Setup: A SOC uses an AI threat detection agent for network anomaly alerting. Over the past month, the agent has been generating approximately 340 alerts per day — of which historical validation shows about 2% are true positives. The SOC analysts have learned, reasonably, that the agent is very noisy. They have developed a pattern of rapidly triaging alerts: most are dismissed in under 30 seconds.

Attack: An adversary, who spent three weeks probing the network in ways that generated alerts (without completing any intrusion), has observed the analysts' dismissal patterns. On day 22, they launch a real lateral movement campaign at 4:47 PM on a Friday. The alert the campaign generates is formatted identically to hundreds of the false positives from the preceding weeks — the same source subnet, the same alert type, the same severity label.

What happens: The analyst on shift, having dismissed 280 alerts earlier that day, sees the alert at 4:47 PM and dismisses it in 18 seconds. The intrusion is not detected until Monday morning, when log analysis finds the lateral movement that began Friday. By then, the attacker has had 63 hours of undetected access.

What was missing: Alert quality metrics and thresholds — if the agent's false positive rate exceeds a threshold, escalate to human review of the agent itself, not just its alerts. Pattern-of-life analysis to detect when real detections are being masked by noise. Minimum review times for alerts from specific high-value asset subnets.

Setup: An enterprise uses an AI security policy management agent that can propose firewall rule changes. Proposed changes go through a 48-hour review cycle involving the security architecture team. The agent can mark a change as "Emergency" to trigger a 4-hour expedited track with a single approver.

Attack: An attacker who has compromised a low-privilege account uses that account to inject a configuration change request into the policy management system. The injected request is designed to open a specific outbound port used for data exfiltration. The injection also sets the change as "Emergency" with reason: "Critical production outage — service dependent on this port. Coordinated with NOC. 4-hour window required."

What happens: The on-call security manager receives an emergency approval notification from the AI policy agent at 2:13 AM. The notification includes the urgency framing from the injected request, formatted as the agent's own assessment. He approves in the expedited track without consulting the architecture team. The port is opened. Data exfiltration begins 40 minutes later.

What was missing: Only the agent (or the system) should be able to mark a change as Emergency — not content injected into the policy system. Emergency changes should require secondary approval, not fewer approvers. The 2 AM timing and the specific port should have flagged anomalous context that the single-approver track couldn't detect.