SECAI Core · phase 11 of 15
Advanced persistent threat
An attacker's ability to obtain, maintain, and diversify access to network systems using exploits and malware.
The Explain card
- Plain English
- An APT is a well-resourced attacker who gets into a network, stays there quietly for a long time, and keeps widening their access using exploits and malware. The key words are persistent and patient.
- Example
- An intrusion group compromises an AI lab's developer workstation, lives there for months, and slowly collects credentials until it can exfiltrate unreleased model weights and training data.
- Why it matters
- AI organizations hold crown jewels: proprietary models, datasets, and compute. APTs target exactly that, and they are caught by long-term anomaly hunting, not by a single alert.
- Hook
- Not a smash-and-grab, a tenant who never signed a lease.
Where it sits in the deck
Phase 11: Threat Landscape: Attack Vectors and Adversarial Techniques
With defences named, learn what they must defend against — the full catalogue of attack techniques targeting AI systems, their inputs, outputs, training pipelines, and supply chains.
