Threat Briefing Webinar | September 15th 2026

How AI broke the Pyramid of Pain

David Bianco's Pyramid of Pain has shaped detection philosophy for over a decade. Its core logic is still sound: the higher up the Pyramid you detect, the harder you are to evade.

What's changed is the operational reality beneath it. AI has collapsed the practical value of the lower layers so fast that organizations still investing there are falling further behind every week.

Data from Push Security's threat hunting pipeline, which includes 15 million browser events per day across approximately one million deployments, makes this case.

Roughly 89% of phishing domains are active for fewer than two days.

Attackers generate entirely new phishing page structures and JavaScript patterns on demand, defeating kit-level signatures.

Legitimate platforms like ChatGPT, Google sites, and GitHub Pages are abused as attack infrastructure, making domain reputation unreliable.

And the innovation-to-commodity window has compressed from years to weeks: ClickFix was adopted by four nation-state groups in a single quarter; ConsentFix went from APT29 attribution to criminal toolkit in six weeks.

Bianco’s model predicted this; techniques change slowest because they are the attack. A device code phishing kit can rotate infrastructure daily, but it always hits the OAuth Device Authorization Grant endpoint. ClickFix always manipulates the clipboard. Credential harvesting requires a user login. These mechanics are the only detection target that persists.

Join Mark Orlando, Field CTO, to unpack the challenges facing analysts and incident responders in the AI era, and what’s needed to level the playing field.

Mark OrlandoField CTO

Register Your Spot Now

Trusted by

Enter some text...