The increasing use of AI in both defensive and offensive cyber strategies is prompting enterprises to explore new security solutions. However, as the French writer Alphonse Karr once said, “The more things change, the more they stay the same.” The core question for businesses is not whether AI requires a radical rethinking of cybersecurity—but rather, what value is at risk from AI misuse, and how much of that risk can be mitigated with existing security capabilities.
The adoption of AI and large language models (LLMs) is revolutionising enterprise operations – introducing new opportunities and challenges – yet the fundamental principles of cybersecurity remain unchanged. In fact, the rise of AI may simply underscore the need to reinforce existing security frameworks, not reinvent them. AI accelerates the execution and complexity of evolving threats, but the core principles of infrastructure and software pipeline security—such as supply chain security, vulnerability management, and access controls—still apply.
The expanding AI attack surface demands robust security solutions to safeguard AI investments, ensure compliance, and build trust in these transformative technologies. Instead of building a dedicated “AI security stack,” enterprises should focus on adapting and extending existing threat models and guardrails to cover AI-specific risks. Implementing “secure by default” solutions, coupled with ongoing threat modeling, will enable security teams to manage AI-driven risks without overhauling their entire security infrastructure.
The Human Factor: The Weakest Link and the Strongest Line of Defense
While AI enhances both attack and defense capabilities, human vulnerabilities remain the most exploitable weakness. AI will empower bad actors to automate software development and data analysis, accelerating their ability to identify and exploit vulnerabilities at scale—making social engineering attacks like phishing and wire fraud more effective and harder to detect. To counter this, organisations must reinforce human-focused security measures, including stronger multi-factor authentication (MFA), privileged access management (PAM), and training to recognise AI-generated phishing and deepfake content.
At the same time, human expertise will remain critical in navigating complex and unpredictable threats. Over the next five years, AI will automate routine tasks like vulnerability scanning and incident response, improving operational efficiency. However, AI alone cannot handle “irreducible uncertainty”—scenarios where the risk landscape is ambiguous or rapidly changing. Security teams will need to interpret AI-generated insights and make informed decisions, combining AI’s analytical power with human judgment to safeguard against evolving threats.
Harnessing GenAI, LLMs and Agentic AI Responsibly
As generative AI, LLMs, and agentic AI become central to digital transformation, their transformative potential comes with complex security challenges. From safeguarding sensitive information to meeting stringent compliance requirements, organisations face mounting pressure to adopt a holistic approach to AI security.
LLMs risk exposing sensitive data, with 55% of data leaders citing this as a top concern, while adversarial attacks like evasion, poisoning, and model inversion threaten AI integrity. Intellectual property theft through model extraction and reverse-engineering further compounds the risks, alongside increasing compliance demands from regulations. Agentic AI – capable of autonomous decision-making and action – also requires stronger privileged access management and continuous monitoring to prevent unauthorised actions and ensure data is AI ready.
To harness AI responsibly, organisations must reinforce existing defenses, adapt threat models to account for AI-specific risks, and implement proactive security measures to protect AI investments while maintaining operational integrity and trust. Automated AI asset discovery provides comprehensive visibility into AI models, datasets, and infrastructure, ensuring organizations have a clear understanding of their AI ecosystem. Specialized risk assessments can address critical vulnerabilities, including OWASP Top 10 LLM risks like prompt injection and data leakage. Real-time monitoring enables continuous detection and rapid response to emerging threats, strengthening overall security.
Securing AI infrastructure is equally critical. Protecting containerized AI workloads requires addressing misconfigurations and vulnerabilities to ensure reliable performance. Cloud configuration assessments can identify and remediate risks in cloud-hosted AI environments, minimising exposure. Automated patching further streamlines patch management, enabling efficient and scalable protection for critical AI infrastructure.
Sensitive data detection is also essential. Advanced scanning and contextual analysis can identify and mitigate the exposure of PII and other sensitive data within AI systems. By detecting patterns and analysing data in context, organisations can prevent unauthorised access and reduce the risk of data leakage—helping maintain compliance with regulations such as GDPR and CCPA. A comprehensive, proactive approach will enable enterprises to confidently manage AI-driven risks while fostering trust and ensuring responsible AI usage.
Evolving, Not Reinventing Cybersecurity
AI will continue to reshape the cybersecurity landscape, but the fundamentals of security strategy remain unchanged. The challenge lies not in reinventing cybersecurity—but in evolving and adapting it to an AI-driven future.
