When the Pyramid Starts to Move: How Agentic AI Changes the Value of Cyber Threat Intelligence
The Cyber Threat Intelligence Pyramid of Pain
For more than a decade, the Pyramid of Pain has provided one of the most useful mental models in cyber threat intelligence.
The principle is elegantly simple. At the bottom of the pyramid sit indicators such as hashes and IP addresses. They are relatively easy for defenders to identify, but equally easy for attackers to change. Move higher, and we find domains, network and host artefacts, tools and, eventually, Techniques, Tactics and Procedures (TTPs). The higher we climb, the more painful it should become for an adversary to adapt.
Change a file hash? Trivial.
Change an IP address? Easy.
Replace infrastructure? Inconvenient.
Replace a tool? More difficult.
Change how you operate? That hurts.
This is precisely why, for more than a decade, I've encouraged organisations building mature Cyber Threat Intelligence (CTI) programmes to move beyond relying solely on Indicators of Compromise (IoCs) and instead focus on behavioural detection.
The objective isn't just to detect the tools, hashes, or infrastructure an attacker used. It's to understand how they operate. Because while IoCs expired, behaviours persisted. By detecting attacker tradecraft rather than individual artefacts, organisations become far more resilient to the constant evolution of adversary tooling and infrastructure.
The emergence of AI challenges one of the assumptions behavioural detection has traditionally relied upon: consistency. An attacker may no longer need to operate in predictable ways. In fact, AI-driven agents may be consistently inconsistent - varying their tools, sequences and decision-making from one intrusion to the next while still pursuing the same objective.
When changing behaviour becomes cheap and commonplace, the top of the Pyramid of Pain starts to move.
Why TTPs Became So Valuable
The Pyramid of Pain, created by David Bianco, describes the relationship between the indicators defenders detect and the difficulty an adversary experiences when forced to change them. Its enduring value comes from an important observation about human attackers: attackers develop habits and tradecraft,
They build tooling. They create playbooks. They learn techniques that work. They reuse infrastructure. Teams develop expertise in particular technologies and attack paths. I can attest from firsthand experience responding to incidents involving multiple nation-state actors that even the most sophisticated adversaries exhibit patterns. Their tools may evolve and their infrastructure may change, but elements of their tradecraft remain remarkably consistent.
One group may favour a particular approach to credential theft. Another may regularly use remote services for lateral movement. A ransomware affiliate may follow a recognisable sequence involving PowerShell, credential dumping, Active Directory discovery, remote administration tools and eventual deployment.
Individual indicators change constantly, but the underlying behaviour changes much more slowly. That made behaviour valuable intelligence.
Frameworks such as MITRE ATT&CK allowed defenders to describe those behaviours systematically, while threat intelligence teams mapped observed campaigns and threat actors against them. The objective was increasingly to detect the tradecraft rather than the artefact. Individual Indicators of Compromise (IoCs) are fleeting. Infrastructure is abandoned, malware is recompiled, and payloads are replaced. Tradecraft, however, is far more enduring. The techniques, operational habits, and decision-making that underpin an intrusion are considerably harder to reinvent.
The real value emerged once you could confidently classify the adversary. Attribution was never simply about naming the threat actor; it provided context. Threat intelligence could then inform you of the adversary's established tradecraft, typical objectives, preferred methods of persistence, lateral movement techniques, data collection behaviours, and even the actions they were likely to take next. Detection became cumulative. Rather than responding only to what had already been observed, defenders could proactively hunt for the behaviours and techniques historically associated with that actor, often uncovering additional compromises that would otherwise have remained hidden.
This fundamentally changed the role of Cyber Threat Intelligence. It evolved from a repository of indicators into a source of adversary knowledge that informed detection engineering, threat hunting, and incident response. The question was no longer, "Have we seen this hash or IP address before?" but rather, "If this is the adversary we believe it is, what else should we expect to find?"
This model contains an implicit assumption: changing tradecraft is expensive. Historically, that has been largely been true.
An attacker who has spent years developing expertise, tooling and operational procedures cannot instantly replace them without introducing cost, risk and uncertainty. Agentic AI attacks begin to challenge that constraint.
From Attack Playbooks to Attack Objectives
Traditional cyberattacks, even highly sophisticated ones, are generally constrained by human decision-making. The attacker chooses a technique, selects a tool, interprets the result and then decides what to do next.
