Why Security Needs to Stop Reading Logs and Start Watching the World
Before autonomous vehicles could drive, they had to learn to see and to understand. A stop sign in the US is just a red octagon with a white outline, but it’s also a social contract where we all agree to behave a certain way. A car drifting toward your lane is not just a position change; it’s also a signal of intent to keep coming. The breakthroughs that made self-driving cars possible were not about faster processors or better cameras. They were about building a world model: a representation of the environment that could answer not just what’s happening? but what’s about to happen next? and what’s my best course of action?
Security is at the same inflection point today.
A Short History of Seeing
The first autonomous vehicles operated on a relatively simple set of rules. If you see a red light, stop. If you see an obstacle, brake. These systems worked well in controlled conditions and failed everywhere else because the real world is full of surprises and corner cases that don’t fit neatly into finite rules based on fixed inputs. Operating in the real world means dealing with a lot more context.
The 2004 DARPA Grand Challenge was a humbling moment for autonomous driving. This generation of vehicles relied heavily on hand-tuned rules to decide what was drivable. The result was vehicles that either crawled because every shadow looked like an axel-breaking crevice, or barreled into actual obstacles because the thresholds were too loose. Of 15 vehicles that participated in the final race, none completed more than 5% of the 150-mile course before crashing out due to errors and mechanical failures.
One year later, 5 out of 23 completed the course. The difference was not horsepower or hardware; It was perception and understanding. Teams fused telemetry from different types of sensors together to build a more complete picture of the world around them. They also applied machine learning based on observing real human driving behaviors, resulting in systems that could reason about the environment rather than just follow a static flow chart.
By the 2010s, deep learning changed the game entirely. Cameras, radar, and lidar merged into a single coherent picture of the world, which was overlaid with high-definition maps. With that high-res model came the ability to predict and plan. The system no longer asked "is there an obstacle in front of me?" It asked "is that pedestrian about to step into my path?" and “what course corrections do I need to make so I don’t hit him or anything else around me?”
This shift from detection to prediction is what separated early autonomy experiments from something you can actually trust with your life. Cybersecurity is on a parallel journey, it’s just running about twenty years behind.
The Security Equivalent of Rules-Based Driving
The first generation of security was perimeter-based. We built a wall to keep bad stuff out and assume anything inside is safe. That assumption broke down the moment organizations started poking holes in the wall for business traffic to pass through, and allowed users to make their own decisions about bringing executable files and untrusted content across that moat.
So we built more rules, this time in the form of signature-based detection. Matching known bad patterns and blocking them worked reasonably well until attackers learned to morph their payloads on the fly.
Next came SIEM and log correlation, which centralized security data, runs yet more rules against it after the fact to generate alerts, and lets analysts piece together what happened. It was a powerful step in the right direction, but in practice it created analyst overload and still answered questions about the past, not the present.
EDR improved things by making the endpoint the primary source of truth and collecting broader and deeper telemetry. XDR went a step further uniting the EDR data with additional telemetry from network, cloud, and identity sources. We got better telemetry and faster detection, but still fundamentally reactive and rules-intensive. Analysts are still triaging and investigating alerts triggered by rules and reconstructing incidents from logs, almost always a step behind their adversaries.
Attackers are well-versed in side-stepping this modern detection and response infrastructure. The modern attacker isn’t typically using novel malware. They’re using legitimate tools that blend in with day-to-day activity: PowerShell, remote desktop, browsers, SaaS applications, and collaboration platforms. The malicious activity looks just like work. The signals they generate closely resemble what any normal employee produces on a normal day. Like an axel-breaking boulder that looks just like a shadow, you can’t catch this by reading the same logs faster. You need better telemetry and intelligence to understand it in order to act in time to avoid critical damage
The Problem Is Not Volume. It’s Visibility.
Here is what a traditional investigation looks like:
- Your XDR fires off a series of alerts.
- Tier 1 analysts triage the alerts and determine something seems amiss and worth investigating further.
- Tier 2 analysts query SIEM logs and see a suspicious download occurred, but don’t have enough information to declare an incident or act, so they pull in additional help.
- The forensics team finds suspiciously obfuscated scripts in a downloads folder, traces it to a URL accessed three days ago via cross-referenced proxy logs, and finally figures out what’s happened.
