Invisible, encrypted, intelligent: the new threat your firewall cannot see

OP-ED · 10 JULY 2025

By Jérôme Beaufils, CEO of SASETY · Lire en français

Cybersecurity is going through a break. Attacks have never been so numerous, so sophisticated and, above all, so silent.

A trend confirmed by the figures:

97% of companies have at least one endpoint infected by a botnet.
1 company in 3 was targeted by ransomware during the year.
Most malicious traffic uses authorised ports, protocols or addresses, making it impossible to detect with traditional firewalls.

The conclusion is clear: traditional security mechanisms have become obsolete.

It is time to rethink security as a native network function, backed by artificial intelligence.

Attacks everywhere, yet invisible

Cyberattacks are no longer one-off events. They are now systemic, persistent and often undetectable.

Most malicious traffic uses authorised ports, protocols or addresses, making it impossible to detect with traditional firewalls.

For example, an infected endpoint uses an encrypted HTTPS tunnel on port 443 to exfiltrate data. The traffic looks legitimate. The firewall rule lets it through. The result: the intrusion goes completely unnoticed.

When generative AI becomes an accomplice

Generative AI tools such as ChatGPT can now be exploited to produce malicious code: password stealers, reverse shells and more.

With a little prompt engineering, someone with no technical skills can generate malware in a few minutes.

A new category of threat is emerging: attackers with no technical knowledge, but armed with AI.

Why firewalls and VPNs are no longer enough

Traditional architectures are fragmented, with scattered tools that do not interact. They offer no global correlation and no consistent inspection of encrypted traffic, nor unified visibility across different uses, including remote work, remote sites and SaaS application consumption.

Anomalies remain invisible or trigger no alert. The company believes it is protected when it is already compromised.

The SASE model: security built into the network

SASE(Secure Access Service Edge) is an architecture that merges networking (SD-WAN) and security in the cloud. It places security functions as close as possible to the traffic, wherever it is.

The key components of a SASE architecture are:

Examples of attacks stopped by the combination of Cato SASE + AI

Ballista (IoT botnet)

Exploits a flaw in a TP-Link router (CVE‑2023‑1389).
Deployed via the dropbpb.sh script, encrypted tunnel on port 82.
Detected by Cato Networks through a combination of IPS + behavioural AI + C2 traffic analysis.
Result: attack blocked before any communication with the command server.

Prompted LLM malware

Generation of a Chrome password stealer via an LLM.
Detected via sandboxing and semantic analysis of the generated code.
Result: blocked before execution.

Security driven by AI and data

The Cato Networks engine relies on anomaly detection techniques combined with AI models:

Sliding time windows to capture behavioural anomalies
Multi-source correlation (user, application, protocol, endpoint, geolocation)
Automatic generation of alerts enriched by generative AI for analysts

How Cato Networks concretely addresses these new challenges

Faced with increasingly stealthy, encrypted and distributed threats, the Cato Networks platform offers an integrated, real-time and fully cloud-native approach to network cybersecurity.

An end-to-end SASE platform

Cato SASE Cloud rests on three fundamental pillars:

A global private backbone covering more than 80 countries.
A unified security stack, inspecting all traffic in a single pass.
A native AI/ML layer for anomaly detection and response automation.

Real-time visibility across all traffic

Cato Networks provides a central management point through the Cato Management Application, enabling correlated, contextualised analysis of network and security data, while applying dynamic policies adapted to the context of the user and the device.

Advanced threat detection

Cato enables proactive identification of suspicious traffic (including C2 connections, Tor usage, exploits and botnets), thanks to behavioural detection based on the analysis of billions of sessions, allowing partners such as SASETY to deliver SOC services through continuous monitoring and remediation capabilities.

Conclusion

Modern cybersecurity requires merging networking and security into a global, intelligent and scalable model. This is precisely what Cato Networks SASE technology makes possible.

Combined with the expertise of a close partner such as SASETY, organisations optimise their business performance while benefiting from the highest level of security, with zero compromise, zero unnecessary complexity and zero blind spots.

☎️ A question, a project? Our experts are here to help!

Contact our experts →