Versatile AI Risk Assessment
Software development and IT security

AI-based cyberattack detection

Also known as: AI-based threat detection

The system learns normal patterns in networks, devices, accounts and email traffic, then flags deviations that may indicate attacks, phishing or compromised accounts.

Explore the interactive model

Export handout

A concise PDF covering how the system works, its data flows and points to investigate, ready to share.

The explanations and measures describe the typical system design. Extensive personal changes add an appendix.

Understand the use case

What defines this use case?

It analyses connection, login and email data and presents suspicious activity to security operations centre (SOC) specialists for review. Spam and phishing filters also fall into this category. Documented uses include two US agencies and, according to the manufacturer, a bank in Kenya.

This page describes a typical system design. Actual data flows and permissions depend on your implementation.

System design
Analysis and processing
Ability to act
Action permissions depend on integration
Fields of use
public administration, energy supply, banking
Also known as
network anomaly detection, Network Detection and Response (NDR), email security, phishing detection, security analytics

How it works, step by step

System design and data flows

  1. Input data

    Network traffic, login logs, device events and emails arrive around the clock.

    Emails and network traffic also come from attackers deliberately trying to influence detection. Logs reveal who communicates with whom, when, and where they log in.

  2. Processing

    A model compares activity with learned normal behaviour and assesses deviations.

    The model processes events from the designated security and operational sources to detect suspicious patterns or deviations. Alerts are then correlated and prioritised for investigation. A warning, incident assessment and countermeasure are separate parts of the security process.

  3. Results

    Suspicious events appear as classified alerts; depending on the setup, the system also blocks links, accounts or connections.

    The result describes the defined model task. A match, category or forecast acquires its professional significance only in conjunction with the underlying data and intended use.

  4. Use and impact

    SOC specialists review alerts and respond; activity the system does not flag often goes unnoticed.

    Integration determines whether the result is simply displayed, adopted after approval or written directly into a business application. These variants differ in their data flows and permissions.

Explore the system design: Select a component to see its task, incoming and outgoing data, and role in the use case. The guided walkthrough explains each phase. Then use Yes, Uncertain and No to represent your specific system variant.

7 review first16 clarify7 baseline threats

InputProcessingResultImpact Externalaccess 05 Input 41 Third-partycontent 00 AI model 05 Providerservice 01 Documentcollection 00 Memory 00 Training andfeedback 21 OtherAI agents 00 Tools andinterfaces 00 Result 01 Business appor equipment 01 person 10 Affectedperson 00 AI serviceswithout approval 01 Externalaccess 05 Input 41 Third-partycontent 00 AI model 05 Providerservice 01 Documentcollection 00 Memory 00 Training andfeedback 21 OtherAI agents 00 Tools andinterfaces 00 Result 01 Business appor equipment 01 person 10 Affectedperson 00 AI serviceswithout approval 01
  • Present
  • Depends on your system
  • Absent
  • Review first
  • To clarify
Architecture as a list

How it differs from similar use cases

Data and information

Input data and information sources

Emails and network traffic also come from attackers deliberately trying to influence detection. Logs reveal who communicates with whom, when, and where they log in.

Processing and operating environment

Some deployers develop their own detection systems; others use security vendors' products.

Storage and further use

The system learns normal behaviour from the organisation's own network, account and email data. Specialists' assessments of whether an alert was justified can feed back into the model.

Results and data sharing

Some systems block links, accounts or connections themselves; others only issue alerts. Cloud services send metadata or emails to the provider for analysis.

Using a provider does not automatically determine where processing takes place. Storage location, subcontractors, deletion periods and use for training must be checked for the specific deployment.

Assess risks and determine measures

From understanding the system to analysing risks

  1. Define the system boundary

    Record data, participants, interfaces and permissions. Resolve uncertain characteristics in the model.

  2. Investigate threats

    Relate review candidates to actual data flows: what could happen, and who would be affected?

  3. Assess risk

    Assess impacts and likelihood in the deployment context. The number of review candidates is not a risk score.

  4. Provide evidence of measures

    Select appropriate controls, assign responsibilities and define effectiveness checks. Document residual risks and approvals.

Key threats in the application context

  • 3 particularly important
  • 4 typical
  • 16 depending on the system
  • 7 additional threats for every AI system

A total of 30 threats from the threat catalogue may be relevant to this use case.

Priority review points

  1. Adversarial Inputs

    Attackers adapt phishing emails and network traffic to appear normal to the model. The attack then slips past detection.

  2. Training Data Poisoning

    An attacker who gains an early foothold gradually expands their activity until the system learns it as normal. Later data exfiltration then triggers no alert.

