--- title: "Pathfinder AI: Revolutionizing Threat Detection with Autonomous Investigations" description: Discover how Pathfinder AI transforms cybersecurity with autonomous investigations. Learn about AI-driven threat detection and see real-world examples of AI security software in action. image: https://www.hunters.security/hubfs/blog%20thumbnail%20p2.jpg --- ** [Thought Leadership](https://www.hunters.security/en/blog/tag/thought-leadership), [Product Announcements](https://www.hunters.security/en/blog/tag/product-announcements) ** # Pathfinder AI: Revolutionizing Threat Detection with Autonomous Investigations - - - - [mailto:?subject=Pathfinder%20AI:%20Revolutionizing%20Threat%20Detection%20with%20Autonomous%20Investigations&body=Pathfinder%20AI:%20Revolutionizing%20Threat%20Detection%20with%20Autonomous%20Investigations%20https://www.hunters.security/en/blog/pathfinder-ai-part-2](mailto:?subject=Pathfinder%20AI:%20Revolutionizing%20Threat%20Detection%20with%20Autonomous%20Investigations&body=Pathfinder%20AI:%20Revolutionizing%20Threat%20Detection%20with%20Autonomous%20Investigations%20https://www.hunters.security/en/blog/pathfinder-ai-part-2) - By [Yuval Zacharia](https://www.hunters.security/en/blog/author/yuval-zacharia) - 11 minutes to read - Table of Contents ## AI-Driven Threat Detection: The Core of Pathfinder Traditional security operations struggle with manual investigations, fragmented workflows, and alert fatigue. Security teams waste valuable time correlating information across tools, chasing false positives, and navigating complex investigative paths. [Pathfinder AI](https://www.hunters.security/en/blog/pathfinder-ai-part-1) changes this paradigm—delivering fully autonomous threat investigation and response through **Agentic AI**. Unlike conventional automation, Agentic AI deploys a network of specialized AI agents that: - Independently investigate, enrich, and correlate security data. - Prioritize threats dynamically, filtering out noise. - Generate full attack narratives to reduce manual workload. - Automate response actions or provide clear recommendations for analysts. This approach enables security teams to move beyond reactive security operations and toward proactive, AI-driven security management. To see a deep dive of Pathfinder AI, [watch the webinar.](https://go.hunters.security/pathfinder-ai-vision-recording) ## Autonomous Investigations: How Pathfinder AI Works ### **Step 1: Alert Trigger and Investigation Orchestration** **![pathfinder-ai-threat-detection-diagram.jpg](https://www.hunters.security/hs-fs/hubfs/Graph%203.jpg?width=1920&height=1382&name=Graph%203.jpg)** ### **Step 2: Specialized AI Agents Perform Targeted Investigations** Every alert detected by [**Hunters SOC Platform**](https://www.hunters.ai) triggers the deployment of the **Investigation Orchestration Agent**. This central agent determines the appropriate investigation steps and orchestrates specialized AI agents to analyze different aspects of the potential threat. - The **Investigation Orchestration Agent** evaluates the alert’s context—determining whether it relates to credential misuse, lateral movement, or other attack types. - It creates an **investigation plan**, breaking the threat into multiple specialized investigation tracks. - It deploys **domain-specific AI agents**, each focused on a particular security domain. To ensure a thorough analysis, the **Investigation Orchestration Agent** assigns **domain-specific AI agents**, which operate autonomously to collect, analyze, and correlate security signals. ### **Examples of domain-specific agents:** - **Network Investigation Agent** – Conducts API calls and SQL searches to analyze traffic anomalies, unauthorized access attempts, and suspicious outbound communications. - **Cloud Investigation Agent** – Retrieves cloud activity logs, permission changes, and security group modifications to detect identity compromise or privilege escalations. - **Identity Investigation Agent** – Examines authentication data, user behavior anomalies, and access patterns to identify unauthorized account activity. - **Threat Intelligence Agent** – Correlates observed activity with known malicious indicators from external threat intelligence feeds. - **Endpoint Investigation Agent** – Analyzes process executions, file modifications, registry changes, and command line activity for potential attacker behaviors. This is not an exhaustive list—additional agents can be deployed based on the organization’s needs and evolving threat landscape. **Step 3: Threat Classification and Conclusion** Once the domain-specific agents complete their investigations, the Investigation Orchestration Agent evaluates their findings and determines the nature of the detected