We're doing a story on how AI is specifically being used to fight cybersecurity threats. Specifically, we're looking to answer the three questions below as comprehensively as possible (the more detail you can provide, the better!):

1) What are the most effective and promising applications of AI in defensive cybersecurity today? Are we talking primarily about advanced anomaly detection, automated incident response, or something else?

2) This is often described as an "AI arms race." In your view, does AI fundamentally favor the offense or the defense in cybersecurity? What technological or strategic breakthroughs are needed for the defensive side to gain a more lasting advantage?

3) What are the inherent risks or blind spots of relying on AI for cyberdefense? For example, how vulnerable are defensive AI models themselves to adversarial attacks, and how can organizations mitigate the risk of over-reliance on these automated systems?

Question

We're doing a story on how AI is specifically being used to fight cybersecurity threats. Specifically, we're looking to answer the three questions below as comprehensively as possible (the more detail you can provide, the better!):

1) What are the most effective and promising applications of AI in defensive cybersecurity today? Are we talking primarily about advanced anomaly detection, automated incident response, or something else?

2) This is often described as an "AI arms race." In your view, does AI fundamentally favor the offense or the defense in cybersecurity? What technological or strategic breakthroughs are needed for the defensive side to gain a more lasting advantage?

3) What are the inherent risks or blind spots of relying on AI for cyberdefense? For example, how vulnerable are defensive AI models themselves to adversarial attacks, and how can organizations mitigate the risk of over-reliance on these automated systems?

Andrew Franks · Accepted Answer

AI has the most potential in defensive cybersecurity, most likely in the form of real-time anomaly detection, behavioural analysis, and automated triage. It provides cybersecurity teams the capabilities to detect more subtle deviations, which slip by standard rule-based systems, and respond to potential incidents more quickly. This is partly because it's often been described as an "AI arms race" and that attackers currently have a small advantage, as developing new offensive models can be more iterative and quicker than defensive ones, so AI applications would have to be better at predictive threat modelling, detection and prevention and require more sophisticated, self-healing architecture to allow a sustained defensive advantage. 
The dangers, however, are far greater. Defensive models can be targeted for poisoning and manipulation (either with adversarial inputs or simply through overreliance which degrades performance), and organisations run the risk of overvaluing automation and replacing human expertise. The best practice is for AI to be used as detection in cybersecurity in tandem with ongoing human oversight, model validation, and layered controls to provide multiple points of failure for an attacker.

Aaron Whittaker · Answer

AI can help with cyber defense, but the system itself becomes a target. Hackers can try to reverse-engineer it, like trying to copy how it works, pull sensitive information from its training data or feed it inputs that trick it into making the wrong call.  When organizations pull back on human supervision and depend mainly on automation, one wrong call from the AI can create a much bigger issue.

Mitigation starts with diversifying controls. To avoid overreliance, split the responsibilities and do not let one AI tool handle everything on its own. Make sure people still review high risk activity and have other detection methods active just in case the AI misses something. Continual testing, monitoring and watching for unusual behavior help keep the AI stable and trustworthy.

Finally the mindset around AI needs to evolve. Automation can help speed things up but it does not remove the need for trained responders and skilled threat hunters. People have to keep an eye on the full situation not rely solely on what the AI shows. And when the AI mislabels an alert human review and adjustment keep the defense system healthy.

Qianqian He · Answer

Hi,

I believe the "AI arms race" is not decided, slight advantage to offense right now,  AI allows for automated tested at scale, testing thousands of weak links  automation of phishing generation or toolkits by attackers in ways that defenders do not match real time at present. I witnessed this first-hand in a partner engagement in which new threat tools evolved more quickly than our defense models. For defense to get any more sustainable advantage we need breakthroughs in real-time adaptation, explainable AI, and much greater shared threat data collaboration amongst organizations so defensive models can learn transparently from attackers' tactics.

Best regards
Name: Qianqian He
Role: Founder
Company: BoxKing Gaming
URL: https://boxkinggaming.com/

Yosi Yahoudai · Answer

I think one area where people overlook the impact of AI tools in security is on the "human firewall" we all know is vulnerable. AI has helped us reduce the repetitive manual tasks like data entry, case logging, and document processing here at our firm. That's where you see those phishing attempts all the time. Fewer manual touchpoints mean fewer opportunities for someone to click on the wrong attachment or link. Personally, I think AI favors people who use it to work smarter, not just faster. It's like, "Sure you've produced more output, but is it any good?"
 
Another risk I see is organizational overconfidence. AI can support your security architecture, but it's not a substitute for smart policy, ongoing employee training, and a culture that takes security seriously. You still need people watching out for your systems and watching out for each other.

Hiren Shah · Answer

Hi,

Among the best applications of that I've seen in cybersecurity is using AI to spot things humans would miss   particularly odd behavior on a network. Instead of waiting for known threats, AI can be trained to understand what "normal" looks like and alert managers to small but suspicious changes such as an employee accessing sensitive files at odd hours or data being transferred in unexpected volumes.

have also experienced, it helping security teams manage that flood of alerts, mining through the noise to single out the ones that matter. In some cases, it can also lock down a device or user account before a human ever has to become involved.

