Why Legitimate-Looking Threats Require More Than EDR and UEBA
Most endpoint security was built around a familiar sequence: malicious activity occurs, a security tool detects it, an analyst investigates, and the organization contains the threat. Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), and User and Entity Behavior Analytics (UEBA) made that process faster and gave security teams better evidence.
That model assumes there is still time to respond.
Attackers use AI to identify vulnerabilities and accelerate attack execution while security investigations still depend on human analysis. AI agents expand the attack surface by executing tasks across applications with the user’s permissions. Those tasks can involve modifying local files or executing system commands without human approval at each step.
A harmful action may finish before an alert becomes an investigation. A user can paste an attacker-provided command into a terminal. An agent can follow a malicious instruction hidden in a document or web page. Sensitive information can leave through an application the organization already trusts.
Each action may look like ordinary work, but the context around it tells a different story.
The user runs the command. The attacker supplies the reason.
The 2025 Microsoft Digital Defense Report found that ClickFix accounted for 47% of initial-access attacks observed in Microsoft Defender Experts notifications, compared with 35% for phishing.
ClickFix disguises an attack as a routine task. A web page displays a fake verification prompt or error message and tells the user to copy a command into a terminal to complete the verification or fix the problem. The user believes the instructions and unknowingly runs malicious code.
Security logs can show that the command ran without capturing the interaction that led to it. They record the execution but miss the deception that made the action appear necessary.
Variants change the setup while preserving the same technique. CrashFix, for example, deliberately crashes a user’s browser and then presents malicious commands as the fix.
Process and command records remain useful. Connecting them to the instructions the user saw makes them more useful. Otherwise, the security team sees the command without seeing the manipulation.
AI agents inherit the same problem
AI agents can process malicious instructions embedded in content they retrieve and execute actions without human approval at each step. Within their granted permissions, they may modify code or system configuration. They may also access data or execute commands that fall outside the user’s intended task.
Some tools use allowlists to control which commands an agent may run automatically. Allowing a command does not guarantee that the command will behave as expected.
In January 2026, Pillar Security disclosed CVE-2026-22708 in Cursor, an AI code editor. The flaw affected Cursor’s non-default Auto-Run mode with Allowlist mode enabled. Certain shell built-in commands could execute without approval even when they were not on the allowlist.
An attacker could use malicious instructions to make the agent modify environment variables that changed how subsequent commands executed. A routine command such as git branch, normally used to list branches in a repository, could then trigger attacker-controlled code. Cursor patched the flaw in version 2.3.
A record showing that the agent that ran the git branch would not explain why the command became dangerous. Understanding the attack requires connecting the command to the instructions that caused the agent to change its environment.
The patch closed that vulnerability. The underlying problem remains: an agent can mistake instructions embedded in content for directions it should follow. This is prompt injection. As Anthropic’s research explains, defenses can make agents more resistant to these attacks without eliminating the risk.
Execution is only part of the story
EDR and UEBA can reveal parts of these attack chains. What often goes missing is the context that links an action to the instructions behind it. Without that connection, it is harder to determine whether the action serves the task the person or agent was authorized to complete.
These tools approach activity from different perspectives. EDR collects operating system telemetry to show how a process started and what it did on the device. UEBA uses account activity to establish patterns of behavior and identify deviations from a user’s history or peer group. Together, they help security teams understand what executed and whether the behavior was unusual. They do not consistently reveal how an instruction reached the person or agent that acted on it.
That distinction matters because an unfamiliar file may be part of an approved assignment, while a familiar command may have come from an attacker. Unusual behavior can warrant investigation without being harmful. Familiar behavior can still create risk. Prevention therefore depends on understanding what prompted an action and whether it still serves the authorized task while there is time to intervene.
Where that analysis happens also matters. Cloud systems help security teams connect evidence across an organization. Sending detailed work activity to the cloud, however, can introduce delay and raise concerns about how sensitive data is handled. When an action can cause damage within seconds, analyzing the relevant context on the device can help security respond sooner while limiting how much sensitive information leaves the endpoint.
Intent connects the action to the work
Consider a sensitive file copied into an AI application. A user completing an approved task through a company account presents a different risk from someone accidentally uploading the same file through a personal account. The risk changes again if an agent initiated the transfer after following a malicious instruction.
The file transfer is the same. The sequence, destination, and purpose are not.
By intent, we mean the goal behind a sequence of actions. Ent uses observable activity to assess what a person or agent is trying to accomplish, whether the actions fit the work being done, and whether that work complies with the organization’s policies.
The Ent Intent-Aware Endpoint Platform connects human and AI agent activity in sequence on the endpoint, where the work happens. Instead of evaluating a file transfer alone, Ent connects it to the activity that preceded it and applies policy while the transfer is still in progress.
For a sensitive file, that means understanding where it came from, how it is being used, and whether its destination is approved for the task. An explicit policy can block a prohibited transfer. When the situation requires more context, AI reasoning on the endpoint can evaluate the surrounding activity.
The response should match the risk and stay within the boundaries set by policy. If a user selects a personal account by mistake, a warning may be enough to redirect them. If the task is allowed but the file contains restricted information, redaction may let the work continue safely. A prohibited transfer may require a block.
EDR and UEBA remain important for understanding execution and behavior. Ent adds the context needed to determine what prompted an action and whether it should continue. As humans and AI agents act through trusted tools, prevention depends on understanding whether those actions still serve the purpose for which they were authorized.
Request a demo to see how Ent protects human and agentic work. You can also read the Ent overview, the solutions brief, and Why Security Needs to Stop Reading Logs and Start Watching the World.