  3. Overreliance

    When the system reports nothing, a network is soon assumed to be clean and people stop hunting for attackers themselves. Attacks the model does not recognise as deviations remain undetected.

4 further review candidates in the typical design

Other relevant threats

  1. Backdoor ML Model

    Training data or an adopted base model can introduce hidden triggers for misbehaviour.

    Listed because of this characteristic

    • Learns from your own data

  2. Privacy Attacks

    Targeted queries can recover some personal or protected training data from the model.

    Listed because of these characteristics

    • Processes personal data
    • Processes confidential data

  3. Sensitive Information Disclosure

    Confidential content can appear in answers, supplied context or logs.

    Listed because of these characteristics

    • Processes personal data
    • Processes confidential data

  4. Exfiltration from ML Application

    Protected data can leak through tools, network connections, storage or insiders.

    Listed because of this characteristic

    • Processes confidential data

Up to 16 further threats may apply, depending on your system design. Nine threats need to be reviewed for every AI system. Two of these are particularly important here and are therefore listed above.

System features and open questions

Each Yes adds further threats to your checklist, up to 16 in total. If you cannot yet answer a question, include its threats in your review.

How many threats a Yes adds
  • Added by this Yes
  • Also requires a Yes to another question

How your system is built

  1. Performs natural language tasks5 threats
  2. Generates its own text2 threats, plus 1 only in combination with other characteristics
  3. Processes text, images and speech together2 threats
  4. Changes data or triggers processes1 threat
  5. Learns from examples with correct answers1 threat
  6. Uses operational feedback1 threat

How you operate the system

  1. Available to people outside the organisation5 threats
  2. Accepts queries directly through an interface4 threats, plus 1 only in combination with other characteristics
  3. Accessible over a network3 threats
  4. Incurs costs with each query1 threat
  5. Shares computing resources with other customers or applications1 threat
  6. Used alongside unapproved AI services1 threat

How your system is built

Can the system change things itself, such as storing data, sending messages, initiating transactions or granting permissions?

Some systems block links, accounts or connections themselves; others only issue alerts.

If yes, add

Is the model trained on examples to which someone has assigned the correct answer?

Phishing filters learn from labelled examples; anomaly detection can work without them.

If yes, add

Does operational feedback or output later feed into analysis or training?

Specialists' assessments of whether an alert was justified can feed back into the model.

If yes, add

How you operate the system

These questions arise for almost every AI system.

Controls and implementation

Measures for the priority review areas are expanded. Each linked measure explains how to implement it.

Review priorityAdversarial Inputs2 measures
Review priorityTraining Data Poisoning2 measures
Review priorityOverreliance3 measures
Backdoor ML Model2 measures
Privacy Attacks3 measures
Sensitive Information Disclosure3 measures
Exfiltration from ML Application3 measures

Controls for the remaining threats are available on their pages in the threat catalogue.

AI Act provisions

When AI Act provisions apply
  1. Art. 4: AI literacy

    For every AI system Applies since 2 February 2025.

  2. Annex III no. 4 point b: Employment decisions

    Depending on use Review trigger from 2 December 2027.

Applies to every AI system

Art. 4: AI literacy

Applies if staff or appointed representatives operate or use AI systems.

Applies since 2 February 2025.

Obligations and details
Who bears the obligations
Provider, Deployer, Product manufacturer, Provider of a general-purpose AI model

Detailed obligations

May apply in particular uses

Annex III no. 4 point b: Employment decisions

Applies if the system monitors workers' behaviour and its alerts inform decisions about their employment.

Applies from 2 December 2027.

Obligations and details
The general condition is
Applies if the system influences working conditions, promotion or dismissal, allocates tasks by behaviour or personal characteristics, or monitors workers' performance and behaviour.
Who bears the obligations
Provider, Deployer, Product manufacturer, Importer, Distributor, Authorised representative

Detailed obligations

Generally does not apply

Annex III no. 2: Critical infrastructure

Under recital 55 of the EU AI Act, components used solely for cybersecurity do not qualify as safety components of critical infrastructure.

Obligations and details
The general condition is
Applies if the system acts as a safety component in critical digital infrastructure, road traffic or water, gas, heating or electricity supply.
Points to consider
A fundamental rights impact assessment under Article 27 is not required here.
Who bears the obligations
Provider, Deployer, Product manufacturer

Detailed obligations

Classify your system with the quick checker All obligations in the obligations compass

Cross-cutting threats

Review these threats for every AI system, whatever its purpose.

Why these threats always belong on the checklist

Atypical system features

View 14 further questions

If any of these features does apply to your system, add the listed threats.

Sources

Related use cases

Also in the field of Software development and IT security

Updated: 30 September 2026. Review checklist rules version 0.3.2, threat catalogue version 2026.10.24.2. How these pages are structured