Automation certainly exists, but much of it has historically followed relatively deterministic workflows, agentic AI introduces something different. Rather than executing a fixed sequence of commands, an autonomous or semi-autonomous attack system can potentially be given an objective:
Gain access to this environment.
Find privileged credentials.
Identify the systems required to deliver this business service.
Establish persistence.
Locate and compromise the organisation’s recovery capability.
The agent can then reason about how to achieve that objective based upon what it discovers. If one technique fails, it will try another. If a tool is blocked, it will generate or select something else. If PowerShell is heavily monitored,it will use another execution mechanism. If credential dumping triggers an EDR control, it seeks credentials elsewhere. If one lateral movement path is blocked, it’ll identify another.
The objective remains stable, but the TTPs used to achieve it may not. Agentic AI is moving from playbook-driven towards objective-driven attacks.
TTP Diversity Becomes a Feature, not a Challenge
Consider a simplified intrusion, common to those I see every week in the ransomware incidents I provide response services for. A traditional attacker might repeatedly use a familiar sequence:
Initial access via exploitation of an internet-facing vulnerability
Defence evasion by installing a vulnerable device driver to disable or bypass endpoint security control
Execution of PowerShell to execute malicious code, establish persistence, download additional tooling and perform reconnaissance while blending into legitimate administration
Credential dumping
SMB lateral movement
Ransomware deployment via a Group Policy Object
As I mentioned above, over time, defenders observe this pattern of behaviour. Threat intelligence identifies the pattern. Detection engineering develops analytics around it. Threat hunters search for it. Purple teams reproduce it. Eventually, the organisation becomes substantially better at identifying that attack sequence. The attacker therefore experiences the “pain” described by the Pyramid.
Now imagine an agentic attacker. It attempts PowerShell and discovers that execution is restricted. Instead of repeatedly fighting that control, it chooses another interpreter. Credential dumping is blocked, so it searches configuration files, browser stores, service accounts, cloud metadata, automation platforms or exposed secrets. SMB movement fails, so it evaluates WinRM, RDP, SSH, remote management software, cloud administration interfaces or application-level trust relationships.
The result could be two attacks pursuing exactly the same objective while producing substantially different ATT&CK mappings. That variability is not accidental, it will become an inherent characteristic of autonomous offensive systems.
The Pyramid of Pain Assumes Scarcity
The deeper issue is economic. The Pyramid of Pain works because certain attacker resources have historically been scarce.
Infrastructure costs money. Tools require development. Exploits require expertise. Operational knowledge takes time to acquire. TTPs require human skill and experience. The higher we move up the pyramid, the greater the investment being disrupted.
Agentic AI reduces the scarcity of something particularly important: decision-making capacity. A human operator cannot realistically evaluate hundreds of potential attack paths simultaneously; an AI system can.
A human penetration tester may know several ways to enumerate an environment. An agent can potentially draw upon an enormous corpus of techniques, tools, documentation, code and previous observations, selecting between them dynamically.
The cost of trying another technique therefore falls dramatically, this matters because the Bianco’s Pyramid of Pain is fundamentally a model of attacker switching costs. If switching from one TTP to another becomes inexpensive, disrupting a particular TTP creates less pain.
The pyramid has not disappeared, but layers of it may be getting flatter.
Threat Intelligence Has Relied on Behavioural Persistence
This creates a difficult problem for Cyber Threat Intelligence functions. A significant part of cyber intelligence analysis involves connecting observations over time.
We see particular infrastructure.
We observe malware.
We identify tools.
We recognise behavioural patterns.
Those observations allow analysts to cluster activity, associate campaigns and sometimes attribute activity to particular groups. TTPs have been particularly useful because they tend to persist even when infrastructure and tooling change. Agentic attacks will weaken that persistence.
Imagine an autonomous attack capability capable of selecting from hundreds of techniques according to the target environment. Against Organisation A it uses PowerShell. Against Organisation B it uses WMI. Against Organisation C it compromises an existing remote management platform. Against Organisation D it exploits cloud identity relationships. Against Organisation E it generates a bespoke attack path that has never previously appeared in the operator’s campaigns.
The actor may be the same; the objective may be the same; the infrastructure may even be related but the observable behaviour could vary significantly.
I have spent years telling defenders not to chase indicators; detect behaviour. Now I’m adapting to the uncomfortable truth that with AI, behaviour itself is becoming disposable?
