By Henrik Smith, Chief Information Security Officer, Infoblox
Artificial intelligence is reshaping the cybersecurity landscape, although its biggest impact may not be the emergence of entirely new vulnerabilities. Instead, AI is enabling attackers to identify, combine and exploit existing security weaknesses at a speed that traditional defensive approaches are struggling to match. This shift is changing how organizations need to assess and manage cyber risk.
For years, businesses have accumulated security backlogs. These include access controls requiring improvement, known vulnerabilities that were assigned lower priorities, systems needing additional monitoring and weaknesses that remained unresolved despite being identified.
Previously, exploiting these gaps at scale required considerable time, coordination and effort. AI is reducing those limitations. Attackers can now evaluate large numbers of possibilities, identify combinations of vulnerabilities and develop attack paths much faster. Activities that once required days or months of preparation could potentially be compressed into significantly shorter periods.
Meanwhile, security teams are still expected to detect, investigate, prioritize and remediate threats using processes designed for a slower threat environment. This creates an increasingly difficult imbalance between offensive and defensive capabilities.
Closing the Gap Between Offensive and Defensive Security
The cybersecurity industry has invested heavily in advanced offensive security capabilities. Organizations regularly emphasize their red teams, penetration testing programmes and offensive security specialists. While these activities remain important, comparable investment is needed in defensive operations.
When offensive teams use advanced technologies to identify ways of breaching an organization’s infrastructure, defensive teams need sufficient budgets, staffing and expertise to understand how those techniques can be detected and prevented.
AI should therefore become more than another technology initiative. It needs to develop into a practical operational capability that strengthens everyday security activities.
One significant opportunity lies in using AI to address security tasks that organizations have historically struggled to complete. AI systems and autonomous agents can process large volumes of information, recognize patterns and connect seemingly unrelated signals across complex environments.
When deployed effectively, these capabilities can help security teams reduce backlogs, identify security gaps and prioritize issues that have a meaningful impact on organizational risk.
However, generative AI currently appears to be benefiting attackers more than defenders. A defensive advantage will emerge only when organizations invest in the people, processes and infrastructure required to use AI effectively in their security operations.
Addressing Resource Constraints and Security Priorities
Resourcing and prioritization remain major challenges for organizations. Security teams frequently operate under pressure while development and business teams continue introducing new technologies and capabilities.
This creates a familiar imbalance: substantial resources are allocated to developing and deploying new systems, while comparatively fewer resources are dedicated to protecting them. AI does not resolve this problem; instead, it makes the consequences more apparent.
Organizations need to reconsider how offensive and defensive security functions collaborate. These teams should not operate independently. Findings from penetration testing and offensive security exercises should directly inform defensive controls, threat detection and remediation activities.
When an offensive team identifies a new method of accessing an organization’s environment, defensive teams should be able to use that intelligence quickly to strengthen existing protections.
Basic Security Weaknesses Remain a Major Concern
Organizations should not assume that sophisticated AI-driven attacks always require equally sophisticated defensive technologies.
Many of the weaknesses being exploited remain familiar security problems, including inadequate access controls, excessive privileges, unresolved vulnerabilities and fragmented security visibility.
AI simply makes it easier for attackers to discover and exploit weaknesses that organizations have allowed to persist.
This also means security leaders may need to reconsider how they classify acceptable risk. A vulnerability previously considered low risk because exploitation was difficult may require a different assessment when attackers can identify and exploit it much faster.
Several individually minor weaknesses can become a significant security exposure when attackers can correlate them and move rapidly between different parts of an environment.
Security leaders should therefore assess risk as an interconnected system rather than treating every alert or vulnerability as an isolated issue.
Moving Beyond AI Security Hype Towards Measurable Outcomes
Another important consideration is avoiding distractions created by the latest AI-related announcements. The cybersecurity industry does not need another cycle of initiatives, declarations and partnerships that fail to demonstrate measurable security improvements.
Collaboration remains important, but its effectiveness should be assessed through tangible outcomes. These include information shared, vulnerabilities resolved, attacks detected, security controls improved and incident response times reduced.
The same approach should guide responsible AI adoption. Organizations should look beyond whether an AI agent behaves unexpectedly and investigate why such behaviour was possible.
Important questions include whether the agent received excessive access, whether security controls were insufficient, whether monitoring was inadequate and whether fundamental security practices were overlooked.
Understanding these underlying weaknesses is essential to building more reliable AI environments.
Defenders Must Increase Their Operational Speed
AI is accelerating the pace of cyberattacks. Organizations that respond effectively will not necessarily be those running the largest number of AI projects. They will be the ones that identify where AI can deliver genuine security benefits and use it to resolve existing weaknesses.
The immediate priority should be to provide defensive teams with the resources, capabilities and intelligence needed to operate at a pace closer to that of attackers.
The practice of treating security backlogs as an unavoidable part of business operations is becoming increasingly difficult to sustain. When AI can turn a previously minor weakness into a viable attack path, organizations can no longer afford to postpone addressing known security problems.