There’s a specific, counterintuitive finding in antibiotic resistance research: bacteria exposed to a dose too low to kill them outright don’t just develop resistance more slowly than bacteria hit with a full lethal dose — they can develop it faster, and through a genuinely different evolutionary strategy. Cybersecurity has its own well-documented version of exactly this insight: attackers who deliberately stay below the thresholds that trigger a full security response, avoiding anything that looks like an obvious, detectable payload, tend to succeed not through one dramatic move but through a chain of many small, individually unremarkable ones. Both fields, independently, discovered the same non-obvious lesson about what staying under a threshold actually does to strategy.
Scientific Foundation
Research led by Dan Andersson and collaborators has established that selecting bacteria below the minimum inhibitory concentration, the sub-lethal dose too weak to kill susceptible cells outright, produces resistance through mechanisms genuinely different from those seen under lethal, above-MIC selection, not merely a slower version of the same process. Under lethal selection, resistance typically emerges through rare mutations of large individual effect, strong enough on their own to survive a dose that kills everything else. Under sub-lethal selection, the picture shifts: researchers find higher rates of resistant-mutant emergence driven by common mutations of small individual effect, strong enrichment for “mutator” bacterial strains carrying an elevated overall mutation rate, and — the most precise and striking finding — resistance built from multiple distinct mechanisms operating together rather than one dominant genetic change. In one documented case using Salmonella exposed to streptomycin, lethal selection produced resistance exclusively through mutations in a single gene affecting the ribosomal drug target. Sub-lethal selection, by contrast, produced high-level resistance through three separate mechanisms combined: alteration of the ribosomal target, reduced drug uptake into the cell, and induction of an enzyme that chemically modifies the antibiotic itself — a distributed, multi-component strategy assembled from several individually modest changes, rather than one large, decisive one.
Cross-Domain Connection
Living off the land, or LOTL, describes a well-documented and increasingly prominent class of cyberattack in which intruders deliberately avoid deploying any new, custom malware at all. Instead, they abuse tools already installed and trusted on the target system — PowerShell, Windows Management Instrumentation, native command-line utilities, Microsoft-signed binaries — specifically because security tools calibrated to flag unfamiliar executables have no signature to match against something the system’s own administrators use every day. CISA’s own guidance describes red teams “frequently” using these techniques with “network defenders rarely finding their activity.” And the structural detail that matters most for this comparison: LOTL intrusions characteristically chain multiple different legitimate tools together across the full lifecycle of an attack, using one native binary for discovery, a different one for lateral movement, another for privilege escalation, and yet another for clearing logs and evading detection — rather than relying on a single large, obvious malicious action that would itself risk crossing a threshold that triggers a full incident response.
What Remains Undemonstrated
The precise, non-obvious finding both fields converge on is the same: staying below a critical threshold, whether that’s a lethal antibiotic concentration or a detection-triggering anomaly score, doesn’t just slow the underlying adaptive process down. It specifically reshapes the strategy that succeeds, favoring many small, individually tolerable actions combined over one large, decisive action that would itself risk crossing the very threshold being avoided. Sub-lethal antibiotic exposure selects specifically for bacteria that assemble resistance out of several modest genetic changes rather than betting everything on one large mutation; LOTL intrusions succeed specifically by assembling an attack out of several individually unremarkable, already-trusted actions rather than betting everything on one custom malicious payload. It’s worth being honest about a real difference in how each system arrives at that shared strategic logic, though. Bacterial resistance evolution remains a blind, generational process, playing out across many rounds of bacterial reproduction, hours to days in real time but still genuine mutation-and-selection cycling, with no organism anywhere planning ahead or understanding the concentration threshold it’s operating under. A LOTL attacker, human or automated, understands the detection threshold explicitly and in advance, and deliberately designs a distributed, multi-tool strategy from the outset specifically to stay under it — a fully conscious tactical choice, not a strategy that emerged through blind trial and differential survival across generations.
Why It Matters
Recognizing that shared strategic logic matters for how each field designs its countermeasures. Antibiotic stewardship guidelines increasingly account for the finding that under-dosing isn’t simply a weaker version of full treatment — it can actively select for a more complex, harder-to-reverse form of resistance, which is part of why medical guidance emphasizes completing a full course at an adequate dose rather than tapering off early. Security teams have reached an analogous conclusion about detection strategy: systems built to flag single large anomalies are structurally blind to exactly the kind of distributed, individually-innocuous-looking activity both bacteria and attackers converge on once a hard threshold is in play, which is precisely why modern LOTL detection research has moved toward analyzing chains and sequences of activity over time, rather than scoring any single action in isolation — a direct, practical echo of the same lesson: if the threshold itself shapes what strategy wins, the defense has to watch for the strategy, not just the threshold-crossing event that a well-adapted adversary, biological or human, has already learned to avoid.
Human Dimension
There’s something worth sitting with in the fact that a bacterium with no capacity for planning and a security researcher’s most sophisticated human adversary arrived at recognizably the same insight from opposite directions. Neither the bacterium nor the intruder invented the strategy from first principles in the sense of understanding why it works — the bacterium simply survived because that combination of small changes happened to work under those specific conditions, replicated across enough generations to become the dominant outcome. The attacker, unlike the bacterium, actually does understand why it works, has read the same detection research the defenders have, and built the strategy on purpose. Both end up in the same place regardless: staying just under the line that would trigger a decisive response turns out to reward not a smaller version of a bold move, but a genuinely different kind of move altogether.
Sources:
1. Dan I. Andersson, UCSB Kavli Institute for Theoretical Physics — “Evolution of antibiotic resistance at sub-MIC” — https://online.kitp.ucsb.edu/online////////superbugs14/andersson2/pdf/Andersson2_Superbugs14_KITP.pdf
2. PMC (National Institutes of Health) — “Evolution of high-level resistance during low-level antibiotic exposure” — https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5913237/
3. biorxiv — “The evolution of no-cost resistance at sub-MIC concentrations of streptomycin in Streptomyces coelicolor” — https://www.biorxiv.org/content/10.1101/062414.full.pdf
4. PMC (National Institutes of Health) — “Need for standardization in sub-lethal antibiotics research” — https://pmc.ncbi.nlm.nih.gov/articles/PMC10768063/
5. ScienceDirect — “Resistance elicited by sub-lethal concentrations of ampicillin is partially mediated by quorum sensing in Pseudomonas aeruginosa” — https://www.sciencedirect.com/science/article/pii/S0160412021002440
6. PLOS Pathogens — “Bacteria primed by antimicrobial peptides develop tolerance and persist” — https://journals.plos.org/plospathogens/article?id=10.1371%2Fjournal.ppat.1009443
7. SecurityScorecard — “Living Off the Land Attacks Explained” — https://securityscorecard.com/blog/living-off-the-land-attacks-explained/
8. SentinelOne — “Living Off the Land (LOTL) Attacks: Detection and Prevention Guide” — https://www.sentinelone.com/cybersecurity-101/endpoint-security/living-off-the-land/
9. Vectra AI — “Living off the land: How attackers hide in legitimate tools” — https://www.vectra.ai/topics/living-off-the-land
10. Springer Nature Link — “Lotldetector: living off the land attacks detection system based on feature fusion” — https://link.springer.com/article/10.1186/s42400-025-00531-w
11. ScienceDirect — “LOTL-hunter: Detecting multi-stage living-off-the-land attacks in cyber-physical systems using decision fusion techniques with digital twins” — https://www.sciencedirect.com/science/article/pii/S0167739X26000166
Idea originated at artificialideas.org. Article researched and written by Claude Sonnet 5. Published at artificialideas.org.