Attribution Becomes Harder Too
Threat actor attribution has always been probabilistic. Adversary infrastructure, malware families, language artefacts, victimology, targeting, operating hours, and TTPs are assessed collectively to form an analytical judgement. None of these signals is definitive in isolation, but together they have historically provided sufficient confidence to classify an adversary and guide both preparatory and incident response activities.
Agentic AI introduces the possibility of deliberate, or even incidental, behavioural contamination. AI agents could adopt, blend, or inadvertently emulate the tradecraft of multiple threat actors, reducing the reliability of the behavioural patterns that attribution has traditionally relied upon. As a result, defenders may need to place less emphasis on who they believe the adversary is and more emphasis on what the adversary is trying to achieve
This Does Not Make CTI Irrelevant
The wrong conclusion would be that threat intelligence no longer matters. Quite the opposite—it remains fundamental. What may change is its centre of gravity. If attacker implementations become increasingly dynamic, intelligence must focus more heavily on those aspects of adversary operations that remain comparatively stable.
Rather than concentrating primarily on malware families, infrastructure, or even behavioural sequences, in the Cyber Resiliency Transformation Programs I’m contracted by customers to lead I will be placing greater emphasis on adversary objectives, constraints, capabilities, access requirements, target selection and the operational outcomes they seek to achieve. These characteristics are far less susceptible to the variability that Agentic AI can introduce and therefore provide a more enduring foundation for detection, hunting, and defensive planning.
CTI may need to move beyond describing how attackers behaved previously towards understanding what attackers are trying to achieve and what conditions must exist for them to achieve it.
We Need to Think Above the Pyramid
There may therefore be another layer of intelligence sitting conceptually above TTPs: intent and objective.
An attacker might change tools constantly. They might change techniques between every victim. They might allow an autonomous system to invent completely different attack paths, but the underlying objective usually changes much less.
If the objective is ransomware, the attacker still needs sufficient control over the environment to create operational impact.
If the objective is espionage, they still need access to information of intelligence value and a means of maintaining or regaining that access.
If the objective is destructive attack, they still need to identify systems whose loss creates meaningful business consequences.
If the objective is extortion, they still need leverage.
The route may change, but the destination does not. That suggests defenders should increasingly model the conditions required for attacker success, rather than relying solely on recognising the route attackers previously took to get there.
Detection Engineering Must Expect Substitution
This also changes how we should think about detection. Strategies built around identifying individual techniques risk becoming increasingly brittle as attacker implementations become more dynamic. Instead, defenders need to ask a different question: what malicious objective does this collection of activity represent?
Consider credential access. There are countless ways to obtain credentials. Detecting a specific credential-dumping utility is valuable. Detecting unauthorised access to LSASS is more resilient. Ultimately, however, the defensive outcome is recognising when an attacker is attempting to compromise an identity, credential, or privilege boundary in a way that materially increases their ability to operate within the environment.
The same principle applies to lateral movement. SMB is not the objective. RDP is not the objective. WinRM is not the objective. These are simply different implementations of the same underlying goal: moving from the attacker's current foothold to systems, identities, or data of greater operational value.
Agentic AI amplifies the importance of this distinction. If AI agents can dynamically select whichever technique best suits the environment they encounter, then defenders cannot assume any particular implementation will be used. The objective remains stable, even if the path taken to achieve it continually changes.
Detection therefore needs to become increasingly outcome-aware rather than technique-dependent. Throughout numerous security operations transformation programmes, I’ve worked with organisations to systematically rebuild detection content around comprehensive coverage of adversary outcomes at the tactic level, rather than pursuing ever-expanding coverage of individual techniques. That approach improved resilience against changing attacker tradecraft then; in an era of Agentic AI, it may become essential.
Threat Hunting Will Need to Look for Attack Trajectories
Threat hunting faces a similar challenge as traditional hunting often begins with a hypothesis based upon known adversary behaviour: “Threat actor X frequently uses technique Y. Can we find evidence of technique Y in our environment?”
This type of hunting will remain useful, but agentic attacks require another form of hypothesis: “What would an attacker need to accomplish to reach this business-critical service, regardless of which techniques they chose?”
This moves threat hunting towards attack trajectories.
Identity escalation.
Trust traversal.
Control-plane access.
Security-control interference.
Backup discovery.
Recovery infrastructure access.
Data concentration.
Privilege accumulation.
Individually, the events may look unrelated but taken together, they describe progress towards an objective. This will require better visibility and correlation across identity, endpoint, network, cloud, SaaS and recovery telemetry.
