{"id":1739,"date":"2026-09-01T08:01:00","date_gmt":"2026-09-01T14:01:00","guid":{"rendered":"https:\/\/raffy.ch\/blog\/?p=1739"},"modified":"2026-08-26T09:03:52","modified_gmt":"2026-08-26T15:03:52","slug":"ai-changes-what-security-has-to-remember","status":"publish","type":"post","link":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/","title":{"rendered":"AI Changes What Security Has To Remember"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-Aug-21-2026-01_17_32-PM.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-Aug-21-2026-01_17_32-PM-1024x576.png\" alt=\"\" class=\"wp-image-1741\" srcset=\"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-Aug-21-2026-01_17_32-PM-1024x576.png 1024w, https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-Aug-21-2026-01_17_32-PM-300x169.png 300w, https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-Aug-21-2026-01_17_32-PM-768x432.png 768w, https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-Aug-21-2026-01_17_32-PM-1536x864.png 1536w, https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-Aug-21-2026-01_17_32-PM.png 1672w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">AI is arriving in security operations as a productivity story: faster triage, better investigations, fewer alerts, and more automation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That is real. But the larger change is that AI creates new actions, attack paths, and evidence that security teams need to capture and understand. The question is no longer only whether an endpoint or identity behaved suspiciously. It is also: what did an agent know, which tools did it call, under whose authority did it act, what did it change, and what happened next?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">SIEM Remains The System Of Record<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">AI will not eliminate the SIEM or security data platform. It may make the traditional SIEM UI less important, but it makes trusted data more important. If telemetry is incomplete, identity and asset context is inconsistent, or detections are weak, AI simply reaches conclusions faster on top of uncertain inputs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A modern SIEM should therefore be more than a log store and search interface. It should be an evidence and control layer: a place where data is reliable, context is preserved, access is governed, and consequential actions can be explained.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There may be an opportunity for the SIEM to become the authoritative home of the security <strong>context graph<\/strong>: not merely a visualization, but the maintained relationship between identities, devices, workloads, applications, data, permissions, ownership, and policy. AI agents need that context before they can safely reason or act.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">AI Creates New Security Telemetry<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Traditional telemetry tells us what happened on a system or network. AI systems require us to capture part of the decision path as well. For consequential agent activity, organizations will need to know:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Which identity and permissions the agent used<\/li>\n\n\n\n<li>What information and tools it could access<\/li>\n\n\n\n<li>Which systems it called<\/li>\n\n\n\n<li>What it changed or attempted to change<\/li>\n\n\n\n<li>Which policies, approvals, or exceptions applied<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This is not only an incident-response requirement. It matters for audit, compliance, and accountability. If an agent changes data that feeds financial reporting, accesses sensitive information, or takes a production action, an application log saying \u201ccompleted successfully\u201d is not enough. Sarbanes-Oxley may not mention agents by name, but the underlying internal-control and evidence problem is obvious.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Intent Is Interesting, But It Is Not Truth<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">New endpoint vendors including Neo, Glow, Ent, and others are focusing on a different layer of the endpoint: observing user and agent behavior, then inferring intent. That is worth watching closely. Ent explicitly frames its approach as intent-aware security across human, AI, and application activity, while Neo and Glow are pursuing AI-era endpoint control and prevention from adjacent angles. <a href=\"https:\/\/ent.ai\/\">Ent<\/a>, <a href=\"https:\/\/www.neo.ai\/\">Neo<\/a>, and <a href=\"https:\/\/www.glow.io\/\">Glow<\/a> are useful examples of the emerging category.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Traditional EDR is still needed for attacks that reveal themselves in low-level evidence: process execution, network activity, and known attacker techniques. But those signals can be insufficient when developers, administrators, and AI-enabled workers legitimately perform highly variable and sensitive work. We can find many attacks at the system layer, while insider-risk activity or misuse of legitimate access may remain hard to distinguish.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Intent signals can add context. Is a sequence of actions consistent with a developer deploying software, an administrator performing maintenance, or an agent moving outside its mandate?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But intent is a probabilistic signal, not a verdict. It should complement evidence from endpoints, identity, cloud, applications, data, and agents\u2014not replace it. That is another reason we need a central correlator or analytics platform. Let\u2019s keep calling that a SIEM.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Security Needs Three Clocks<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The need to correlate all of that evidence creates a timing problem.