What Does Preemptive Security Mean? Here’s a Quick FAQ.

Q1. What does “preemptive security” mean?

A: Preemptive security refers to security capabilities that anticipate, neutralize or disrupt threats before they successfully execute or cause damage, rather than primarily relying on detection-and-response after the fact. These include techniques like predictive threat intelligence, machine learning (ML), deception, automated moving-target defenses and continuous infrastructure adaptation.

Q2. Why is preemptive security being emphasized now?

A: There was the pre-AI world. Now it’s the post-AI world where threat actors are increasingly using AI for attacks, urgently creating the need for preemptive security.

• The threat landscape is evolving rapidly, especially with the rise of generative AI and more sophisticated adversaries. Phishing attacks are becoming customized for the target organization, while single-use malware and single-use domains are now being used for attacks. Traditional reactive detection/response is increasingly inadequate because you cannot depend on a patient zero being infected to create signatures that protect everyone else.
• The global attack surface is also rapidly expanding, with the adoption of multiple clouds, the growth of IoT/OT devices, distributed remote users and branch/edge deployments.
• Once an attack has landed on a network, it takes only 48 minutes for the adversary to move laterally across the network, creating an urgent need for preemptive measures.

Q3: What are some key trends in the cyberattack landscape and proof points of threat actors using AI?

A:

• 78% of chief information security officers surveyed reported that AI-powered threats are having a significant impact on their organizations.¹
• Ransomware attacks surged by 132% in Q1 2025 compared to Q4 2024, aided by AI deception-based social engineering to gain initial access to networks.²
• Vulnerability exploitation saw a 34% increase due to AI-driven threats.³

Q4: How are threat actors using AI?

A:

• A growing threat comes from AI-driven social engineering, where attackers use artificial intelligence to craft highly convincing phishing emails and voice phishing (vishing) calls. These messages often mimic trusted individuals or organizations, making it far easier to trick victims into disclosing sensitive information or granting unauthorized access to secure systems.
• AI is also transforming how malicious software is developed. By automating and accelerating the creation of complex code, attackers can now produce advanced ransomware in a fraction of the time. These AI-enhanced threats are often capable of bypassing traditional security defenses, effectively lowering the technical expertise needed to launch successful attacks.
• Finally, AI is democratizing cybercrime. With AI-powered tools automating tasks such as phishing kit creation, exploit generation and malware delivery, even inexperienced attackers can orchestrate sophisticated campaigns. This shift has fueled the growth of “cybercrime-as-a-service,” making attacks more frequent, diverse and unpredictable across all industries.

Q5. What is the patient zero infection strategy used by traditional detect-and-respond solutions?

A: The old “patient zero infection” strategy involved another organization becoming the initial target (known as “patient zero”) then studying how that attack/malware operates and using those insights to strengthen your own defenses. However, that approach is no longer effective. Modern threat actors are developing single-use malware specifically designed for your industry, your organization and even your individual employees—greatly increasing the likelihood that you will become patient zero.

Q6. What are the key components or features of preemptive security?

A:

• Prediction and Anticipation: Using AI/ML and predictive threat intelligence to foresee attack vectors and act early.
• Deception/Moving Target Defense: Misdirecting adversaries, altering the attack surface and denying them static easy targets.
• Architecture and Exposure Management: Recognizing that the “global attack surface grid” is expanding (cloud, IoT, APIs) and adjusting security design accordingly.
• Strategic Alignment: Security becomes a business-enabler tied to innovation, digital trust and operational excellence (per the 2026 trends).

Q7. What does Predictive Threat Intelligence mean?

A: Predictive threat intel solutions forecast the likelihood of future cyberattacks by combining AI, analytics and predictive modeling. Unlike traditional threat intelligence, predictive intelligence focuses on what could happen next rather than what has already occurred.

Q8. How should organizations shift from traditional “detection and response” to preemptive modes?

A: Some recommended actions:

• Assess current reliance on reactive tools (SIEM, EDR, MDR) and measure how much of your budget/architecture is truly anticipatory.
• Invest in AI/ML-driven capabilities like predictive analytics, deception tools, moving-target defenses and advanced threat hunting.
• Redesign architecture to reduce attack surface: segmenting, limiting static exposures, isolating critical assets, embedding security in design rather than coming in post-hoc.
• Align security strategy with business-level drivers of innovation, digitization and trust (as per the 2026 trends) so that security isn’t just a cost-center but an enabler.
• Recognize that preemptive capabilities, not detection and response, are the definitive future of cybersecurity in the age of GenAI.⁴

Q9. How does Protective DNS enable preemptive security?

