Behavioral intent: the attack signal that survives every evasion attempt Every security team eventually hits the same uncomfortable realization: the signals they rely on to detect malicious activity can be faked. IP addresses rotate. User-agent strings are trivial to spoof.