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An endpoint or identity control may see a risky action immediately, but the evidence needed to understand it may be spread across cloud systems, containers, SaaS applications, sandboxes, and downstream tool calls. Some context arrives seconds later. Some appears only after an agent has completed a chain of work. Some only matters when an investigator or auditor returns months later.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Security therefore needs to work across three clocks:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>First, there is <strong>inline prevention<\/strong>: block the clearly dangerous action before it can do damage.<\/li>\n\n\n\n<li>Second, there is <strong>delayed contextual assessment<\/strong>: reassess the event minutes later, once the surrounding identity, application, cloud, and agent telemetry has arrived and can be rejoined.<\/li>\n\n\n\n<li>Third, there is <strong>long-term reconstruction<\/strong>: retain the evidence needed for hunting, incident response, audit, legal review, and lessons learned.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The point is not to delay every decision. It is to recognize that the best immediate decision and the best informed decision may occur at different times\u2014and both need to be explainable.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What This Changes For MDR<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This need to capture agent actions, join them with broader context, and preserve reliable evidence across all three clocks changes MDR too. The future MDR is not simply an AI SOC that processes alerts with fewer analysts. It has to operate the telemetry, detection, context, and accountability loop around AI-enabled environments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That means ensuring the right telemetry is collected, maintaining the context graph that makes it useful, testing detections, defining which actions can be automated, preserving approvals and exceptions, and proving later what the system saw and did.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">AI may reduce manual work in the SOC. It does not remove the need for a trusted security operating layer. When AI acts, security has to remember not only what happened, but why.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>AI is arriving in security operations as a productivity story: faster triage, better investigations, fewer alerts, and more automation. That is real. But the larger change is that AI creates new actions, attack paths, and evidence that security teams need to capture and understand. The question is no longer only whether an endpoint or identity [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39,8,35,30],"tags":[73,90,84,69,88],"class_list":["post-1739","post","type-post","status-publish","format-standard","hentry","category-artificial-intelligence","category-security-information-management","category-security-intelligence","category-security-market","tag-ai","tag-edr","tag-mdr","tag-siem","tag-telemetry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"AI is arriving in security operations as a productivity story: faster triage, better investigations, fewer alerts, and more automation. That is real. But the larger change is that AI creates new actions, attack paths, and evidence that security teams need to capture and understand. The question is no longer only whether an endpoint or identity\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Raffael Marty\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Future of Tech and Security: Strategy &amp; Innovation with Raffy \u2013 Insights at the intersection of cybersecurity, strategy, and innovation.\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"AI Changes What Security Has To Remember \u2013 Future of Tech and Security: Strategy &amp; Innovation with Raffy\" \/>\n\t\t<meta property=\"og:description\" content=\"AI is arriving in security operations as a productivity story: faster triage, better investigations, fewer alerts, and more automation. That is real. But the larger change is that AI creates new actions, attack paths, and evidence that security teams need to capture and understand. The question is no longer only whether an endpoint or identity\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2025\/09\/ogimage.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2025\/09\/ogimage.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"512\" \/>\n\t\t<meta property=\"og:image:height\" content=\"512\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-01T14:01:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-08-26T15:03:52+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@raffaelmarty\" \/>\n\t\t<meta name=\"twitter:title\" content=\"AI Changes What Security Has To Remember \u2013 Future of Tech and Security: Strategy &amp; Innovation with Raffy\" \/>\n\t\t<meta name=\"twitter:description\" content=\"AI is arriving in security operations as a productivity story: faster triage, better investigations, fewer alerts, and more automation. That is real. But the larger change is that AI creates new actions, attack paths, and evidence that security teams need to capture and understand. The question is no longer only whether an endpoint or identity\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@raffaelmarty\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2025\/09\/ogimage.