Cisco Talos has embedded a machine learning engine directly into Snort 3, the open-source intrusion detection system that has been a backbone of network security for decades. The new component, called SnortML, runs LSTM-based classification on HTTP query strings and POST bodies entirely on the local device, adding roughly 350 microseconds of latency per inspection while catching exploit variants that no signature has been written for yet. The move signals a broader industry shift: the sensor layer of network defense is beginning to think, not just match patterns.
Why Signatures Alone Hit a Wall
Classic Snort signatures are precision instruments. A well-crafted rule catches a known exploit with near-zero false positives and minimal overhead. The problem is exposure time. Between a novel vulnerability surfacing in the wild and a researcher reverse-engineering it, writing a rule, validating it, and shipping it through update channels, days or weeks can pass. For actively exploited flaws in common software, that window is not theoretical. It is where breaches happen.
SnortML does not replace signatures. It runs alongside them in parallel, feeding from the same HTTP inspector via Snort 3's publish/subscribe interface. When the HTTP inspector finishes parsing a request, it pushes the URI query string and POST body to the event bus. The SnortML inspector picks it up, runs it through a pre-trained TensorFlow model, and returns a probability float. Either path can trigger an alert independently. When both fire on the same payload, the correlation carries meaningfully higher confidence.
How the Engine Works Under the Hood
The model architecture is straightforward but effective: an embedding layer maps raw byte values to learned vector representations, followed by an LSTM that processes sequences and captures temporal structure, and a final dense layer that collapses output to a single probability score. The embedding layer is the key differentiator. A byte value of 0x27 (apostrophe) sitting next to 0x4F 0x52 (OR) carries learned context about SQL injection patterns that pure frequency analysis would miss. The LSTM then recognizes the characteristic ordering of bytes that distinguishes attack payloads from legitimate traffic.
Inference is handled by LibML, which uses XNNPACK for hardware-accelerated matrix operations. On a 4.7 GHz AMD processor, a single classification pass completes in approximately 350 microseconds. From Secure Firewall 10.0.0 onward, SnortML automatically selects between models sized for 256, 512, or 1024 byte inputs based on actual query length. Short queries get the lighter model. Only longer, more complex requests go through full-sized inference. Queries exceeding 1024 bytes are truncated at that boundary.
The initial release in March 2024 targeted SQL injection. By late 2025, coverage expanded to XSS and command injection. Model updates arrive through Snort's Lightweight Security Package system, using the same channel as rule content, so operators do not need a separate update workflow.
The Limits of Per-Parameter Detection
SnortML is deliberately scoped. It inspects individual HTTP parameters. A single URI query string or POST body comes in, gets scored, and either triggers or does not. The model has no memory of what came before that request, or from the same source IP over the previous twenty minutes.
Consider a three-request attack chain: a probe to map input validation behavior, an enumeration request to identify injectable parameters, and finally the tailored exploit. Each request, viewed individually, might score below threshold. The third request is dangerous precisely because of the first two, and SnortML cannot see that relationship. Anything outside HTTP parameter space, DNS tunneling, TLS-layer attacks, SMB exploitation, non-HTTP protocol anomalies, also falls outside its scope entirely. The publish/subscribe architecture is protocol-agnostic, but trained models for other inspectors do not yet exist, and assembling labeled corpora for less-studied protocols is considerably harder than it was for HTTP.
Where Agentic AI Picks Up the Thread
This is where agentic AI enters the picture. While SnortML operates at the wire level, scoring individual payloads in under a millisecond, agentic systems operate at a higher abstraction layer where temporal context and cross-source correlation become the primary tools. An AI agent maintains state across a multi-step investigation. It decides what to examine next based on what it has already found, rather than following a predetermined playbook. It queries SIEMs for related events, looks up file hashes against threat intelligence platforms, pulls user activity from identity providers, and checks source IPs against BGP-level blacklists. Each lookup informs what comes next.
The commercial security industry has been building toward this for roughly two years. IBM launched ATOM, its Autonomous Threat Operations Machine, in April 2025. Trend Micro released its Agentic SIEM in August 2025. These are not chatbots with security knowledge attached. They are orchestration platforms where specialized agents divide investigation work and pass structured findings between each other. The pace of adoption makes sense when you look at the labor market: the global cybersecurity workforce gap sits around four million unfilled positions, and a 2025 survey found 82% of SOC analysts worried about missing real threats due to alert volume alone.
The Sensor Layer Becomes More Critical, Not Less
In an agentic architecture, Snort's output feeds an automated reasoning chain directly. False positives do not simply consume analyst attention. They burn agent compute cycles, fill investigation queues, and in misconfigured deployments can trigger automated containment actions. The accuracy requirements for the sensor layer go up.
SnortML's probabilistic output helps here. Because the classifier returns a float rather than a binary match, the agentic layer can incorporate that probability into its own confidence scoring. An alert combining a classical signature match with a 0.97 SnortML score gets routed very differently from one where only the ML fired at 0.61. The richer output gives downstream reasoning more to work with and makes threshold-based escalation logic more nuanced.
What Deployers Should Know Now
For teams running Snort 3 today, the operational advice is clear: start passive. SnortML's false positive rate is low but not zero. Running it inline with block-on-detection before understanding how it behaves against your specific traffic profile is a reliable way to cause production outages. Legitimate applications with unusual encoding, REST APIs passing data structures in query strings, or frameworks with non-standard escaping can all produce inputs that score above threshold without being malicious.
The right posture is to automate investigation heavily and automate response conservatively. Let agents handle triage, enrichment, correlation, and context assembly. Reserve final containment decisions for a human who has reviewed the agent's assembled context. Automation reduces the review time from hours to seconds; the human judgment step is what adds adversarial resilience.
The harder long-term problem is the feedback loop: confirmed incidents flowing back to improve both ML models and rule coverage, supervised by humans but executed automatically. A detection system that gets measurably better at catching what attackers actually do today, rather than cataloguing what they did a year ago, changes the economics of offense and defense in a meaningful way. The engineering work remaining is not about the sensor's detection capability. It is about the plumbing that connects what the sensor observes to the reasoning systems that can act on it intelligently, and the feedback path that turns those actions into a system that improves over time.