Know Your Attacker: LLMs as Tool, Target, and Insider Threat

AI is rewriting the attacker playbook. Large language models now act as an adversary's tool, a high-value target, and a new source of insider risk, but every campaign still leaves a footprint in global DNS.

Join DomainTools at the SANS Fall Cyber Solutions Fest 2026: Threat Intelligence Track on Thursday, November 19, for "Know Your Attacker: LLMs as Tool, Target, and Insider Threat." Taylor Wilkes-Pierce, VP of Solutions Engineering, will show how DNS intelligence enriched with web content, X.509 certificates, and IP telemetry helps security teams track attacker infrastructure during the staging phase and stop LLM-era threats before they strike.

• LLM as a tool: spot generative tooling fingerprints, from templated site content to batch-issued certificates.
• LLM as a target: defend exposed AI models and APIs against model distillation, intellectual property theft, and cognitive FQDN spoofing aimed at autonomous AI agents.
• LLM as an insider risk: detect grey-market token reseller usage before it fuels adversary-in-the-middle attacks and targeted phishing.