activity. Possible conclusions include, but are not limited to: - Confirmed security threat requiring immediate attention (true positive). - Benign event mistakenly flagged as a threat (false positive). - Simulated attack conducted by an internal security team (red team activity). - Legitimate action performed by an authorized user or system. If the agent identifies new findings during the investigation that require further examination, it dynamically generates an updated investigation plan and redeploys relevant domain-specific agents to analyze the newly uncovered data. This adaptive and iterative approach** **ensures greater accuracy, minimizes false positives, and guarantees that security teams focus only on real, high-risk threats. ### **Step 4: Response Execution or Detection Optimization** If a threat is confirmed, **Pathfinder AI **takes action: - **Develops a response plan**, generating remediation steps based on the attack’s context. - **Activates domain-specific AI agents** to execute **containment and mitigation actions**—either autonomously or with analyst approval. - If an alert is** deemed benign**, Pathfinder AI **automatically fine-tunes detections**, improving future accuracy and minimizing unnecessary escalations. This continuous learning capability strengthens security posture over time, ensuring that detection models remain effective against evolving threats. *Video demonstration of how investigation results are delivered to the user and how they take action based on those results.* ### Real-World AI Security Software Examples ## **Use Case 1: Detecting MFA Bypass and Persistent Access in Azure** #### **Attack Scenario:** An attacker gains access to **John’s credentials** and bypasses MFA using a **legacy protocol (IMAP)**. Once inside, they create a **persistent service principal key**, ensuring continued unauthorized access to **Azure resources**, even if John’s password is changed. #### **Step 1: Investigation Orchestration** - **Investigation Orchestration Agent** detects suspicious authentication via IMAP, triggering an identity compromise investigation. - An **investigation plan** is generated to analyze account activity, cloud modifications, and network behavior. #### **Step 2: Domain-Specific AI Agents Perform Deep Investigations** - **Identity Investigation Agent:**** ** - Queries authentication logs for **unusual login behavior**. - Compares current login **IP, geolocation, and device fingerprint** against historical patterns. - **Findings:** Detects **anomalous login from Montenegro**, deviating from John’s usual Colorado-based access pattern. - **Cloud Investigation Agent:**** ** - Scans Azure logs for **newly created service principals**. - Reviews permission escalations and key assignments. - **Findings:** Flags **a new persistent Azure service principal key**—anomalous activity immediately following the suspicious login. - **Network Investigation Agent:**** ** - Monitors outbound traffic patterns for data exfiltration attempts. - Scans for connections to known **malicious infrastructure**. - **Findings:** Detects a **brief spike in outbound traffic**, but destination **matches an internal backup service**. No data exfiltration observed. #### **Step 3: Correlation and Confirmation** - **Pathfinder AI **correlates key findings: - IMAP login from an unusual location. - Creation of persistent service principal key. - No immediate signs of data theft. - The system classifies the event as a** high-confidence account takeover**. #### **Step 4: Automated Response** - Revokes John’s Azure session. - Forces a password reset and enforces modern authentication. - Disables the newly created service principal key to eliminate persistence. This entire workflow is conducted **without manual analyst intervention**, accelerating response time while eliminating false positives.   ## **Use Case 2: Investigating Suspicious Command Execution** #### **Attack Scenario:** A security analyst receives an alert regarding cmd.exe execution on a high-privilege system. The command appears **obfuscated** and may indicate **stealthy attacker activity**. ### **Step 1: Automated Investigation** Investigation Orchestration Agent detects suspicious **command execution** and initiates endpoint, network, and forensic analysis.   ### **Step 2: AI-Driven Analysis** **Endpoint Investigation Agent: ** - Breaks down the **executed command**, identifying parameters and execution paths - Flags attempts to **redirect output to a remote share and self-delete**—a common **anti-forensic technique**. **Threat Intelligence Agent:** - Matches observed behavior with known **attack techniques from threat databases**. - Confirms **strong alignment** with adversary tactics used in recent incidents. **Network Investigation Agent:** - Scans for recent **unusual outbound connections**. - **Findings:** Detects **communication with an unclassified but non-malicious IP**, ruling out exfiltration. #### **Step 3: Analyst Assistance & Guided Response** - **Pathfinder AI** summarizes findings, ensuring analysts understand the **threat’s full context**. - Generates an automation response plan which includes **immediate containment actions**, preventing further compromise. ### Enhancing Cybersecurity with AI: Pathfinder’s Approach Pathfinder AI automates and accelerates security investigations, allowing SOC teams to: - **Reduce investigation time **from** hours to minutes**. - **Minimize false positives** while improving detection accuracy. - **Automatically adapt **to evolving threats. As AI-driven security operations continue to evolve, [Pathfinder AI](https://www.hunters.security/en/blog/pathfinder-ai-part-1)** **ensures security teams stay ahead—operating faster, smarter, and more effectively than ever before. To see Pathfinder AI in action, [watch the webinar.](https://go.hunters.security/pathfinder-ai-vision-recording) Learn more about this exciting launch by reading the press release which was covered by [CSOonline.com](https://www.csoonline.com), [securityboulevard.com](http://securityboulevard.com), [hacker noon](https://hackernoon.com/), [marketwatch.com](https://hackernoon.com/) and more. ### Related Articles [Thought Leadership, ](https://www.hunters.security/en/blog/tag/thought-leadership) [Next-Gen SIEM, ](https://www.hunters.security/en/blog/tag/next-gen-siem) [AI SOC](https://www.hunters.security/en/blog/tag/ai-soc) ##### [ Agentic AI in SOC: Building an Autonomous Security Operations Center ](https://www.hunters.security/en/blog/agentic-ai-secops) Sarah Breathnach Jun 12, 2025 [![why-agentic-ai-matters-in-secops](https://www.hunters.security/hubfs/benefits%20of%20agentic%20AI%20in%20the%20soc%20(1200%20x%20800%20px).png) ](https://www.hunters.security/en/blog/agentic-ai-secops) [Product Announcements, ](https://www.hunters.security/en/blog/tag/product-announcements) [Team Axon](https://www.hunters.security/en/blog/tag/team-axon) ##### [ Axon Identity Threat Protection: Your Response Solution for Credential Compromise ](https://www.hunters.security/en/blog/axon-identity-threat-protection-stop-credential-theft) Yonatan Khanashvili Apr 28, 2025 [![real-time monitoring of compromised employee credentials with Axon Identity Threat Protection and Hudson Rock](https://www.hunters.security/hubfs/Axon%20ITP.jpg) ](https://www.hunters.security/en/blog/axon-identity-threat-protection-stop-credential-theft) [Thought Leadership, ](https://www.hunters.security/en/blog/tag/thought-leadership) [AI SOC](https://www.hunters.security/en/blog/tag/ai-soc) ##### [ How SOC Teams Use Agentic AI & Co-Pilot AI to Reduce Risk ](https://www.hunters.security/en/blog/ai-soc-proactive-security-operations) Ian Forrest, VP Product Apr 9, 2025 [![AI SOC analyst using agentic AI dashboard for proactive threat investigation](https://www.hunters.security/hubfs/ai%20soc%20proactive%20blog%20(2).png) ](https://www.hunters.security/en/blog/ai-soc-proactive-security-operations) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Yuval Zacharia", "url" : "https://www.hunters.security/en/blog/author/yuval-zacharia" }, "dateModified" : "2026-05-15T11:00:13.879Z", "datePublished" : "2025-03-05T21:30:25.000Z", "headline" : "Pathfinder AI: Revolutionizing Threat Detection with Autonomous Investigations", "image" : [ "https://www.hunters.security/hubfs/blog%20thumbnail%20p2.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.hunters.security/en/blog/pathfinder-ai-part-2", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.hunters.security/hubfs/Hunters%20H%20Logo%20Reverse%20on%20white%20(1)%20(1).png" }, "name" : "Cyber Hunters Ltd." } } ``` ```json { "@context" : "http://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "United States", "addressLocality" : "Newton", "addressRegion" : "Massachusetts", "postalCode" : "02466", "streetAddress" : "275 Grove St. " }, "description" : "Hunters SOC Platform", "image" : "https://f.hubspotusercontent30.net/hubfs/5765386/Hunters%20H%20Logo%20Reverse%20on%20white%20(1)%20(1).png", "logo" : "https://f.hubspotusercontent30.net/hubfs/5765386/Hunters%20H%20Logo%20Reverse%20on%20white%20(1)%20(1).png", "mainEntityOfPage" : { "@id" : "https://www.hunters.security/en/blog/pathfinder-ai-part-2", "@type" : "WebPage", "description" : "Discover how Pathfinder AI transforms cybersecurity with autonomous investigations. Learn about AI-driven threat detection and see real-world examples of AI security software in action." }, "name" : "Hunters", "telephone" : "", "url" : "/" } ```