SANTA CLARA, Calif., November 11, 2026 – NSFOCUS recently launched its Smart Security 4.0 strategy during the 2026 TechWorld Smart Security Conference held in Beijing, which seeks to rebuild security capabilities around an intelligence-native foundation, continuously evolve to counter emerging threats, improve operational efficiency through autonomous operations, and strengthen security and resilience as enterprises advance their digital and intelligent transformation.
AI-Driven Attacks Move Towards 24/7 Automation, Challenging Traditional Human-Led Defenses
AI is reshaping the balance between cyber attackers and defenders. Data from the live-fire cyberattack-and-defense drills released at the 2026 TechWorld Smart Security Conference show that large language model (LLM)-enabled attack campaigns have shortened the time required for ransomware intrusions to around 10 hours. Prompt injection has become the leading risk to AI applications, with detections of malicious prompts containing long payloads increasing fivefold in a single quarter. AI infrastructure—including LLM gateways, orchestration engines, keys and SSH authorizations—is also emerging as a new target for attacks.
More notable is the shift in the nature of attacks. This year’s drill featured an “AI Red Team” for the first time, with humans assisting AI in carrying out attacks. As one of the first participating teams, NSFOCUS used a China-developed open-source LLM deployed locally, drawing on 133.4 billion tokens of local computing resources to produce hundreds of attack reports.
The results showed that authorization-related vulnerabilities—including unauthorized access and privilege escalation—accounted for the largest share (41.2%) of the vulnerabilities identified by the agents. 35% of successful compromises involved perimeter devices that are difficult for human operators to monitor continuously. In the fastest case, the entire process—from initial contact with an asset to compromising a core system, clearing traces and safely withdrawing—took just 100 minutes, without human intervention. A traditional red team would typically need several hours or even days to complete the same task.
These drill results indicate that cyber offense and defense have entered the AI era. Faced with AI-driven automated attacks capable of operating continuously, traditional defense models that rely on predefined rules and manual intervention may struggle to respond in time, putting defenders at a clear disadvantage.
Smart Security 4.0: Making AI an Integral Part of Security, Not an Add-on
To address these changes, NSFOCUS has introduced its Smart Security 4.0 strategy, built around four defining characteristics: intelligence-native security, continuous evolution, autonomous operations and business resilience. Together, these four characteristics are intended to turn AI from an add-on security tool into an integral part of the security foundation:
Intelligence-native security
An intelligent foundation is built on four layers—data and knowledge; models and agents; orchestration and execution; and governance and auditing. Rather than replacing customers’ existing firewalls, web application firewalls (WAFs), endpoint detection and response (EDR) systems or security operations centres (SOCs), AI enables these tools to be coordinated through a unified set of policies, with full traceability over who authorizes an action, which tool is invoked and what action is performed.
Continuous evolution
Models and agents learn continuously. Each attack and operational outcome is processed through a cycle of knowledge extraction, validation and evaluation, policy deployment, and feedback, contributing to the next iteration of capabilities. This allows security capabilities to improve continuously through real-world practice rather than remain static after deployment.
Autonomous operations
AI takes the lead across five stages: assessment, investigation, decision-making, execution and review, enabling 24/7 parallel operations. AI handles high-frequency, large-scale security tasks, while human experts retain control over critical decisions, authorization boundaries and accountability.
Business resilience
The goal shifts from “zero incidents” to “zero disruption”. Four steps will be conducted to help maintain business continuity and ensure reliable recovery following a security incident: business identification, impact containment, trusted recovery and effectiveness validation.
Putting Capabilities into Practice: From Detection in Minutes to Full-Lifecycle Agent Security
In practical terms, NSFOCUS demonstrated the key capabilities of Smart Security 4.0 in four areas:
AI-Native Detection and Response
By combining large and small models with meta-learning techniques, NSFOCUS has reduced the time needed to detect previously unknown threats from several days to just minutes, and shortened the on-site generation of detection rules from several weeks to minutes. In tests at a customer site, all 29 attacks exploiting zero-day and one-day vulnerabilities were detected, achieving a 100% detection rate. The three-layer encoding/decoding rate was also 100%, while the recovery rate for encoding-based evasion reached 98%. Supported by the NSFGPT AI Security Capability Platform and the FDE Rule Operations Framework, detection capabilities accumulated in the field can feed back into the discovery of previously unknown threats, creating a cycle of improvement driven by AI-native capabilities and continuous evolution.
