One of the more fascinating moments of the 2026 FIFA World Cup may ultimately have less to do with football than with AI. During the United States' Round of 32 match against Bosnia and Herzegovina, forward Folarin Balogun was shown a straight red card following review by the Video Assistant Referee (VAR). The dismissal immediately became one of the tournament's most debated officiating decisions – at least in the USA.
And then, seemingly right after, there was a literal hair raising VAR call -- the Croatia seemingly hair-triggered ball-sensor offsides VAR call that entirely changed the outcome of a knockout match.
While technology had been brought into the process to improve accuracy, many of the game's most experienced observers -- including former players, coaches, and referees -- looked at the same replays and reached remarkably different conclusions.On the Balogun call, their view was not that the challenge deserved no punishment, but that the circumstances surrounding the play did not justify the game's harshest disciplinary action.
On the Croatia seemingly hair follicle that ticked the ball sensor, people considered the art of dealing with false positives. Could a mosquito getting whacked by a ball trigger the appearance of a human ball contact?
Hey, Rocky the Raptor here, RPost’s cybersecurity product evangelist. I feel whether history ultimately judges the referee's decisions as correct is almost beside the point now. These incidents highlighted something far more relevant to those of us who deal with cybersecurity, AI, and enterprise risk constantly.
For decades, sports organizations have sought to reduce human error through technology. Goal-line technology answered a relatively simple question: Did the ball cross the line? And the answer was always binary - either it did, or it didn't. Technology performs extraordinarily well when the question being asked is objective and measurable.
VAR, however, has introduced a much more complicated challenge. It attempts to assist officials not only in determining what occurred, but also in evaluating what the event means within the broader context of the game. Was the Balogun contact reckless? Was there intent? Did the player's momentum make the collision unavoidable? Was there an opportunity to avoid it? These questions are inherently contextual, and context is often difficult to reconstruct from video alone.
Slow-motion replay, while technically precise, illustrates this challenge perfectly. A collision that takes place in a fraction of a second suddenly unfolds over several seconds. Incidental contact appears prolonged. Natural athletic movement begins to look deliberate. The replay faithfully records every frame, yet the very process of slowing time can alter our perception of what actually happened.
The technology has not lied; it has simply presented facts without the entire context required to interpret them correctly.
On the Croatia example, could it be possible that there was a false positive sensor interaction? A mosquito hit the ball, or a flying bead of sweat 😉? And if a flying bead of sweat, whose sweat? Croatian perspiration or Portugal salty water?
AI has become extraordinarily effective at identifying patterns across enormous volumes of information. Modern security platforms can recognize anomalous login behavior, suspicious document access, unusual network traffic, and subtle deviations that no human analyst could reasonably detect at scale. This capability has transformed enterprise security operations, yet organizations are beginning to discover that identifying an anomaly is only the beginning of the analytical process.
Consider a few ordinary examples. An employee downloads several thousand files in a single afternoon, an executive suddenly authenticates from an unfamiliar geographic location, a trusted supplier accesses confidential documents during unusual hours, or an invoice approval workflow suddenly accelerates compared to historical patterns.
Each of these events might indicate malicious activity or have a legitimate explanation. But the distinction cannot always be derived from the observable event itself. It always depends upon the context.
One of the unintended consequences of increasingly sophisticated AI is that its conclusions often appear more authoritative than they actually are. Confidence scores, visual dashboards, behavioral models, and probability rankings naturally encourage humans to believe that the underlying conclusion must also be correct. We are inclined to assume that because AI evaluated millions of variables, it has somehow eliminated uncertainty. In reality, uncertainty rarely disappears; it simply moves to a different layer of the problem.
Cybercriminals understand this remarkably well. Increasingly, they invest less effort in defeating security systems and more effort in blending into them. Modern attacks rarely begin with noisy malware or brute-force intrusion attempts. Instead, attackers spend weeks or months conducting reconnaissance, emulating legitimate devices, routing activity through residential networks, cloud providers, virtual private servers, and trusted infrastructure. They intentionally behave in ways that appear ordinary because they know both humans and AI systems are naturally inclined to trust what looks familiar.
This is precisely why context has become one of the most valuable forms of intelligence in modern cybersecurity.
Many of the investigations conducted using RPost's RAPTOR™ AI illustrate this principle repeatedly. Individual observations often appear unremarkable when viewed in isolation, such as a document accessed through what appears to be a legitimate cloud provider, a sequence of opens from infrastructure commonly associated with content delivery networks, or a device fingerprint that closely resembles a mainstream mobile platform. None of these signals alone establishes malicious intent.
However, when those same observations are examined alongside interaction history, infrastructure attribution, behavioral consistency, timing, recipient relationships, and post-delivery activity, a far more complete picture begins to emerge. It is rarely one signal that exposes the threat, but the accumulation of context surrounding many seemingly ordinary signals.
That may ultimately be the most important lesson from the World Cup incident. The experienced commentators were not necessarily seeing a different video than the officials reviewing VAR. They were bringing decades of accumulated understanding about player movement, body mechanics, match tempo, and football itself. They instinctively evaluated factors that no replay, regardless of its resolution, could fully capture. Technology supplied the evidence, and experience supplied the interpretation.
The same partnership will define the future of enterprise AI. AI will continue to become better at discovering relationships, identifying anomalies, and surfacing patterns that humans would otherwise miss. That capability is indispensable as organizations confront increasingly sophisticated AI-assisted cybercrimes. Yet the objective should not be to remove human judgment from the decision-making process; rather, it should be to enrich human judgment with observations that would otherwise remain invisible.
This philosophy increasingly underpins the next generation of cybersecurity platforms. The goal is no longer simply to detect activity, but to understand the significance of that activity within the broader operational context of the business. Build a context model that minimizes false positives. That requires combining machine-scale analysis with contextual intelligence derived from behavior, relationships, infrastructure, historical interactions, and business process understanding. This is where RPost’s RAPTOR™ AI sets itself apart.
In many aspects, this represents the next evolution of AI itself. The first generation helped us process information more efficiently, so the next generation must help us interpret information more accurately.
The debate surrounding Balogun's red card or the Croatian sweat bead or hair triggered ball sensor will eventually fade into football history, replaced by the next controversial VAR decision. The broader lesson, however, extends well beyond sport. Whether we are officiating a World Cup match or defending a multinational enterprise, observation alone is rarely enough. Facts and precision matter, and context built into technology - that matters enormously.
Context remains the difference between seeing what happened and understanding what it means. As AI becomes increasingly central to enterprise decision-making, organizations would do well to remember that distinction. AI can reveal signals that humans might never notice, while building context into the AI models will remain essential to determining which of those signals truly matter.
In both football and cybersecurity, context models may be the difference between making the right call and confidently making the wrong one. Contact us to learn more about RPost’s RAPTOR™ AI preemptive cybersecurity and context models.
July 03, 2026
June 26, 2026
June 19, 2026
June 12, 2026
June 05, 2026
Blog
