While being a CISO I love to ensure that each of my teams had a mission statement, their elevator pitch to the CEO that explains what they did. One of my favourites (not created by me) was for an operations team – “We understand the true state of normal and respond when there is unexpected change”.
To understand “true normal” in cyber, you need telemetry data. Lots of it, for a long time. I would propose that cyber is a big data problem for that reason.
In taking that theme to the modern era of AI, where attackers now move at machine speed, there is only one answer.
AI needs to respond to attacks at machine speed… leveraging big data.
The million-dollar question is how will AI know what is normal? What can be ignored and what needs an (automated) response for any given environment?
To understand the challenge better I started working on my own AI trained anomaly detection platform (for want of a better title). This project expands on my previous experiences with AI and the need for Non-Human (AI) Identity Management and oversight.
Everyone is talking about governing AI, but many of us don’t even know where the controls are yet to be governed. My experience is that you have to rely on good security foundations first and search hard for the AI controls… there aren’t many readily accessible in some architectures.
What I have built is not an answer to the industry’s challenges. Far from it. The outcome is not the goal. I’m seeking a deeper understanding of the opportunities we cyber professionals have in the new world. One that is coming at us faster than we could have imagined (some might say that already has passed us by).
The project.
Using lots of open-source tooling, I have a syslog server collecting data from anything I can possibly get my hands on. I use an ELK stack for deeper review. On an Ubuntu server I (with an enormous amount of help from Claude) I have created an app that takes logs from firewalls, Windows, Linux, cloud-identity, network, and AI-agent logs into one live entity graph. It flags what doesn’t belong, and explains why using a locally-hosted model.
For the developer types: Python/FastAPI (REST + WebSocket), Neo4j, Ollama (self-hosted, no cloud calls), vanilla JS + WebGL 3D graph frontend, two Docker containers behind the existing nginx reverse proxy for authentication functions.
Ingest — Polls an existing Elasticsearch pipeline every 5 minutes; writes every event’s host/IP/user/process and their relationships into a Neo4j graph, not just anomalies.
Detect — Three independent methods: statistical (Isolation Forest on per-entity activity, off-hours, GeoIP impossible-travel), graph-native (Cypher queries for first-time relationships and fan-out spikes), and signature-based (known-bad events like Defender detections or denied AI-agent actions, trusted directly and scored at maximum).
Explain — high-scoring anomalies get a plain-language explanation from Ollama (self-hosted LLM, phi4-mini), generated in the background, never blocking.
Present — FastAPI backend with a 3D force-directed entity graph, a natural-language “Ask” chat panel (phi4-mini since I am running this on some lean hardware), one-click Kibana deep-links, and on-demand external-IP enrichment (WHOIS/RDAP + GreyNoise).
Enrich — background jobs label existing graph nodes with UniFi device info and reverse-DNS hostnames; never create new nodes.
Learn — every acknowledged anomaly is recorded to a durable SQLite decision log before retention deletes it — passive groundwork for future automation, nothing predictive live yet as the training continues.
Summary:
In an increasingly complex world, I don’t think disparate security systems will be enough to detect and respond to cyber incidents.
I also don’t believe we can define today what the cyber incidents of tomorrow will look like.
It’s my opinion that cyber teams will need vast amounts of telemetry from every part of the technology stack, to feed an AI engine. One capable of identifying anomalies wherever they occur. And beyond detection, we’ll need AI-managed, automated mechanisms capable of responding at machine speed.
If you are interested in seeing my project, why not connect with me. If you or your business are wondering how you might govern cyber (with actual controls effectiveness evidence), I’m open to a chat on that too!