AI-Driven Vulnerability Management
At the end of August, NSFOCUS AI, built on Zhipu’s GLM-5.3 foundation model, achieved a 95.02% vulnerability reproduction success rate and ranked first globally in the CyberGym evaluation. In April, it also won first prize at the second Tencent Cloud Hackathon Intelligent Penetration Testing Challenge. The system covers AI-powered vulnerability discovery through collaboration among multiple Meta-Agents, end-to-end autonomous penetration testing, and a closed-loop vulnerability remediation process involving autonomous verification, patch generation and automatic fixing. These operations can run 24/7.
Digital Employees and Proactive Threat Hunting
To address advanced threats that remain concealed for extended periods by using legitimate accounts, NSFOCUS presented a real-world case involving its “AI-powered security digital employee” defense capability. In the incident, an attacker used legitimate IT operations accounts throughout a 23-day campaign, and conventional standalone alerts failed to detect the abnormal activity. The digital employee identified weak signals through user and entity behavior analytics (UEBA), detected anomalies by cross-checking IT operations tickets, and then correlated records from identity and access management (IAM), network traffic and EDR systems. The attack was ultimately identified when the attacker attempted to move into the production network, after which threat hunting across the network located all compromised assets. During response, policies were deployed within seconds: IAM revoked tokens, firewalls blocked lateral movement, and EDR removed persistent threats. Lessons from the hunt were also incorporated into routine detection rules.
Agent and Data Security
For agent security, NSFOCUS has introduced its NSFAIS ( AI Application Security) solution, which covers the full-lifecycle of AI agents, from development and application deployment to runtime operations. It establishes four layers of defense: compliance checks, evaluation and hardening, monitoring and protection, and continuous operational optimization. Combined with products such as the Agent Detection and Response (AI-DR), AI Gateway ( AI-GW) and AI GuardRails (AI- GR), the solution aims to ensure trust before deployment, control during operation and practical adoption across industries.
In terms of data security, NSFOCUS has developed three main pillars: NSFGPT supports data security operations through data mapping, intent-based control and semantic authorization; NSFAIS ( AI Application Security) solution safeguards the boundaries of AI agents’ data access and use; and trusted data spaces and confidential AI, supported confidential computing and trusted connectors, allowing data to be used without being exposed.
Implementation: One Framework, a Five-Step Roadmap and a New Delivery Model
NSFOCUS has proposed a “1-4-4+12” development framework: one intelligent security operations centre, where AI leads operations while humans retain control over boundaries and authorization; four principles: intelligence-native security, continuous evolution, autonomous operations, and business resilience; four categories of protection—assets, data, applications and identities, with identity protection extended to agent identities and non-human identity credentials; and 12 implementation priorities spanning the AI foundation, core defenses and operational resilience.
NSFOCUS recommends a five-step implementation roadmap: establish an AI security computing centre as the intelligent foundation; connect existing security products to intelligent capabilities; upgrade existing security platforms with AI features such as AI-powered Q&A, analysis and inspections; use AI to re-engineer the delivery process for security capabilities; and, ultimately, deploy digital employees for tasks such as attack surface analysis, threat hunting and vulnerability verification. In parallel, the company plans to explore an FDE (Field Delivery Engineer) model that combines on-site AI-assisted coding with agent interaction, embedding customers’ business objectives and on-site constraints into security capabilities. Cloud–on-premises collaboration will enable operational experience to be continuously accumulated.
Overall, NSFOCUS aims to integrate AI capabilities into cybersecurity detection, vulnerability management, threat response and day-to-day operations, using continuously evolving security capabilities to strengthen business resilience for enterprises.