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2026\\\/09\\\/01\\\/ai-changes-what-security-has-to-remember\\\/#blogposting\",\"name\":\"AI Changes What Security Has To Remember \\u2013 Future of Tech and Security: Strategy & Innovation with Raffy\",\"headline\":\"AI Changes What Security Has To Remember\",\"author\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/author\\\/raffy\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/#person\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/ChatGPT-Image-Aug-21-2026-01_17_32-PM.png\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2026\\\/09\\\/01\\\/ai-changes-what-security-has-to-remember\\\/#articleImage\",\"width\":1672,\"height\":941},\"datePublished\":\"2026-09-01T08:01:00-06:00\",\"dateModified\":\"2026-08-26T09:03:52-06:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2026\\\/09\\\/01\\\/ai-changes-what-security-has-to-remember\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2026\\\/09\\\/01\\\/ai-changes-what-security-has-to-remember\\\/#webpage\"},\"articleSection\":\"Artificial Intelligence, Security Information Management, Security Intelligence, Security Market, AI, EDR, mdr, SIEM, telemetry\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2026\\\/09\\\/01\\\/ai-changes-what-security-has-to-remember\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/raffy.ch\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/category\\\/security-information-management\\\/#listItem\",\"name\":\"Security Information Management\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/category\\\/security-information-management\\\/#listItem\",\"position\":2,\"name\":\"Security Information Management\",\"item\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/category\\\/security-information-management\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2026\\\/09\\\/01\\\/ai-changes-what-security-has-to-remember\\\/#listItem\",\"name\":\"AI Changes What Security Has To Remember\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2026\\\/09\\\/01\\\/ai-changes-what-security-has-to-remember\\\/#listItem\",\"position\":3,\"name\":\"AI Changes What Security Has To Remember\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/category\\\/security-information-management\\\/#listItem\",\"name\":\"Security Information Management\"}}]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/#person\",\"name\":\"Raffael Marty\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2026\\\/09\\\/01\\\/ai-changes-what-security-has-to-remember\\\/#personImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1a1923877d9dbd00d99847074d62faab586cce0a9ee6a4c85e8bb7c46d7418ac?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Raffael Marty\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/author\\\/raffy\\\/#author\",\"url\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/author\\\/raffy\\\/\",\"name\":\"Raffael Marty\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2026\\\/09\\\/01\\\/ai-changes-what-security-has-to-remember\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1a1923877d9dbd00d99847074d62faab586cce0a9ee6a4c85e8bb7c46d7418ac?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Raffael Marty\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2026\\\/09\\\/01\\\/ai-changes-what-security-has-to-remember\\\/#webpage\",\"url\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2026\\\/09\\\/01\\\/ai-changes-what-security-has-to-remember\\\/\",\"name\":\"AI Changes What Security Has To Remember \\u2013 Future of Tech and Security: Strategy & Innovation with Raffy\",\"description\":\"AI is arriving in security operations as a productivity story: faster triage, better investigations, fewer alerts, and more automation. That is real. But the larger change is that AI creates new actions, attack paths, and evidence that security teams need to capture and understand. The question is no longer only whether an endpoint or identity\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/2026\\\/09\\\/01\\\/ai-changes-what-security-has-to-remember\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/author\\\/raffy\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/author\\\/raffy\\\/#author\"},\"datePublished\":\"2026-09-01T08:01:00-06:00\",\"dateModified\":\"2026-08-26T09:03:52-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/\",\"name\":\"Cyber Security - Strategy and Innovation\",\"description\":\"Insights at the intersection of cybersecurity, strategy, and innovation.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/raffy.ch\\\/blog\\\/#person\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"AI Changes What Security Has To Remember \u2013 Future of Tech and Security: Strategy & Innovation with Raffy","description":"AI is arriving in security operations as a productivity story: faster triage, better investigations, fewer alerts, and more automation. That is real. But the larger change is that AI creates new actions, attack paths, and evidence that security teams need to capture and understand. The question is no longer only whether an endpoint or identity","canonical_url":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/#blogposting","name":"AI Changes What Security Has To Remember \u2013 Future of Tech and Security: Strategy & Innovation with Raffy","headline":"AI Changes What Security Has To Remember","author":{"@id":"https:\/\/raffy.ch\/blog\/author\/raffy\/#author"},"publisher":{"@id":"https:\/\/raffy.ch\/blog\/#person"},"image":{"@type":"ImageObject","url":"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2026\/08\/ChatGPT-Image-Aug-21-2026-01_17_32-PM.png","@id":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/#articleImage","width":1672,"height":941},"datePublished":"2026-09-01T08:01:00-06:00","dateModified":"2026-08-26T09:03:52-06:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/#webpage"},"isPartOf":{"@id":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/#webpage"},"articleSection":"Artificial Intelligence, Security Information Management, Security Intelligence, Security Market, AI, EDR, mdr, SIEM, telemetry"},{"@type":"BreadcrumbList","@id":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog#listItem","position":1,"name":"Home","item":"https:\/\/raffy.ch\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog\/category\/security-information-management\/#listItem","name":"Security Information Management"}},{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog\/category\/security-information-management\/#listItem","position":2,"name":"Security