The Endpoint and the Security Singularity: Key Takeaways from Allie Mellen at HexCon26

Cybersecurity is approaching an inflection point.

AI is altering what attackers can do, how quickly they can gather information and how much expertise they need to move through different stages of an attack. At the same time, security teams are beginning to use AI agents to reduce repetitive work and accelerate investigations.

During her HexCon26 session, “The Endpoint and the Security Singularity,” Keynote Speaker Allie Mellen, Principal Analyst at Forrester, explored both sides of this shift.

Her central argument was clear: AI may change the way attacks are carried out and the way security operations function, but the endpoint continues to sit at the center of both.

As Agentic AI in Endpoint Security develops, that relationship between endpoints, AI, and security operations becomes increasingly important.

AI in enterprise IT: Lessons from HexCon26

Enterprise AI becomes meaningful when it moves from answering questions to helping organizations act – with context, controls and accountability built in. Here are some of the biggest AI lessons from HexCon26.

Read more

AI is removing traditional constraints for attackers

Attackers have always operated within constraints. Reconnaissance takes time. Identifying operating systems and vulnerabilities requires expertise. And building an exploit on top of it requires another layer of technical knowledge.

AI, unfortunately, is beginning to reduce many of those barriers.

Allie explained that attackers can increasingly use AI to identify operating systems, discover vulnerabilities, gather information about a target and assist with exploit creation. AI can also provide domain knowledge that previously required attackers to build expertise across endpoints, networks, cloud environments and other areas.

She also pointed to attribution as a growing challenge. AI can potentially help attackers imitate characteristics associated with other threat actors, making malicious activity harder to attribute accurately.

That does not mean AI-driven attacks are already perfect.

Allie noted that some automated attacks today still behave inefficiently, take unnecessary paths and leave behind evidence that a human attacker might avoid. But she also stressed that these systems are likely to become faster and more effective over time.

The result is a changing attack model where tasks that once demanded significant time, expertise and manual effort can increasingly be supported by AI.

For defenders, that makes the question of where this activity can be observed and stopped even more important.

The endpoint remains a critical security control point

Infrastructure discovery. Vulnerability identification. Exploit deployment. Lateral movement. Data exfiltration. Allie highlighted one commonality across all these activities: the endpoint. During the session, she explained how much of the effort to defend against AI-driven attacks will continue to start with and remain focused around the endpoint.

At the same time, traditional boundaries between endpoint technologies are becoming less distinct. Allie discussed increasing crossover between UEMs, endpoint security capabilities, and EDRs/XDRs. She delved deeper into this shift by showing how capabilities traditionally associated with one security category are increasingly appearing across adjacent areas. UEM, for example, is moving further into protection-focused capabilities, while EDR and XDR continue to expand beyond their traditional boundaries.

This convergence creates an important foundation for Agentic AI in Endpoint Security. Because, as security operations become more automated, the endpoint becomes one of the places where agents can draw the context needed to understand what is happening.

From AI agents to agentic security operations

AI agents are not chatbots.

Allie defined an AI agent as a software system that uses AI to interact with its environment, collect data and make decisions based on predefined goals without constant human intervention.

The distinction matters because individual agents are generally built to handle focused tasks. In security operations, Allie discussed agents designed for areas such as alert triage, phishing analysis, threat hunting, investigation, and reporting.

The goal, however, is not to ask one AI system to perform every security function. Instead, specialized agents can focus on individual tasks where they are more likely to produce consistent outcomes.

Agentic AI takes this model further.

Rather than operating independently, multiple agents can communicate and work together toward a broader objective. Allie described agentic systems where alerts move from triage agents to an incident orchestrator and then into different investigation or response workflows depending on the information available.

This is where agentic AI in endpoint security begins to change the structure of security operations. Instead of AI assisting with a single task, multiple specialized agents can begin supporting different stages of the same security workflow.

Agentic security still depends on context and control

This shift toward agentic security does not mean every security action is ready to become autonomous. Allie noted that the agentic systems she sees today are still largely focused on alert triage and investigation, rather than response.

The reason is simple: a technically valid response may not always make sense in the context of the business. During the session, she gave the example of an AI system recommending that Excel be blocked across an environment. Technically, that could stop certain malicious activity. Operationally, however, it could also disrupt teams that depend on Excel to carry out critical work. Context therefore becomes essential.

Allie also warned about the possibility of cascading failures in agentic systems. If one agent produces an incorrect result and another agent relies on that information, errors can propagate through the wider workflow.

For now, some of the clearest use cases remain areas where agents can reduce repetitive analyst work and accelerate access to information, including triage, investigation, threat hunting and reporting.

The security singularity is therefore not simply about AI replacing traditional security operations. It is about a transition in which attackers and defenders are both increasingly using AI, while the endpoint remains central to understanding and acting on what happens next.