Fazlur Rahman
AI is transforming cybersecurity in both directions. Defenders use AI for threat detection (anomaly and behavioral analysis), automated SOC triage, phishing detection, and threat intelligence summarization. Attackers use AI for personalized phishing at scale, voice and video deepfakes for business email compromise, adaptive malware that evades signature-based detection, and automated vulnerability discovery. Top defender AI tools: Microsoft Security Copilot, CrowdStrike Charlotte AI, SentinelOne Purple AI, Palo Alto Cortex XSIAM, Darktrace. Top regulations: EU AI Act (high-risk classifications effective August 2025), NIST AI Risk Management Framework, US sector-specific rules.
How Attackers Use AI in 2026
Three attack patterns dominate the AI threat landscape:
1. AI-Assisted Phishing
Generative AI lets attackers produce convincing personalized phishing emails at scale, in any language. Attackers feed AI tools scraped social-media profiles and company org charts; the output is targeted lures indistinguishable from legitimate correspondence. Phishing volume has increased sharply since 2023 and remains the most common initial-access vector for cyberattacks.
2. Deepfake Voice and Video for BEC
Voice cloning now requires only a few seconds of sample audio, often harvested from public-facing videos, earnings calls, or recorded voicemails. Documented cases include a $243 million CFO video conference deepfake (Hong Kong, 2024) and numerous voice clones used to authorize fraudulent wire transfers. The FBI has issued repeated warnings about AI-driven BEC attacks.
3. Adaptive and Polymorphic Malware
Generative AI enables malware that rewrites its code on each infection to evade signature detection. AI is also being used to develop more effective social-engineering scripts, identify vulnerable targets via automated reconnaissance, and craft payloads that bypass traditional EDR detection. The trend line points toward AI-driven malware that adapts to individual victim environments.
How Defenders Use AI
Five defender use cases that have moved from experimental to mainstream in 2026:
- Threat detection: ML models analyze network and endpoint telemetry for anomalies that signature-based detection misses. This is the largest deployed use of AI in security.
- Automated SOC triage: AI summarizes alert queues, correlates related alerts, and proposes triage decisions. Cuts tier-1 analyst workload dramatically.
- Email security: AI models detect subtle phishing signals (writing style, sender-behavior changes, content patterns) that traditional rule-based systems miss.
- Threat intelligence: AI summarizes and correlates threat reports, IOC lists, and vulnerability disclosures in near-real-time.
- Vulnerability prioritization: AI scoring considers exploitability, asset exposure, and business context — far more accurate than CVSS alone.
Top Defender AI Tools (2026)
| Tool | Vendor | Primary Use |
|---|---|---|
| Security Copilot | Microsoft | SOC analyst augmentation, incident summarization |
| Charlotte AI | CrowdStrike | Falcon alert triage and threat hunting |
| Purple AI | SentinelOne | Singularity platform triage |
| Cortex XSIAM | Palo Alto Networks | SIEM replacement with autonomous SOC |
| Darktrace | Darktrace | Self-learning network and email detection |
| Abnormal Security | Abnormal | AI-driven email threat detection |
| Irregular | Irregular | AI red teaming for model safety |
| Recorded Future | Recorded Future | AI threat intelligence |
| BigID | BigID | AI data security posture |
| Avalor (from Zscaler) | Zscaler | AI security data fabric |
The EU AI Act and Cybersecurity
The EU AI Act took effect in August 2024 with phased enforcement starting August 2025. For cybersecurity specifically:
- AI systems used in critical infrastructure (including security monitoring and threat detection) are classified as high-risk.
- High-risk AI systems require risk assessments, data quality controls, transparency, human oversight, and post-market monitoring.
- AI applications that influence elections, employment, or financial services carry enhanced obligations.
- Prohibited practices include social scoring, emotion recognition in workplace and education, and AI for untargeted facial scraping.
Outside the EU, the NIST AI Risk Management Framework (AI RMF 1.0, January 2023) is voluntary but widely adopted. The US AI Bill of Rights (2022) provides additional blueprint guidance. Sector rules in finance (OCC, SEC), healthcare (HHS), and critical infrastructure (CISA, TSA) introduce AI-specific obligations.
Defending Against AI-Powered Attacks
- Verification protocols for financial transactions. Voice and video authorization is no longer sufficient. Require cryptographic out-of-band confirmation for any payment or wire transfer over a defined threshold.
- Train employees on deepfake indicators. Lip-sync mismatches, unnatural eye movement, unusual hesitation, and unexpected background audio are still common tells.
- Multi-channel verification. Any high-value request — even from a familiar voice or face — must be confirmed through a second channel the attacker does not control.
- AI-driven detection deployed. Static rule-based email and endpoint defenses lag AI-powered phishing. Use AI-driven detection at the email and EDR layers.
- Tabletop exercises simulating AI attacks. Include a deepfake impersonation scenario in your next incident response tabletop.
AI Security Skills to Learn
Five high-ROI skill areas for security professionals who want to ride the AI curve:
- Prompt engineering for security analysis. Most modern SOC tools expose an LLM-style interface. Knowing how to prompt effectively multiplies productivity.
- AI/ML fundamentals. Understand how models are trained, evaluated, and improved — enough to engage engineering teams in informed conversation.
- Adversarial machine learning. How to attack and defend ML systems: prompt injection, jailbreaks, model evasion, data poisoning.
- AI governance and compliance. EU AI Act, NIST AI RMF, sector-specific rules. Compliance analysts with AI understanding are in very high demand.
- AI red teaming. Methodologies for testing AI systems for safety, security, and bias issues.
Career Implications for Cybersecurity Professionals
AI is changing security careers but not eliminating them. Roles that benefit:
- SOC analysts who learn to leverage AI assistants (output 2–3x alerts handled per day).
- Threat intelligence analysts who use AI for summarization and correlation (output 4–5x reports per week).
- GRC professionals who specialize in AI governance (high demand, low supply).
- Penetration testers who add AI red teaming skills (new premium specialty).
Roles under pressure: tier-1 alert triage (AI handles most of it) and basic compliance checking (AI-assisted). Senior security leadership, business-context interpretation, and adversarial testing remain human-dominated.
For the broader compliance frameworks that govern AI security deployments, see our compliance frameworks guide. For the defensive basics that protect every employee, see our 25 cybersecurity tips. To build the modern SOC analyst skills that AI augments, the TutorsBot Cyber Security Analyst Foundation course covers detection engineering, threat hunting, and incident response — the foundation that AI-assisted security operations build on.
