Artificial intelligence has become both the shield and the sword of modern cybersecurity

Security leaders are increasingly ambivalent about AI, and for good reason: it strengthens both sides of the fight at once. Recent industry surveys find that a large majority of practitioners still see AI as more opportunity than risk, yet almost all of them are uneasy about handing company data to third-party AI systems and worry that vendors and partners adopting AI tools are quietly expanding their attack surface.^[1]

The World Economic Forum's Global Cybersecurity Outlook found that AI-related vulnerabilities were seen as the fastest-growing category of cyber risk over the past year — even as the share of organizations formally assessing the security of their own AI tools nearly doubled.^[2] The takeaway is not that AI is good or bad for security, but that its benefits depend entirely on governance: poorly implemented AI can introduce misconfiguration, biased decisions, and new attack surfaces, while well-governed AI can meaningfully shorten detection and response times.

Generative AI has lowered the skill floor for cybercrime. Underground tools such as WormGPT, FraudGPT, and similar large-language-model variants are marketed on dark-web forums specifically because they strip away the safety guardrails found in mainstream chatbots, allowing attackers to generate persuasive phishing emails, fake invoices, and executive-impersonation messages with none of the spelling or grammar mistakes that once gave scams away.^[3]

These tools go beyond writing convincing prose. Researchers have documented generative AI being used to draft business-email-compromise scripts, build fake websites, probe for system vulnerabilities, and even produce working malware code — capabilities that previously required real technical skill and now require only a subscription and a prompt.^[4] The effect is a democratization of sophistication: a novice attacker can now approach the output quality of a seasoned operator.

Security teams heading into 2026 cite hyper-personalized phishing, automated vulnerability scanning and exploit chaining, adaptive malware, and deepfake voice fraud as their top AI-driven concerns, in that order.^[5] What ties these together is speed and personalization: AI lets attackers tailor lures to a specific employee's role and writing style, chain together exploits automatically, and mutate malware to slip past signature-based defenses.

Well over a third of security professionals report having already experienced AI-enhanced or AI-generated phishing attacks firsthand, and analysts increasingly describe the situation as an arms race moving at "machine speed," where attackers deploy automation faster than many defenders can adapt their playbooks.^[6][7] For organizations, the practical implication is that perimeter-based defenses and static detection rules are no longer sufficient on their own.

AI is not only a weapon for attackers — it is also the most effective tool defenders have for keeping pace. Organizations that pair AI and security automation with their detection and response workflows identify and contain breaches dramatically faster than those relying on manual methods, translating into millions of dollars in avoided incident costs.^[8]

In practice, this means machine-learning models that flag anomalous logins and lateral movement, natural-language systems that triage the flood of daily security alerts, and models trained to spot the subtle patterns of AI-generated phishing content itself. The most common defensive use case reported by IT leaders is AI-driven threat and anomaly detection, precisely because it helps thin, alert-fatigued security teams focus human judgment where it matters most.^[9]

Deepfakes have moved from novelty to a routine enterprise threat. A majority of organizations surveyed by Gartner reported experiencing at least one deepfake-enabled social-engineering attempt in the past year — impersonating an executive on a phone call or video meeting to authorize a fraudulent payment or extract sensitive data.^[10]

The defense gap is stark: research on human detection consistently finds that people identify high-quality synthetic audio or video only slightly better than chance, while most organizations still lack a formal deepfake response plan.^[11] Regulators are starting to respond — the EU AI Act's transparency provisions require disclosure of AI-generated synthetic media — but as the technology becomes cheaper and faster to produce, awareness training and out-of-band verification (a callback on a known number, a pre-agreed passphrase) remain the most practical near-term defenses.^[12]

The evidence points away from replacement and toward transformation. If AI were displacing security staff at scale, the global workforce shortage — estimated at millions of unfilled positions worldwide — would be shrinking. Instead, it continues to widen even as AI adoption accelerates, which is a strong signal that demand for skilled people is outpacing what automation alone can absorb.^[13]

Industry workforce studies consistently find that most security professionals view AI as a career opportunity rather than a threat, expecting it to demand more specialized skills and more strategic thinking rather than fewer jobs.^[14] What is changing is the shape of the work: AI now handles the first pass of alert triage, while people are needed more than ever for the judgment calls — deciding which flagged anomaly is a real adversary and which is noise, a task that still requires human accountability and context AI cannot fully replicate.

The next phase of this story is likely to be defined by three forces: agentic AI, governance, and regulation. As organizations deploy autonomous AI agents into workflows, security teams are already voicing concern about visibility into what those agents can access and act upon — a new category of non-human identity that needs the same governance rigor as a human employee's credentials.^[15]

At the same time, frameworks such as the EU AI Act, the NIST AI Risk Management Framework, and the OECD AI Principles are pushing organizations toward structured AI-security assessment rather than ad hoc adoption.^[1] The likeliest future is neither an AI-secured utopia nor an AI-broken internet, but a continued, faster-moving contest in which the advantage goes to whichever side — attacker or defender — operationalizes AI with more discipline.