Zscaler maps deception controls to AI-enabled attack campaigns

Zscaler has published an analysis of five threat actors described in Anthropic’s September 2026 threat intelligence report, arguing that deception should serve as a primary early-detection and containment layer against AI-enabled attacks.

The company said AI has not changed attacker tactics, which still rely on stolen credentials, exposed applications and cloud misconfigurations, but has compressed the time defenders have to respond by speeding up reconnaissance, credential validation and exploit development.

The post maps deception controls such as decoy credentials, honeytokens, synthetic assets and canaries to specific attack steps across the five campaigns, and recommends deploying them in the discovery paths AI agents are likely to enumerate.