Every AI Appreciation Day tends to focus on the same themes: productivity, creativity and automation. Those advances deserve recognition, but in cybersecurity, AI’s biggest contribution is shifting how the industry works.
Across identity, infrastructure, application security, incident response and data protection, AI is forcing organizations to rethink decades-old assumptions about how they defend themselves. At the same time, it’s creating entirely new risks that demand equally new approaches. Appreciating AI means acknowledging both realities.
AI is accelerating both attackers and defenders
One of AI’s greatest strengths is speed. Security researchers can uncover vulnerabilities faster than ever before, while defenders can analyze enormous amounts of telemetry in seconds rather than hours.
Unfortunately, attackers have gained the same advantage. As Dhruv Majumdar, VP of Security Solutions at Fleet Device Management, explains, the window between discovering a vulnerability and seeing it exploited continues to shrink.
“AI is helping security researchers uncover vulnerabilities faster than ever before, but it’s also accelerating the speed at which those same weaknesses can be exploited, from days to hours.”
AI still needs human judgment
For all its capabilities, AI remains fundamentally limited in one critical area: context. Security teams increasingly recognize that automation alone cannot replace human expertise.
Gunter Ollmann, CTO at Cobalt, points to recent research showing that automated security tools continue to miss important vulnerabilities despite dramatic improvements in AI.
“Context still matters.”
AI isn’t replacing cybersecurity professionals. It’s changing what expertise looks like.
Much of the public conversation around AI still centers on job displacement. Cybersecurity tells a different story. Rather than replacing practitioners, AI is reshaping the skills security professionals need to succeed.
Laurent Halimi, CEO and founder of Cyberr, believes AI knowledge is quickly becoming part of the baseline cybersecurity skillset.
“Cybersecurity professionals who invest in AI skills today will likely be the ones leading security teams tomorrow.”
Identity becomes more complicated when humans aren’t the only users
As organizations deploy AI agents capable of making decisions and taking autonomous actions, identity itself becomes more complex. According to Bojan Simic, CEO and co-founder of HYPR, enterprises can no longer think solely about authenticating human users. Instead, they must establish trustworthy identities for non-human actors.
“If you can’t answer exactly who an agent is acting on behalf of, what its boundaries are, and how to stop it in real time, you don’t have a policy.”
AI failures are becoming business incidents
For years, organizations discussed AI primarily through the lens of governance. Today, resilience is becoming just as important. As AI becomes embedded across customer service, healthcare and software development, failures no longer remain isolated technology issues. They become operational crises.
Arvind Parthasarathi, CEO and founder of CYGNVS, notes that organizations increasingly need coordinated response plans when AI systems hallucinate, leak sensitive information or autonomous agents behave unpredictably.
“When an AI agent misbehaves, organizations need to activate a cross-functional machinery spanning IT, security, legal, executives, as well as external providers like law firms.”
Data quality determines AI quality
While much of the industry celebrates increasingly sophisticated models, Amit Shuster, VP of Product and Engineering at Vetric, argues that organizations often overlook the foundation beneath them.
“The real workhorse of the AI era is the data underneath them.”
AI understands a lot…but not everything
AI is also transforming what security technology itself can accomplish. For decades, many defensive tools depended on rules, signatures and pattern matching.
Those approaches detected activity but rarely understood its significance.
Roi Vanunu, Director of Product Management at Jazz, believes modern AI fundamentally changes that equation.
“For the first time, it’s possible to build security tools that don’t just detect; they understand.”
Appreciation should come with realism
Perhaps the healthiest perspective comes from Corey Thuen, CEO and co-founder of Gravwell, who approaches AI with equal parts optimism and skepticism.
“Too many people assume that because AI’s writing sounds pretty good, it understands all situational context and knows what it’s doing. It doesn’t, plain and simple. It’s predicting language, not reasoning about security, policy or intent. That’s exactly why prompt injection works here: attackers manipulate AI models using language, because those models can’t distinguish between a legitimate instruction and a cleverly crafted one with malicious intent. Security teams that understand those limitations and balance AI’s weaknesses with human intelligence will build stronger defenses than those who assume it’s smarter than it really is.”
Join our LinkedIn group Information Security Community!
