AI in Cybersecurity: What Security Leaders Actually Need to Know
What dozens of experts say security leaders need to understand now about AI on both sides of the threat equation, and why governance is lagging further behind than most programs can afford.
Key points
- AI lowers the skill floor for attackers and sharpens detection for defenders, but only when defenders feed their systems quality data.
- NIST's AI Risk Management Framework, finalized in January 2023, is voluntary and carries no enforcement weight in the security context.
- The EU AI Act, in force since August 2024, imposes risk-tiered obligations on AI systems deployed in the Union, including certain security tools.
- SEC cybersecurity disclosure rules require registrants to report material incidents and describe risk management processes annually; AI-related failures are squarely within scope.
- Organizations treating AI adoption as a procurement decision rather than a governance one are building the regulator conversation into their future.
Does AI actually change the offense-defense balance?
It does, and not symmetrically. Offense gains are concrete: AI makes phishing faster to produce, vulnerability research quicker to run, and social engineering more convincing at scale, without requiring nation-state budgets. Defense gains are real too, with anomaly detection and behavioral analysis both improving under machine learning pipelines. The catch is data quality. Bad training data produces confident, wrong answers, and in security operations that failure mode has real consequences.
What's the policy situation right now?
Fragmented, and that's the most charitable reading. NIST's AI Risk Management Framework offers voluntary governance guidance but doesn't compel anything in the security context. CISA has published guidance on AI and critical infrastructure. Biden-era executive action directed agencies toward sector-specific AI safety standards, work the current administration has partially deprioritized.
The EU AI Act is the sharpest instrument in play. Organizations deploying AI-assisted security products in the Union need to determine whether those products qualify as high-risk under the regulation's annexes, a classification that brings conformity assessment requirements that aren't optional. We examined how unsanctioned AI tools complicate exactly this kind of compliance mapping in our May report on shadow AI.
On the disclosure side, the SEC's cybersecurity rules, effective for most registrants since December 2023, require material incident disclosure and annual risk management reporting. If an AI system causes or materially worsens a breach, the governance of that system becomes a disclosure question.
Should you worry about the governance gap?
Yes, but not because AI is uniquely dangerous. Worry because AI accelerates whatever posture an organization already has. Strong detection pipelines get sharper. Neglected ones produce faster, more confident noise. The technology doesn't fix organizational debt; it compounds it.
The thing worth watching here isn't the next AI capability announcement. It's whether your governance documentation would satisfy a regulator who just read your incident report. Most programs aren't there yet, and the rules are tightening.
