Dhananjay Ganjoo, Managing Director – India & SAARC
The uncomfortable part of an adaptive attack is not how quickly it starts, but how quickly it can change course.
AI-assisted operations can probe environments, learn from responses, switch techniques and chain subsequent actions while an attack is still in progress.
Anthropic’s 2026 analysis of 832 accounts banned for malicious cyber activity points to this shift.
While much of the activity it observed focused on preparing for attacks, the highest-risk actors used AI in live operations, including autonomous execution, orchestration and real-time pivot decisions.
For defenders, this creates a moving target. The attack that enters an environment may not follow the same pattern as it progresses through it.
Applications present a moving target of their own. They span on-premises infrastructure, multicloud environments, Kubernetes clusters and the edge, with APIs carrying traffic between users, workloads and services.
Endpoints appear, integrations change and application behaviour evolves continuously.
Preventive controls and known-threat detection remain essential. But when both the threat and environment can change in real-time, security also needs to understand what applications and APIs are doing while they are running.
When the attack pattern keeps changing
Application security has become very good at recognising known bad behaviour. Signatures identify established techniques. WAF policies inspect requests against defined rules.
API schemas establish how endpoints are expected to be used. Threat intelligence adds knowledge of emerging campaigns and indicators.
The challenge begins when malicious activity does not stay inside those familiar patterns.
An attacker probing an API may alter request structures after an unsuccessful attempt, move to another endpoint, change the sequence of calls or abuse legitimate application functionality based on what the environment reveals.
That means defenders need another layer of context; how the attacker behaves as it develops.
A single request may reveal very little. But look at the sequence around it. Which endpoints are being called? How are request patterns changing? Which resources are being accessed? Is activity moving outside established patterns? A very different picture can emerge.
Industry Research found that 48% of organisations update production APIs daily or more frequently, yet only 19% maintain a fully automated and continuously updated API inventory.
Security teams are therefore dealing with two variables at once, an application estate that changes continuously and malicious activity that may not follow a predictable path.
Runtime is where behaviour becomes visible
Much of what security knows is established before traffic reaches a running application, identities, policies, configurations, API definitions, vulnerability intelligence and threat indicators.
What cannot always be known in advance is how malicious activity will behave once it encounters the application. Runtime provides that context.
Observing live application and API traffic allows security teams to connect signals that may mean little on their own, changes in request frequency, repeated access across objects, an unexpected sequence of API calls or traffic moving between endpoints.
This is where behavioural detection complements established security controls. Known-threat detection asks whether traffic resembles something defenders already understand.
Behavioural detection asks whether the application or API is behaving as expected?
For threats capable of changing during execution, that distinction can make the difference between seeing isolated events and understanding what is happening across the application data path.
Detection must lead to enforcement
Visibility alone does not reduce risk.
If anu unusual behaviour is identified only after the application has processed the traffic and the attacker has achieved the objective, the insight has arrived too late.
Runtime visibility therefore has to connect detection with policy enforcement capable of acting on live application and API traffic.
The response does not have to be binary. Some malicious activity should be blocked immediately.
In other cases, security teams may rate-limit requests, restrict access to endpoint, tighten a policy or isolate suspicious activity while legitimate traffic continues.
That distinction matters because security teams are protecting payment systems processing transactions, healthcare platforms supporting patients, e-commerce services serving customers and industrial applications supporting operations.
Stopping an attack by unnecessarily stopping the application is not resilience. The objective is to prevent malicious activity from achieving its goal while allowing legitimate users and services to continue operating.
Protection has to follow the application
The challenge becomes harder when an application spans several environments.
A customer-facing service may have workloads in a public cloud, sensitive systems on premises, containerised services running in Kubernetes and APIs connecting all of them.
Each environment may have different controls, policies and operational teams.
Attack path does not respect those boundaries
If visibility and enforcement change every time application traffic crosses an environment, blind spots emerge where organisations need consistency.
Protection therefore has to follow the application and its APIs across the hybrid multicloud estate rather than depend on where workload happens to run.
That requires a consistent view of application traffic, the ability to identify malicious or anomalous behaviour wherever it appears, and controls capable of responding without unnecessarily disrupting legitimate traffic.
Availability is part of the security outcome
Application security is ultimately an availability problem. Modern businesses depend on applications being continuously accessible.
When an application or API goes down, a security incident quickly becomes a business interruption.
Industry research found that significant API, bot and DDoS-related incidents take organisations an average of 2.8 hours to fully resolve.
It also estimated the average cost of application-layer DDoS downtime at $7,530 per minute.
For security leaders, success therefore cannot be measured simply by how much traffic is blocked or how many threats are detected.
What matters is whether the organisation can contain malicious activity while keeping critical services operating.
Security and application delivery increasingly have to move together. Protection has to be strong enough to stop malicious traffic, precise enough to preserve legitimate traffic and consistent enough to work wherever the application runs.
From knowing the threat to being ready for it
Threat intelligence, vulnerability management, signatures, access controls and preventive protections remain fundamental to cyber defence.
But organisations cannot assume they will always know the exact shape of an attack before it reaches a running application.
As threats become more adaptive, security needs to know in advance with what it can learn from application and API behaviour at runtime.
Continuous visibility must feed behavioural detection, and behavioural detection must translate into policy enforcement before malicious activity becomes operational impact.
This is what continuous security readiness means. It is less about predicting every attack, but recognising when behaviour changes, assessing the risk and acting while the application remains available.
Cyber resilience will increasingly be determined in the space between the first meaningful deviation and the business disruption.
The organisations best prepared will be those that can recognise that change early, adapt their protection and keep the applications their business running.
