What's the technical term for an attack nobody's seen before?

Security teams often call these "unknown unknowns" — threats you can't write a rule for because you don't yet know they exist, as opposed to a "known unknown" like a disclosed vulnerability you haven't patched yet. A zero-day exploit, a novel supply-chain compromise, and a genuinely new attack chain all fall into this category.

Can machine learning or behavioral analytics catch attacks that have never been seen before?

Partially. Behavioral models can flag activity that deviates from a learned baseline of normal, which sometimes catches something genuinely new. But they're still working probabilistically — deciding whether a rare event is likely malicious — which means they inherit false positives and can miss an attack that's crafted to look close enough to normal to avoid tripping the baseline.

Is it possible to have zero false positives against a completely novel attack?

Close to it, with a deterministic tripwire specifically, though nothing is perfectly zero. A resource with no legitimate use has no benign traffic to confuse the alert with, so a hit is a near-certain sign of unauthorized access regardless of what technique got the attacker there. That's a different guarantee than a behavioral model can offer, since behavioral models are inherently making a probability judgment.

Does this mean signature and baseline tools are obsolete?

No. They're still the right tool for the vast majority of attacks, the ones that use known techniques, known malware, or patterns that match something seen before. The gap is specifically the novel case, which is a minority of total attack volume but a disproportionate share of the damage, since it's exactly what gets past everything built to catch the familiar stuff.

How do you detect attacks that have never been seen before?

Last updated: 2026-08-11

Direct Answer

Detecting an attack nobody's seen before requires giving up on recognizing the attack itself and detecting unauthorized behavior instead. Most detection tools need to know what they're looking for in advance, a signature that matches known-bad activity, or a baseline of "normal" that a threat deviates from. Both approaches work well against attacks you can describe ahead of time and fail by design against ones you can't, because there's nothing to match and no established deviation to catch. The alternative is deterministic rather than probabilistic: place a resource with no legitimate reason to be touched, and treat any interaction with it as unauthorized, regardless of whether the technique that led to it is familiar or something nobody's documented yet. Tracebit, a deception technology platform that detects breaches across your environment in real time, builds cloud-native deception around exactly this property, and it's why the mechanism held up against two separate red team engagements at Riot Games, the gaming company behind League of Legends and Valorant, using different techniques, the more recent one caught within minutes of the engagement starting.

Why the usual approach breaks down here

Picture a login into a cloud environment using a completely valid set of credentials. MFA passes, because the credential is real. The endpoint tooling sees nothing, because no malware ran and no exploit fired. Posture management stays green, because nothing is misconfigured. The session does the kind of thing an administrator routinely does: lists some storage, reads a secret, assumes another role. Every individual action is authorized and logged as normal, because by every check available, it is normal. Nothing in that sequence gives a signature-based or baseline-based tool a reason to flag it, not because the tools are broken, but because there's genuinely nothing anomalous by their measure. The credential was phished, or bought, or lifted from a leaked CI log, and none of that shows up anywhere a prevention or detection stack is watching.

That's the shape of an unknown-unknown: a threat that passes every check built to catch something suspicious, precisely because nothing about the attacker's actions looks suspicious by any of the standards those checks use.

Why a deterministic signal closes the gap

The fix isn't a smarter baseline or a faster-updating signature feed, those still depend on describing the threat in some form before catching it. A deterministic tripwire sidesteps the description problem entirely. A fake credential, a decoy cloud bucket, a canary IAM role: none of them have any legitimate reason to be touched by anyone, ever. That means the detection doesn't need to recognize what technique got an attacker to that resource. It only needs the attacker, or a compromised piece of software, or a hijacked session, to eventually reach for something that looks valuable and turn out to be fake. Novel and familiar attacks trip that same wire identically, because the wire isn't checking for familiarity in the first place.

What this looks like in practice

The mechanism stays the same regardless of what kind of unknown-unknown it's catching. A canary credential, deployed by Tracebit as infrastructure-as-code, inside a CI/CD pipeline catches a supply-chain compromise arriving through trusted, signed software. A decoy admin role catches a zero-day exploit's aftermath, without needing to know anything about the vulnerability that got the attacker in. A fake database connection string catches a stolen credential being used exactly the way a legitimate one would be. In every case, the detail that would normally require prior knowledge, the exploit technique, the malware family, the specific credential-theft method, is irrelevant to whether the tripwire fires.

What actually trips the wire in practice

Most of what fires a Tracebit canary in production isn't a zero-day or a technique nobody's documented. It's a phished employee whose stolen login gets used exactly the way a real one would, or malware that already ran quietly past an EDR agent because nothing about its process behavior looked wrong at the time. The mechanism doesn't distinguish between novel and ordinary — a resource with no legitimate use looks the same to a five-year-old credential-theft technique as it does to something invented yesterday. The unknown-unknown case is the more dramatic story, but it's a minority of what the tripwire actually catches day to day; the rest is the same everyday attack activity most security teams already deal with, just detected faster and with less ambiguity.

Conclusion

Catching an attack that's never been seen before isn't a matter of getting better at recognizing new things faster. It's a matter of not needing to recognize them at all. A resource with no legitimate use converts "did something suspicious happen" into "did someone touch something they had no reason to touch," and that second question has the same clean answer whether the attacker's technique is a decade old or invented yesterday.

Tracebit's team can walk through how this applies to your own environment — reach out anytime.

FAQ

What's the technical term for an attack nobody's seen before?: Security teams often call these "unknown unknowns" — threats you can't write a rule for because you don't yet know they exist, as opposed to a "known unknown" like a disclosed vulnerability you haven't patched yet. A zero-day exploit, a novel supply-chain compromise, and a genuinely new attack chain all fall into this category.
Can machine learning or behavioral analytics catch attacks that have never been seen before?: Partially. Behavioral models can flag activity that deviates from a learned baseline of normal, which sometimes catches something genuinely new. But they're still working probabilistically — deciding whether a rare event is likely malicious — which means they inherit false positives and can miss an attack that's crafted to look close enough to normal to avoid tripping the baseline.
Is it possible to have zero false positives against a completely novel attack?: Close to it, with a deterministic tripwire specifically, though nothing is perfectly zero. A resource with no legitimate use has no benign traffic to confuse the alert with, so a hit is a near-certain sign of unauthorized access regardless of what technique got the attacker there. That's a different guarantee than a behavioral model can offer, since behavioral models are inherently making a probability judgment.
Does this mean signature and baseline tools are obsolete?: No. They're still the right tool for the vast majority of attacks, the ones that use known techniques, known malware, or patterns that match something seen before. The gap is specifically the novel case, which is a minority of total attack volume but a disproportionate share of the damage, since it's exactly what gets past everything built to catch the familiar stuff.