A: Protective DNS (PDNS) uses the Domain Name System (DNS) as a universal proactive shield. It identifies, analyzes and blocks connections to high-risk and malicious domains before a device communicates with them.

This is achieved by:

• Using predictive DNS-based threat intelligence to detect and block threat actor infrastructure before activation, instead of chasing individual malware variants and domains
• Leveraging ML and DNS telemetry to identify high-risk/suspicious domains and prevent users and devices from resolving to those domains
• Detecting and neutralizing traffic distribution systems (TDS) that redirect users to phishing or malware sites

Q10. Why is DNS a powerful point of control?

A: Every digital connection begins with a DNS query. By monitoring and controlling DNS requests, organizations gain visibility into:

• All outbound communications, including those coming from end-user devices, IoT/OT devices, cloud workloads and remote users
• Threat activity before it manifests, such as attempts to access phishing/quishing domains, command-and-control connections or data exfiltration attempts

This visibility allows for early detection and preemptive blocking, even before endpoint or firewall solutions can react.

Q11. What proof points exist to show government and industry adoption of Protective DNS?

A:

• In the United States, CISA/NSA launched PDNS in 2022 to strengthen the cyber posture of federal agencies and critical infrastructure.
• In the United Kingdom, PDNS was officially launched in 2017 and has since established itself as a critical cornerstone of security for U.K.-based public services.
• The Australian Signals Directorate launched the Australian PDNS in 2021 to protect federal, state and territory government agencies.
• Ukraine implemented a national PDNS in 2023, providing filtering of phishing sites resulting in a 30–40 percent reduction in financial phishing fraud as reported by their citizens.
• Google Cloud has released a public preview of Google Cloud’s DNS Armor, powered by Infoblox, to natively protect Google Cloud workloads using DNS-based threat detection.
• Microsoft has released a public preview of Zero Trust (ZTDNS) which locks down Windows 11 machines and only allows them to access PDNS-approved domains, enhancing overall network security.

Q12. What are the benefits and risks of adopting a preemptive security approach?

A:

Benefits:

• Potentially shorter dwell time for adversaries and fewer successful breaches.
• Security becomes more forward-looking and aligned with business innovation rather than always playing catch-up.
• Greater resilience in an environment where attack surfaces and attack tools (e.g., AI-enabled threats) are growing rapidly.

Risks or challenges:

• Preemptive capabilities may require more investment up front (advanced analytics, deception technology, architecture overhaul).
• Organizations may face maturity and staffing constraints: shifting from “detect/respond” culture to “anticipate/disrupt” is non-trivial.
• Over-reliance on automation or AI without proper governance and human oversight could bring new risks.
• Metrics and ROI for “prevented attacks” can be harder to quantify than “responded incidents.” Make sure the preemptive solutions you adopt provide a dashboard on threats prevented, so that it can be easily presented to the board.

Q13. How can I start measuring progress toward preemptive security maturity?

A: Some possible metrics include:

• Percentage of security budget allocated to preemptive/anticipatory tools vs. legacy detection/response.
• Number of incidents or adversary dwell-time metrics before and after implementing deception/moving target defense tools.
• Time to detection vs. time to prevention (blocking or preemptive blocking) of attempted attack vectors.
• Alignment indicators, such as the number of security initiatives directly tied to business innovation projects, and the number of times security enabled (rather than delayed) the rollout of new digital capabilities.

Sources:

1. CrowdStrike 2025 Global Threat Report: Beware the Enterprising Adversary, Myers, Adam, CrowdStrike Blog, February 27, 2025. https://www.crowdstrike.com/en-us/blog/crowdstrike-2025-global-threat-report-findings/
2. Massive Surge In Ransomware Attacks—AI And 2FA Bypass In Crosshairs, Winder, Davey, Forbes, March 25, 2025. https://www.forbes.com/sites/daveywinder/2025/03/25/massive-surge-in-ransomware-attacks-ai-and-2fa-bypass-to-blame/
3. 2025 Data Breach Investigations Report, Verizon, 2025. https://www.verizon.com/business/resources/reports/dbir/
4. Gartner Says That in the Age of GenAI, Preemptive Capabilities, Not Detection and Response, Are the Future of Cybersecurity, Business Wire, September 19, 2025. https://www.businesswire.com/news/home/20250919589679/en/Gartner-Says-That-in-the-Age-of-GenAI-Preemptive-Capabilities-Not-Detection-and-Response-Are-the-Future-of-Cybersecurity