Artificial intelligence is reshaping cybersecurity, giving attackers new ways to identify vulnerabilities and scale their operations while enabling defenders to detect and respond to threats faster.
The challenge for organisations is to ensure their security capabilities keep pace with increasingly sophisticated, AI-enabled attacks.
Gartner notes that AI is transforming both attacker capabilities and defensive requirements, forcing organisations to adapt to faster, more scalable threats.
“Attackers are also using generative AI to help them work faster and more effectively, much like businesses use it to improve productivity,” emphasised Gartner in an article.
Fabio Fratucello, Field CTO, Worldwide at CrowdStrike, and Daryl Pereira, director and head of the Office of the CISO, JAPAC, Google Cloud, share insights on the evolving cybersecurity landscape and ways organisations can strengthen their defences.
AI-driven battleground
Cybersecurity is moving towards an AI-versus-AI environment, with attackers and defenders increasingly using AI to operate at machine speed.
Pereira cautions, however, against viewing today's landscape as a completely autonomous contest.
“Although I would be cautious about describing it as a completely autonomous AI-versus-AI environment today,” he said.
Nevertheless, AI is accelerating security operations and pressuring organisations to rethink how they detect and respond to threats.
“This accelerating pace has necessitated a strategic shift to an ‘AI Threat Defence’ model, moving security from a human-speed, passive detect-and-respond model to a machine-speed, proactive defence,” Pereira said.
Fratucello similarly advocates for security operations that can investigate multiple attack vectors simultaneously rather than sequentially.
“Modern security platforms must process massive datasets and coordinate responses across endpoints, identity systems, cloud environments, and networks at machine speed,” he said.
Who has the advantage?
“The key differentiator lies in combining real-world threat intelligence with AI capabilities that security teams can trust and control.” Fabio Fratucello
The key differentiator lies in combining real-world threat intelligence with AI capabilities that security teams can trust and control,”
As attackers and defenders deploy increasingly autonomous AI agents, the advantage will depend on more than automation alone.
Fratucello describes AI as a tool, target and force multiplier for attackers, highlighting the need for defenders to combine AI capabilities with reliable intelligence.
“The key differentiator lies in combining real-world threat intelligence with AI capabilities that security teams can trust and control,” he said.
The urgency is underscored by CrowdStrike’s 2026 Global Threat Report, which found that the fastest attack breakout time had fallen to 27 seconds. With autonomous AI agents, breakout times are approaching zero.
To counter this speed, security teams need AI that can analyse large datasets, investigate threats and respond with minimal delay.
“This speed advantage requires security teams to deploy AI capabilities that can reason over massive datasets and respond autonomously like experienced analysts,” Fratucello said.
Such capabilities must integrate context across security domains and coordinate actions throughout the security lifecycle, while retaining appropriate human oversight.
CrowdStrike advocates purpose-built security models and harnesses that combine offensive models, which anticipate attacker behaviour, with defensive models that protect against threats. These capabilities can strengthen security continuously, but their effectiveness depends on the intelligence and data supporting them.
“Models alone don't determine success. The harness — domain-specific threat intelligence and security data that specialises AI for cybersecurity use cases — provides the crucial advantage,” Fratucello said.
Pereira similarly emphasises the importance of the information available to security teams and how effectively they use it.
“The bigger differentiators will be data, intelligence, visibility and how effectively organisations can translate those into action,” he said.
This is where defenders have a potential advantage. While attackers can automate reconnaissance and vulnerability identification, defenders have access to detailed knowledge of their own systems, identities, data assets and normal activity.
By combining this internal context with external threat intelligence, organisations can build AI-native security systems with integrated data and visibility across their environments.
“The question is therefore not simply who can deploy the most autonomous AI. Greater autonomy also introduces risk. The advantage will go to organisations that can use AI quickly and effectively, aided by environmental context, while maintaining strong security controls and appropriate human oversight,” Pereira said.
“The bigger differentiators will be data, intelligence, visibility and how effectively organisations can translate those into action.” Daryl Pereira
The new human security analyst
As AI takes on more security tasks, the role of human analysts is shifting from manual investigation towards supervision, strategic decision-making and handling complex incidents.
Traditionally, analysts reviewed data across multiple tools, investigated alerts and identified potential threats. AI agents can now perform much of this time-consuming analytical and technical work, helping security teams improve their speed and efficiency, Fratucello said.
This shift reflects a broader evolution in security operations. Gartner describes security professionals as moving from manual operations towards AI-assisted and increasingly autonomous processes.
According to Craig Lawson, VP analyst at Gartner, AI, machine learning and advanced analytics are enabling security operations centres (SOCs) to operate with greater independence while retaining essential human oversight.
Gartner also predicts that 25% of common SOC tasks will become 50% more cost-efficient by 2027, driven by automation enhancements and hyperscaling strategies.
For Fratucello, this development represents an extension of human capabilities rather than a replacement for security professionals.
The future envisions humans and machines working together, complementing each other and leveraging their respective strengths. Fabio Fratucello
“The future envisions humans and machines working together, complementing each other and leveraging their respective strengths,” he said.
As AI handles repetitive investigations, analysts can focus on setting objectives, exercising judgment and retaining decision-making authority. They can also direct AI agents to investigate threats at machine speed.
“This collaborative approach enables organisations to combat accelerated threats with human judgment while operating at the speed only autonomous capabilities can deliver, resulting in faster and more intelligent security operations,” Fratucello said.
Pereira shares this view, describing the emerging model as an “Agentic SOC”, in which AI handles repetitive activities while human analysts concentrate on work requiring contextual understanding and judgment.
This includes interpreting an attacker's intent, assessing the implications of an incident for the organisation, prioritising risks and making decisions during complex security events.
The cybersecurity race
CISOs need to advise the business to approach AI from both directions: understanding how adversaries can use it to increase their speed and scale, while ensuring their own AI environments do not introduce unnecessary exposure. Daryl Pereira
For chief information security officers (CISOs), the challenge is twofold: prepare for adversaries using AI to increase the speed and scale of attacks, while ensuring their own AI deployments do not introduce new vulnerabilities.
Pereira recommends moving towards an AI-native security architecture supported by Google Cloud's four-step AI Threat Defence framework: Prepare, Scan, Remediate and Monitor.
The framework aims to help organisations strengthen resilience through greater visibility, threat intelligence and clear processes for prioritising threats.
However, adopting AI for defence also means securing the AI systems themselves.
Pereira warned that attackers are targeting AI ecosystems, highlighting the need for centralised governance to manage unmanaged agents and enforce security controls.
“CISOs need to advise the business to approach AI from both directions: understanding how adversaries can use it to increase their speed and scale, while ensuring their own AI environments do not introduce unnecessary exposure,” he said.
Fratucello likewise advocates an AI-native security approach that provides unified visibility and real-time protection across security domains.
“As AI adoption expands attack surfaces, strong governance, guardrails, and controls become essential,” he said.
Organisations must establish clear AI policies, monitor unauthorised AI use, assign trusted identities to agents, enforce access controls and data classification, and assess third-party security risks. Runtime protection can also help provide visibility into AI agents and enforce controls while they operate.
Ultimately, the goal is to balance AI adoption with the safeguards needed to prevent new capabilities from becoming new attack vectors.
AI vs AI
As AI transforms both cyberattacks and security operations, adopting more AI tools will not, on its own, give organisations an advantage.
They need an integrated strategy that combines threat intelligence, automated response, visibility across their environments, strong governance and human oversight.
