AI in endpoint security mostly means machine learning models that classify files, processes or behavior as malicious or normal. They catch variants that signatures miss, but they can be evaded or poisoned. Treat the model as one layer, test it against your own samples, and keep controls that do not depend on it.
What does AI actually do on an endpoint?
In practice it classifies. A model looks at features of a file, a process tree or a stream of events and outputs a score. NIST's report on adversarial machine learning (AI 100-2e2025) lists the places researchers have studied these classifiers: malware classification, malicious PDF detection, Android malicious app detection, network intrusion detection, spam detection and phishing detection.
Benefits are real. A model generalizes from known samples to unseen ones, so a repacked variant of known malware may still score high. A behavioral model can flag a process that does something unusual for its type, without a signature for the specific tool.
How is it attacked?
The NIST taxonomy arranges attacks by stage and attacker goal. Two matter most for detection models.
Evasion changes an input at deployment time so the model gets it wrong. NIST reports evasion demonstrated against malware classifiers, PDF malware classifiers, Android malicious app detection and intrusion detection, and in the real world against face recognition, phishing page detection and malware classification. One case study covered a commercial phishing page detector: of 4,600 samples the model marked uncertain, analysts found 100 adversarial examples, and attackers used relatively simple methods such as cropping, masking and blurring instead of sophisticated optimization.
Poisoning corrupts training data so the model learns the wrong thing. NIST notes poisoning has been shown for malware classification, malicious PDF detection and Android app classification, and for clustering used in malware classification and network anomaly detection. Poisoning is a supply chain problem: if a model retrains on telemetry that an attacker can influence, the attacker influences the model.
The taxonomy also covers privacy attacks and abuse attacks, which matter more for generative systems.
Can the models be hardened?
Only partly. NIST says the mitigations it describes all exhibit inherent trade-offs between robustness and accuracy and add computational cost at training time, so designing models that resist evasion while keeping accuracy remains an open problem. Formal verification techniques show potential for certifying robustness but are limited by scalability, computational cost and the types of operations they support.
The honest reading: no vendor can promise a model that cannot be evaded. What you can do is lower the cost of a miss.
What about AI for attackers and for analysts?
The same report concerns attacks on AI systems. It does not measure how much AI helps attackers write malware or helps analysts triage alerts, so this post does not claim numbers either way. Assess any vendor claim by asking for the evaluation method.
A constructed example
A security team pilots a model-based detection feature. In a test lab, they take 50 known malware samples, repack each with a simple packer and slightly change strings, then run them on a test machine. The detector flags 41. They then check the nine misses against a behavioral rule and a restricted-execution policy, and find that those controls catch seven of them. The lesson was not that the model is bad. It was that the layers cover each other's misses, and the team now knows which ones.
How to check or apply this
- Ask what the model classifies, on what features, and how often it is retrained.
- Ask how the vendor tests against evasion and what the false positive and false negative rates were, on what data.
- Run your own test with benign and malicious samples in a lab, including trivial modifications.
- Keep controls that do not use the model: application allowlisting, least privilege, patching, network segmentation.
- Treat retraining data as a supply chain input, and ask who can influence it.
- Review automated response actions, since a false positive can quarantine a business-critical process.
- Keep humans in the loop for high-impact actions and review the model's misses.
Safeguard is not an endpoint protection product. Its AI is applied to software supply chain security, such as finding vulnerabilities and proposing fixes, and it offers Full AI, Zero AI or bring your own model, so teams can choose how much AI is involved.
Quick check
Can machine learning malware detectors be evaded?
Yes. NIST documents evasion attacks against malware classifiers and notes that robustness against them is an open problem, with trade-offs against accuracy.
What is data poisoning?
Corrupting training data so a model learns incorrect behavior. NIST notes it has been shown against malware classification and anomaly detection systems.
Sources
Last reviewed: 18 October 2026.
