AI in Cybersecurity: What Security Leaders Actually Need to Know
Dozens of experts weigh in on how artificial intelligence is reshaping both offense and defense — and why the gap between the two may be widening faster than policy can close it.
Artificial intelligence has moved from conference keynote abstraction to operational reality on both sides of the threat equation. Defenders use it. Attackers use it. The question security leaders now face is not whether AI matters to their programs, but how fast the asymmetry compounds.
The offense-side gains are real and documented. AI lowers the skill floor for phishing generation, accelerates vulnerability research, and enables more convincing social engineering at scale. None of that requires nation-state resources anymore.
Defense has its own gains. Anomaly detection, automated triage, and behavioral analysis all benefit from machine learning pipelines — when they are tuned correctly and fed quality data. Bad training data produces confident, wrong answers. That failure mode carries operational consequences.
The policy gap here is not trivial. NIST's AI Risk Management Framework, finalized in January 2023, offers a voluntary governance structure for AI systems broadly, but it does not carry enforcement weight in the security context. CISA has published guidance on AI and critical infrastructure, and the Biden-era Executive Order 14110 directed agencies to develop sector-specific AI safety standards — work the current administration has partially unwound or deprioritized.
The EU AI Act, which entered force in August 2024, applies risk-tiered obligations to AI systems deployed in the Union, including certain security tools. Organizations operating across jurisdictions need to track which of their AI-assisted security products qualify as "high-risk" under Annex III of that regulation. That classification carries conformity assessment requirements that are not optional.
SEC disclosure obligations add another layer. The Commission's cybersecurity disclosure rules — effective for most registrants since December 2023 under 17 C.F.R. § 229.106 — require material incident disclosure and annual reporting on risk management processes. If an AI system causes or materially worsens a breach, the adequacy of that system's governance is a disclosure question, not just a technical one.
What the expert consensus seems to land on: AI amplifies whatever posture an organization already has. Strong detection pipelines get sharper. Neglected ones produce faster, more confident noise. The technology does not fix organizational debt. It accelerates it.
Security leaders who treat AI adoption as a procurement decision — rather than a governance and risk management decision — will likely find themselves explaining that distinction to a regulator.