- They remediate the immediate threat, and then begin the laborious process of hunting for similar signs of intrusion elsewhere before closing the incident.
- Finally, updated threat intelligence is shared with the detection engineering team so they can update detection rules to do better next time. Hopefully.
- The whole process takes days, and at the end of it you still don’t know exactly what the user saw, why they did what they did, or how to coach them to prevent similar incidents in the future.
Now here is what modern security can look like.
For example, imagine you have a screenshot of the user in Discord. They’re chatting with a new contact who convinces them to download and execute a file. You’re looking at a visual record of the conversation, the download, the execution, with behavioral context layered on top. You can see the source of the scam so you can put in place better countermeasures. You can see the additional URLs for more effective threat hunting. You can understand exactly what happened without unreliable user interviews. Most importantly, you can create an intervention so that if this pattern appears again, the system responds before the file is ever opened.
This isn’t just an incremental improvement in tactics for security teams; it’s an entire new model for defenders, and it’s what we’re building at Ent.
What the User Sees Is the Signal
The core insight that drives everything we’re building at Ent is simple: the user sees things that security tools don’t, and that context is key to making better, faster decisions.
When a user copies a file from one application and opens it into another, traditional security sees a process launch event, and maybe a file write. What it doesn’t see is that the user has three applications open. One of them is a project they are actively working on, they are about to send a document containing PII to an external contact, and based on their history and role, this is either completely normal or a potential compliance violation.
Those details needed to unravel the user’s intent are all there, just not visible to a typical security stack. They require a different kind of seeing.
Ent combines real-time endpoint telemetry that reflects exactly what the user sees and does with multimodal AI to build an Organizational Work Model, a real-time understanding of how people actually operate within the scope of their job. Ent’s model reveals not just what actions they take, but what those actions mean given who they are, what team they are on, what they normally do, and what they are looking at right now.
This is the security equivalent of the world model developed for autonomous vehicles. Instead of asking "what happened?", we ask "what is happening, why, and what should we do about it?"
Seeing Is Not Enough. You Have to Act.
Returning to our autonomous vehicle analogy, today’s autonomous vehicles are not safer just because they have better sensors. They are safer because they’ve got better brains that build perception loops that lead to action. The system sees everything around it, understands it in context, anticipates what comes next, and responds proportionally. It performs a soft course correction for a pothole a half block away, but performs emergency braking for an imminent collision. The response fits the risk.
Ent is creating this real-time feedback loop for cybersecurity.
When Ent identifies a risky action, it fires an alert, but also intervenes at the moment of user decision. That can be a plain-language nudge for the user that explains the risk and offers a safer path. It can involve automatically masking sensitive fields before a spreadsheet is submitted to an AI tool for analysis. It could be a hard block and immediate deletion of a malicious file. Or it can be a silent, context-rich alert to the security team so investigators have everything they need without starting from scratch.
The intervention happens at the right moment, enriched with all the right context, with the right level of force. A security awareness training session six months after an incident changes almost nothing. An explanation that appears at the exact moment someone is about to make a mistake changes behavior when it matters.
Fleet Learning and the Compounding Advantage
One more thing autonomous vehicles figured out that security largely has not: fleet learning. When one self-driving car encounters a new edge case, that data propagates across the entire system. Every vehicle has the opportunity to benefit from a new corner case that one vehicle learned. The safety of the fleet compounds over time at a speed no individual human driver can match.
Ent's Organizational Work Model works the same way. The system continuously learns what is normal for each user, each role, each workflow. When behavior shifts, it understands the context: is this a mistake, a gray area, or something genuinely malicious? And as the model learns, every detection gets sharper, every intervention gets more precise, and every investigation gets faster. This is the structural advantage that reactive tools can’t close by throwing more data and people at the problem.
The Next Generation Is Already Here
We built Ent because we believe cybersecurity has to be redesigned around a work model, not just a threat model. The threat model tells you what bad looks like. The work model tells you when something is happening that’s outside of what’s normal, and gives you the opportunity to do something about it at decision time. The self-driving era of security is here. The question is whether your stack is built to drive in it.
To learn more about Ent and our vision for securing human and AI-driven work, visit ent.ai.
Brandon Dixon is CTO and co-founder of Ent. Before Ent, Brandon led threat intelligence and security product strategy at Microsoft Security.
To see our product in action, schedule a demo.