Are We Training AI Too Late?

The report argues that current security AI is overly reliant on post-compromise artifacts, which produces a detection lag as adversaries increasingly use fresh infrastructure and pre-exploitation reconnaissance; GreyNoise data is cited showing many high-impact exploits originate from previously unseen IPs and that anomaly spikes often precede CVE disclosures. The author recommends expanding AI training data to include Internet-scale pre-exploitation telemetry (first-seen IPs, anomaly-detection outputs, infrastructure rotation) to detect attacker intent earlier and reduce reactive bias.