Cybersecurity has entered a phase where artificial intelligence serves both as a tool for defenders and a weapon for attackers.
AI lets both attackers and defenders analyse data, identify vulnerabilities, and act quickly, creating a fast-evolving race for advantage.
The challenge is not just adopting AI, but ensuring security defences evolve as quickly as emerging threats.
Gartner notes that AI is transforming both attacker capabilities and defensive requirements, forcing organisations to adapt to faster, more scalable threats.
“Attackers are also using generative AI to help them work faster and more effectively, much like businesses use it to improve productivity,” emphasised Gartner in an article.
Fabio Fratucello, Field CTO, Worldwide at CrowdStrike, shares insights on the evolving cybersecurity landscape and ways organisations can strengthen their defences.
AI-driven battleground
“The key differentiator lies in combining real-world threat intelligence with AI capabilities that security teams can trust and control.” Fabio Fratucello
Fratucello advises organisations to invest in security operations that investigate multiple attack vectors simultaneously, rather than sequentially, to address AI-driven threats.
“Modern security platforms must process massive datasets and coordinate responses across endpoints, identity systems, cloud environments, and networks at machine speed. The key differentiator lies in combining real-world threat intelligence with AI capabilities that security teams can trust and control,” he said.
He noted that AI has significantly reduced the time between vulnerability discovery and exploitation.
The company’s 2026 Global Threat Report found the fastest attack breakout time has dropped to 27 seconds. With autonomous AI agents, breakout times are approaching zero.
“This speed advantage requires security teams to deploy AI capabilities that can reason over massive datasets and respond autonomously like experienced analysts,” he said.
AI agents should integrate context across security domains, reason dynamically, and act at machine speed while maintaining human oversight.
Security teams must coordinate these agents across the security lifecycle to ensure cohesive operations.
Who has the advantage?
Models alone don't determine success. Fabio Fratucello
A greater challenge emerges asboth attackers and defenders deploy more autonomous AI agents.
Fratucello recognises that “AI is a tool, target, and force multiplier for attackers.”
CrowdStrike recommends purpose-built security models and harnesses to give defenders an AI advantage. These unified platforms combine offensive models that anticipate attacker behaviour with defensive models that protect against threats.
These models work together to improve and strengthen defences continuously.
“Models alone don't determine success. The harness - domain-specific threat intelligence and security data that specialises AI for cybersecurity use cases - provides the crucial advantage,” he emphasised.
The new human security analyst
In today’s AI-driven cybersecurity environment, the role of human security analysts is evolving.
Traditionally, security analysts manually reviewed data across multiple tools, investigated alerts, and identified potential threats. AI is now transforming much of this work. Fratucello said AI agents can handle much of the analysis and technical investigation, helping security teams improve both speed and effectiveness.
This shift reflects the broader evolution of security operations. Gartner describes security professionals as moving from manual operations toward AI-assisted and increasingly autonomous processes.
According to Craig Lawson, VP analyst at Gartner, AI, machine learning and advanced analytics are enabling security operations centres (SOCs) to operate with greater independence while maintaining essential human oversight for adaptive cybersecurity.
Gartner also predicts that 25% of common SOC tasks will become 50% more cost-efficient by 2027, driven by automation enhancements and hyperscaling strategies.
Rather than replacing skilled security professionals, Fratucello sees AI agents as tools that extend their capabilities.
“The future envisions humans and machines working together, complementing each other and leveraging their respective strengths,” Fratucello shared.
As AI takes on more time-intensive investigative work, analysts will focus on setting objectives, exercising judgment, and retaining decision-making authority, while deploying expert-trained AI agents to investigate at machine speed.
This collaborative approach enables organisations to combat accelerated threats with human judgment while operating at the speed only autonomous capabilities can deliver, resulting in faster and more intelligent security operations,” the CrowdStrike executive shared.
The cybersecurity race
“Success requires balancing AI innovation with comprehensive security frameworks.” Fabio Fratucello
“AI is reshaping both business innovation and the attack surface, empowering attackers through enhanced speed and scale,” Fratucello said.
He advises organisations to adopt an AI-native security approach that offers unified visibility and real-time protection across all domains to prevent breaches before they escalate.
“As AI adoption expands attack surfaces, strong governance, guardrails, and controls become essential,” he reminded Chief Security Officers.
Runtime protection provides the optimal point for complete visibility and enforcement controls when securing AI agents during execution.
He also noted that organisations must establish clear AI policies, monitor for unauthorised AI use, assign trusted identities to each agent, ensure continuous authorisation, enforce robust access controls and data classification, and rigorously assess third-party security risks.
He concluded: “Success requires balancing AI innovation with comprehensive security frameworks.”
AI vs AI
As AI continues to reshape the attack surface and security operations, organisations must move beyond simply adopting AI tools.
They need an AI security strategy that integrates threat intelligence, autonomous capabilities, real-time visibility, and human oversight across the security lifecycle.
The emerging AI-versus-AI environment makes speed essential, but speed alone is not enough.
Organisations must combine analysis and response with intelligence, governance, and human decision-making to manage increasing threats.