It also reinforces the importance of retaining historical telemetry. As attacker behaviour becomes increasingly dynamic, understanding an intrusion may depend less on matching a known signature and more on reconstructing the sequence of decisions that enabled the attacker to progress through the environment. The ability to replay events, understand causal relationships, and identify the paths not taken becomes increasingly valuable when every intrusion may look different.
This is also why I have repeatedly argued that your backup solution is far more than a recovery capability. It is a critical cybersecurity investigative resource. Beyond restoring systems, it provides defenders with historical context that may no longer exist elsewhere, enabling investigators to reconstruct attacker activity, validate hypotheses, understand the scope of compromise, and identify the decisions that shaped the intrusion.
Cyber Resiliency Becomes Even More Important
The broader implication is that if Agentic AI dramatically expands the range of techniques an attacker can employ, prevention becomes an even less reliable foundation for cyber strategy.
An organisation may successfully eliminate ninety-nine attack paths, but an autonomous adversary only needs to identify the hundredth. As AI reduces the cost of exploration and experimentation, attackers can test more techniques, adapt more quickly to defensive controls, and discover viable alternatives with far less human effort. The economics increasingly favour the attacker: finding the remaining path becomes cheaper, faster, and more likely.
This does not diminish the importance of prevention - it remains the foundational table stakes of defence. Every blocked path increases attacker cost, generates telemetry and constrains available options.
But organisations should assume that sufficiently capable adversaries may eventually find a route through and that makes the questions of cyber resiliency increasingly important.
Can we detect that an attacker is progressing towards a critical business outcome?
Can we contain them?
Can we determine the Last Trusted State of both our infrastructure and our production data? While production data is typically encrypted or wiped only in the very last minutes or hours of an attack, the adversary may have dwelled inside the environment for days, weeks, or months, making the trusted state of production data and infrastructure different.
Can we understand which identities, systems and trust relationships have been compromised?
Can we recover the Minimum Viable Company?
Can we reconstruct services without restoring the attacker’s persistence?
Can we demonstrate that the recovered environment can be trusted?
Agentic AI does not simply create a detection problem; it strengthens the argument that cybersecurity must be designed around surviving successful attacks, not merely preventing known ones.
Intelligence Must Become More Dynamic Than the Adversary
The irony is that CTI itself will increasingly need many of the characteristics that make agentic attacks powerful:
Continuous reasoning.
Rapid correlation.
Large-scale hypothesis generation.
Dynamic interpretation of telemetry.
Understanding relationships rather than isolated indicators.
The future of CTI cannot simply be producing reports describing what an adversary did last month and mapping those observations to ATT&CK techniques. That intelligence remains useful, but its half-life will shorten considerably.
In the future, to continue to provide strategic, operational and tactical value CTI will increasingly need to answer:
What is the adversary trying to achieve?
What paths could lead there?
Which of those paths exist in our environment?
What evidence would indicate progress along them?
What alternatives might the attacker choose when we block one?
Most importantly, what must remain recoverable to a trusted state regardless of which path they select?
The Pyramid Is Not Dead, but the Pain Is Moving.
The Pyramid of Pain remains one of the most influential models in Cyber Threat Intelligence. Like many in the CTI community, I remain deeply grateful to David Bianco for its creation. For more than a decade, it has served as a foundational framework, helping organisations shift their focus from fleeting indicators towards the aspects of adversary behaviour that are inherently more difficult to change.
Hashes will still be easier to change than sophisticated operational capabilities. Infrastructure will still impose costs. Tools will still require development and testing. Human adversaries will continue to have preferences, habits and constraints.
But agentic AI changes one of the variables underneath the model: it is making behavioural adaptation cheaper. The ability to select another technique, generate another approach and explore another attack path increasingly becomes a computational problem rather than a human one.
That means defenders should be cautious about assuming that today’s observed TTPs will necessarily describe tomorrow’s attack. The future attacker may not have a fixed playbook at all. They may have an objective, access to a vast library of offensive knowledge and an agent capable of deciding what to do next.
For CTI, that requires an important evolution. Indicators tell us what attackers used and TTPs tell us how attackers behaved. Increasingly, we may need intelligence that tells us what attackers are trying to achieve, the conditions they require to achieve it, and how close they are to succeeding.
In an era of agentic attacks, the route through the pyramid may change continuously, but the destination is what remains constant.
