Abstract: Techniques are described herein that are capable of increasing effectiveness of an agentic AI flow based on output of an AI sub-agent. An extent to which an input-output pair corresponds to a goal of an agentic AI flow that is implemented by AI sub-agents in an agentic AI system may be determined to provide a first factor. Extents to which intermediate input-output pairs of the AI sub-agents correspond to sub-tasks in the agentic AI flow may be determined to provide a second factor. An evaluation of an effectiveness of an invocation path of the agentic AI flow may be performed to provide a third factor. Score(s) are assigned to the invocation path and/or the AI sub-agents using the first, second, and/or third factors. The effectiveness of the invocation path is increased by reconfiguring the invocation path and/or by reconfiguring or replacing an AI sub-agent.

Abstract: Graph-based detection systems and techniques are provided to identify potential malicious lateral movement paths. System and security events may be used to generate a network connection graph and detect remote file executions and/or other detections, for use in tracking malicious lateral movement across a computer network, such as a compromised computer network. Lateral movement determination across a computer network may be divided into two subproblems: forensic analysis and general detection. With forensic analysis, given a malicious node, possible lateral movement leading into or out of the node is identified. General detection identifies previously unknown malicious lateral movement on a network using a remote file execution detector, and/or other detectors, and a rare path anomaly detection algorithm.

Abstract: Graph-based detection systems and techniques are provided to identify potential malicious lateral movement paths. System and security events may be used to generate a network connection graph and detect remote file executions and/or other detections, for use in tracking malicious lateral movement across a computer network, such as a compromised computer network. Lateral movement determination across a computer network may be divided into two subproblems: forensic analysis and general detection. With forensic analysis, given a malicious node, possible lateral movement leading into or out of the node is identified. General detection identifies previously unknown malicious lateral movement on a network using a remote file execution detector, and/or other detectors, and a rare path anomaly detection algorithm.