access, moves across systems and communicates with attackers. It extracts TTPs and generates structured, explainable outputs supporting containment, environment-wide hunting for related variants and remediation and eradication guidance. Outputs are transparent, evidence-backed and reviewed by human analysts before action is taken.
Israel | IT and Communications (ICT)
AI-Assisted Deep Malware Analysis for Scalable Response
Dream
Batuta's service teams, IT managers and solution engineers spend significant time manually writing scripts to detect and remediate endpoint vulnerabilities and deploy technologies. Script development requires both deep technical expertise and situational awareness, creating a bottleneck. To scale, the business must boost productivity by five times without increasing headcount or compromising security. Solution: Magic scripts convert natural language instructions (e.g. “block port 445”) into safe, executable code, enabling rapid containment and remediation. The system is context-aware, adapting scripts to the active module. For example, compliance modules generate read-only scripts, while remediation modules produce scripts that enforce controls. Scripts are tailored to the target operating system (OS) and environment, accounting for platform constraints. Built-in safety checks prevent harmful actions (e.g. disk wiping or the disabling of security tools), with user approval required for sensitive operations.
Saudi Arabia | IT and Communications (ICT)
From Classification to Containment: Streamlining Cyber Defence with AI-Driven Software Classifier and Magic Scripts
Batuta

Cyber Frontiers Initiative

A World Economic Forum Initiative
© 2026 All rights reserved
Privacy Policy & Terms of Service