Information Management","item":"https:\/\/raffy.ch\/blog\/category\/security-information-management\/","nextItem":{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/#listItem","name":"AI Changes What Security Has To Remember"},"previousItem":{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/#listItem","position":3,"name":"AI Changes What Security Has To Remember","previousItem":{"@type":"ListItem","@id":"https:\/\/raffy.ch\/blog\/category\/security-information-management\/#listItem","name":"Security Information Management"}}]},{"@type":"Person","@id":"https:\/\/raffy.ch\/blog\/#person","name":"Raffael Marty","image":{"@type":"ImageObject","@id":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/#personImage","url":"https:\/\/secure.gravatar.com\/avatar\/1a1923877d9dbd00d99847074d62faab586cce0a9ee6a4c85e8bb7c46d7418ac?s=96&d=mm&r=g","width":96,"height":96,"caption":"Raffael Marty"}},{"@type":"Person","@id":"https:\/\/raffy.ch\/blog\/author\/raffy\/#author","url":"https:\/\/raffy.ch\/blog\/author\/raffy\/","name":"Raffael Marty","image":{"@type":"ImageObject","@id":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/1a1923877d9dbd00d99847074d62faab586cce0a9ee6a4c85e8bb7c46d7418ac?s=96&d=mm&r=g","width":96,"height":96,"caption":"Raffael Marty"}},{"@type":"WebPage","@id":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/#webpage","url":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/","name":"AI Changes What Security Has To Remember \u2013 Future of Tech and Security: Strategy & Innovation with Raffy","description":"AI is arriving in security operations as a productivity story: faster triage, better investigations, fewer alerts, and more automation. That is real. But the larger change is that AI creates new actions, attack paths, and evidence that security teams need to capture and understand. The question is no longer only whether an endpoint or identity","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/raffy.ch\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/#breadcrumblist"},"author":{"@id":"https:\/\/raffy.ch\/blog\/author\/raffy\/#author"},"creator":{"@id":"https:\/\/raffy.ch\/blog\/author\/raffy\/#author"},"datePublished":"2026-09-01T08:01:00-06:00","dateModified":"2026-08-26T09:03:52-06:00"},{"@type":"WebSite","@id":"https:\/\/raffy.ch\/blog\/#website","url":"https:\/\/raffy.ch\/blog\/","name":"Cyber Security - Strategy and Innovation","description":"Insights at the intersection of cybersecurity, strategy, and innovation.","inLanguage":"en-US","publisher":{"@id":"https:\/\/raffy.ch\/blog\/#person"}}]},"og:locale":"en_US","og:site_name":"Future of Tech and Security: Strategy &amp; Innovation with Raffy \u2013 Insights at the intersection of cybersecurity, strategy, and innovation.","og:type":"article","og:title":"AI Changes What Security Has To Remember \u2013 Future of Tech and Security: Strategy &amp; Innovation with Raffy","og:description":"AI is arriving in security operations as a productivity story: faster triage, better investigations, fewer alerts, and more automation. That is real. But the larger change is that AI creates new actions, attack paths, and evidence that security teams need to capture and understand. The question is no longer only whether an endpoint or identity","og:url":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/","og:image":"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2025\/09\/ogimage.png","og:image:secure_url":"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2025\/09\/ogimage.png","og:image:width":512,"og:image:height":512,"article:published_time":"2026-09-01T14:01:00+00:00","article:modified_time":"2026-08-26T15:03:52+00:00","twitter:card":"summary","twitter:site":"@raffaelmarty","twitter:title":"AI Changes What Security Has To Remember \u2013 Future of Tech and Security: Strategy &amp; Innovation with Raffy","twitter:description":"AI is arriving in security operations as a productivity story: faster triage, better investigations, fewer alerts, and more automation. That is real. But the larger change is that AI creates new actions, attack paths, and evidence that security teams need to capture and understand. The question is no longer only whether an endpoint or identity","twitter:creator":"@raffaelmarty","twitter:image":"https:\/\/raffy.ch\/blog\/wp-content\/uploads\/2025\/09\/ogimage.png"},"aioseo_meta_data":{"post_id":"1739","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-08-21 17:57:44","updated":"2026-09-01 14:01:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null,"seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/raffy.ch\/blog\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/raffy.ch\/blog\/category\/security-information-management\/\" title=\"Security Information Management\">Security Information Management<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tAI Changes What Security Has To Remember\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/raffy.ch\/blog"},{"label":"Security Information Management","link":"https:\/\/raffy.ch\/blog\/category\/security-information-management\/"},{"label":"AI Changes What Security Has To Remember","link":"https:\/\/raffy.ch\/blog\/2026\/09\/01\/ai-changes-what-security-has-to-remember\/"}],"_links":{"self":[{"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/posts\/1739","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/comments?post=1739"}],"version-history":[{"count":3,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/posts\/1739\/revisions"}],"predecessor-version":[{"id":1744,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/posts\/1739\/revisions\/1744"}],"wp:attachment":[{"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/media?parent=1739"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/categories?post=1739"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/raffy.ch\/blog\/wp-json\/wp\/v2\/tags?post=1739"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}