CONTEXT is king in the fight against modern cyberattacks, argues Etay Maor, reframing how security teams detect and respond to intrusive activity. The piece emphasises that attackers no longer rely on a single dramatic exploit; instead they exploit chained, seemingly ordinary events that, taken together, signal an imminent breach. For defenders, the challenge is that data about users, devices, applications and network activity sits in multiple, disconnected tools.
This fragmentation creates blind spots that attackers can exploit more quickly than humans can stitch together the clues. The author argues for a contextual, agentic defence that treats multiple signals as a whole, helping teams anticipate what an attacker is likely to do next and intervene before escalation.
The article outlines how this approach works in practice: moving from asking whether an event is bad to predicting the attacker’s next move and the smallest, safest way to stop it. It uses a scenario in which a finance department user downloads legitimate remote‑admin software from a low‑reputation domain. While the software itself isn’t malicious, the context—first usage, unusual timing, and the domain’s reputation—creates an early warning.
If another related event follows, the system can link the patterns and, where appropriate, block further downloads or tighten access without wholesale disruption. Key elements for embedding contextual security include auditing data quality, clear autonomy boundaries, visible and reversible actions, scalable infrastructure to handle AI‑driven activity, and measuring outcomes such as time-to-detect and time-to-contain rather than merely counting alerts.
The piece closes by stressing that contextual defence complements, rather than replaces, foundational controls, enabling security teams to connect signals and act with precision.