Tanium relaunches Security Operations with Endpoint Drift and behavior-based detection for AI-accelerated attacks using trusted admin tools

What changed

Tanium relaunched Security Operations on October 6 around behavior-based endpoint detection for attacks that use stolen credentials and ordinary administrative tools rather than recognizable malware. New Endpoint Drift learns each endpoint's normal behavior and ranks machines that deviate from it, while a new Insights Engine targets activity hidden inside trusted processes. Response actions range from stopping a process or collecting forensic evidence to isolating hosts across a large fleet. Tanium's “AI-era attacker” framing is the vendor's threat positioning; real detection and response effectiveness still depends on independent validation in each environment.