AI in cybersecurity

AI in cybersecurity means that attackers and defenders now use the same kinds of AI models against each other. Generative AI, the kind of AI that writes text and creates images, voices and video, makes attacks cheaper and more convincing. The same models help defenders read and judge far more than any team of people could.

Here is how it works in general. An attacker uses an AI model to produce something convincing: an email, a voice, a face or a piece of malicious code. Because the model does the writing, the attacker can send thousands of versions, each one different and each one without the spelling mistakes that used to give fakes away. The defender uses its own model to read every item as it arrives. The model checks who normally sends what, in what tone, and what each person normally does. It flags what breaks the pattern, and a person reviews what it flags.

The contest has changed what defence looks for. Older security tools mostly matched known patterns, such as a known bad file or a known bad sender. A message that an AI model wrote a minute ago matches no known pattern. So defenders now judge behaviour and intent instead. Attackers also turn AI against AI: they type instructions into a company's chatbot to make it ignore its rules. Protecting the model itself is the subject of AI security.

Take, for example, an email to a company's accounts team that appears to come from the chief financial officer. It is written perfectly and asks for an urgent payment. Integrated cloud email security flags it, because this sender has never asked for a payment before.

Consider a video call to open a bank account. A fraudster shows a face made by AI. Liveness detection checks for the small signs that a living person is in front of the camera.

Say a security team wants to test its own defences. Automated red teaming uses an AI agent that plans and runs the attack itself, the same way a real attacker's AI agent would.

In the security operations centre, for instance, an AI SOC analyst reads every alert first, so that the analysts see only the few that matter.

How is AI in cybersecurity different from AI security? AI in cybersecurity is about using AI models as tools, for attack and for defence. AI security is about protecting a company's own AI models and agents from being tricked. Deepfake detection sits between the two: it uses AI to catch what other AI made.