I think for now AI is more weighed to the offensive side than the defense. On the offensive side, it is capable of automating and scaling attacks more rapidly than a lot of teams may be able to react. A hacker must find only one gap,  while defenders must protect everything, at all times. We're going to need AI that's more open and adaptable, not just reactive, if we want to level the playing field. We need more sharing between companies of threat data so defenses can get better quicker. Cybersecurity is not the sort of thing that should be a solo game.

The biggest risk I see is over trusting AI. Simply because something is smart doesn't mean it's always correct. Hackers can fool these models with carefully crafted input, and if teams depend only on automation they may not catch what is really happening. That is why it is important to keep high-quality people in the loop, to test the system frequently and to have backup tools. AI should be the friend of the defense, not its replacement. It's a tool, not a shield.

Best regards,

Name: Hiren Shah
Company: Anstrex
Role: Founder
URL: https://www.anstrex.com/

Will Melton · Answer

AI for cybersecurity has gotten good at spotting weird text like phishing attempts. In my work with AI SEO tools, we now catch AI-generated content used for social engineering, and our systems learn quickly. It's much faster than before with fewer false alarms. But you have to audit these systems. If attackers figure out how your AI thinks, they'll find a way around it.

Tom Terronez · Answer

Doing dental IT, I've found AI is most useful for catching threats in real time and isolating a device the moment it gets compromised. These AI systems flag privacy risks with medical equipment and patient records. Manual reviews just can't keep up with the volume of attacks we see now, so automation is essential. But we always tell clients to train their people, since smart attackers can fool AI and create security holes.

Alvin Poh · Answer

In my SaaS business, AI works best for handling security alerts and spotting weird account activity. It stops attackers from jumping between our systems. Our AI flags odd patterns way faster than the old methods. Attackers are getting smarter, but our tools keep up as long as we keep feeding them new data. You still need people to review things, or you'll miss the new, creative attacks.

Nathan Thorne · Answer

One of the most hopeful ways AI is being used in cyberdefense, though, is to learn what "normal" behavior on a network looks like and flag things that deviate from it. I have seen it flag up small but significant clues, like someone logging on at an unusual hour from a nonsense location or sudden high data transfers. That may not be enough to sound the alarms of a traditional system, but AI can catch these types of attacks early, sometimes before they have much real impact.

It's a game-changer in terms of sifting through the noise, too. Security teams receive a mountain of alerts on a daily basis, and AI can help determine what is imminent and even take initial actions, like isolating a device or freezing an account. That's particularly helpful for smaller teams that don't have the time or staff to manually catch everything. AI is not perfect, but it allows human experts the opportunity to be another step ahead of threats rather than playing perpetual catch-up.

Best regards,
Nathan Thorne,

Horticulturist and CEO of Handy Flowers

URL : https://www.handyflowers.co.uk/

LinkedIn : https://www.linkedin.com/in/nathan-thorne-4a17512b7/

Headshot: https://drive.google.com/file/d/1x9as6VQ33bonnvrt2K8sPYM3tNP6aoAL/view?usp=sharing

Alex Vasylenko · Answer

Currently, the best AI functionalities are Advanced Anomaly Detection and Automated Incident Response. They provide the scalability and rapid responses needed to defeat threats that bypass signature detection for zero-day attacks and targeted spear-phishing attacks.

Unfortunately, for now, the "AI arms race" is tilted in favor of offense. Attackers will employ AI to conduct hyper-efficient reconnaissance and generate polymorphic malware.

For defense to obtain a lasting asymmetric advantage, the future will look like AI-Native Infrastructure and Autonomous Self-Healing Systems, which will be true AI-embedded systems rather than tacked on after the fact. The opportunity is to achieve true Adversarial Robustness by training our models against evasion and poisoning attacks.

The underlying risk is over-reliance. We address this risk by requiring Human-in-the-Loop (HITL) governance and requiring Model Explainability (XAI) so that human judgment validates AI defense's speed.

Ben Mizes · Answer

One of the largest challenges I've observed with AI in cybersecurity is that these systems are often no more secure than the networks they're designed to defend. Hackers have discovered how to subtly manipulate inputs, like tweaking traffic patterns, or slightly changing the dimensions of a medical image, so the AI reads an entirely different threat. It can let bad things through or sound alarms over benign activity purely because the signals are designed to trick it.

Another problem is that AI frequently operates as a black box. It makes decisions without always providing a crisp explanation for why, which means that it can be difficult for human teams to determine when to take the system at its word and when they should push back. The risk is when companies begin relying too heavily on automation and stop asking questions. The best results come when AI is employed as a tool for human beings, not in place of them. That requires routine checkups, transparency and always having talented people in the loop.

Best regards,
Ben Mizes
CoFounder of Clever Offers
URL: https://cleveroffers.com/
LinkedIn: https://www.linkedin.com/in/benmizes/

6 Answers

Ben Mizes

Yosi Yahoudai

Alvin Poh

Tom Terronez

Andrew Franks

Aaron Whittaker

Related Questions