NSFOCUS puts AI at the centre of cyber defence, with humans retaining control

The company’s Smart Security 4.0 strategy would use AI to coordinate security operations and handle repetitive work, while reserving sensitive decisions for people. Its performance figures are vendor-reported, not independent evaluations.

NSFOCUS has unveiled Smart Security 4.0, a strategy intended to place artificial intelligence at the centre of cyber defence, as attackers increasingly use automation to speed up reconnaissance and intrusion. The company introduced the plan at its 2026 TechWorld Smart Security Conference in Beijing, arguing that security systems must evolve continuously, operate with greater autonomy and protect business continuity as well as networks. Its claims about the strategy and conference exercises are company-reported, rather than independent measures of industry-wide performance.

The conference exercises, as described by NSFOCUS, included an AI-assisted simulated intrusion completed in 100 minutes, from initial contact with an asset to compromising a core system and withdrawing. The company said 41.2 per cent of vulnerabilities identified by participating agents involved authorisation weaknesses, while 35 per cent of successful compromises involved perimeter devices. Separately, Palo Alto Networks’ Unit 42 has documented a real intrusion in which a human attacker used AI agents to help with reconnaissance, credential searches and access to cloud resources. That investigation lasted less than ten hours and involved more than 50 techniques mapped to MITRE ATT&CK. Unit 42 stressed that the episode involved a human directing the operation: AI accelerated tactical work but did not act as an entirely independent attacker.

NSFOCUS’s proposed model brings data and knowledge, models and agents, operational tools, and governance into a shared architecture. Rather than displacing existing firewalls, endpoint systems or security operations centres, the company says AI should coordinate them under common policies, with records of who authorised actions and which tools were used. Its approach also envisages learning from the outcomes of investigations and responses, so that validated findings can inform future rules and procedures. AI would manage repetitive, high-volume work, while people retain authority over sensitive actions and accountability.

That division of responsibility matters because AI applications can be exposed to prompt injection: instructions embedded in user input or retrieved material may alter a model’s behaviour. OWASP’s GenAI Security Project warns that such attacks can expose information, influence decisions or trigger unauthorised actions through connected tools. It says retrieval-augmented generation and fine-tuning do not remove the risk, and recommends least-privilege access, input and output checks, adversarial testing and human approval for high-risk operations. NSFOCUS says its agent-security offering is designed to cover development, deployment and runtime, combining assessment, monitoring and operational controls.

The company also presented tools for detection, vulnerability management and threat hunting. NSFOCUS says its tests at a customer site detected all 29 attacks involving zero-day and one-day vulnerabilities, and that its system identified suspicious activity during a 23-day scenario in which an attacker used legitimate IT operations accounts. The company attributes the latter result to correlating behavioural signals with service tickets and records from identity, network and endpoint systems. These outcomes are vendor-reported demonstrations, not independent evaluations. Its technical report gives a 95.02 per cent score for NSFOCUS AI using GLM-5.3 on CyberGym Level 1; that benchmark measures reproduction of known vulnerabilities under specified validation conditions, not the ability to compromise real-world networks autonomously.

For implementation, NSFOCUS proposes a framework spanning an AI-led security operations centre, four guiding principles, four protection domains and 12 priorities. Its five-stage roadmap begins with an AI security computing centre, then connects existing products, adds AI capabilities to platforms, reworks service delivery and introduces digital employees for tasks such as threat hunting and vulnerability verification. The company says it is also exploring a field-delivery model combining AI-assisted development with on-site expertise. The ambition is to make security operations more adaptive while preserving human oversight, but the reported results and proposed capabilities remain claims from the strategy’s developer.

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph:

Source: Fuse Wire Services