Akamai uses machine learning models in its Akamai Hunt service to automatically detect suspicious movement of attackers through customers' internal networks, surfacing threats that evade traditional security tools. Human security experts then investigate each flagged event before alerting the customer.

Akamai Hunt applies two types of machine learning models: graph neural networks (GNNs) that learn normal patterns of how network assets connect to each other and flag anomalous connections, and TF-IDF analysis that identifies suspicious processes spreading unusually across systems. The service collects telemetry from Akamai Guardicore Segmentation deployments and Akamai's global DNS sensors, and applies AI/ML analysis to these combined data sources. Human security analysts validate findings before alerts are sent to customers.