Why Cyber Attackers Benefit More from AI Technology than Defenders

AI is transforming both cyber offense and defense, but the attackers hold distinct advantages.  AI tools can be used for attacks and defense but the attackers are less concerned with quality or problems.  They can use risky or unvetted technology with impunity as they aren’t overly concerned if it causes harm.  The result is they employ such tools much earlier than the defenders.  AI powered social engineering is a good example. 

Defenders face two problems.  First, security tools don’t magically appear.  They are a response to a problem and represent an investment by enterprises.  So, before they are commissioned, there must be a problem to address.  That means the attackers are winning somewhere first. 

Secondly, defenders don’t have that luxury of being reckless when it comes to new technology.  Their risk appetite is much less because a security tool that creates loss, is just an insider attack conducted by incompetent security.  An improper AI powered social engineering filter may delete important messages or be vulnerable to being hijacked by hackers.

Cybersecurity must wait for tools to be properly designed, tested, vulnerabilities closed, and vetted for their operational environment.  Roll-out is often slow for any system that has strong capabilities to do harm.

So, there is a time lapse between when attackers use new tools, such as AI advancements, and when defensive tools will appear and be confident to do no harm. 

This is the attacker’s advantage that compounds the benefit they hold in maintaining the initiative of when, where, and how attacks will occur.

As for AI cybersecurity, there is good news.  Despite these challenges, AI-driven defense is catching up and we will see defensive tools restore some balance by the end of the year.

Check out my full 2026 Cybersecurity Predictions (prediction number 8 to be precise) for details.

https://matthewrosenquist.substack.com/p/top-10-cybersecurity-predictions

 

Clip from my keynote delivered to the Nemertes group. 

More information at http://nemertes.com/ and http://nemertes.substack.com/

 

Follow Matthew on

-          LinkedIn: https://www.linkedin.com/in/matthewrosenquist/

-          SubStack: https://substack.com/@matthewrosenquist 

 

Visit Cybersecurity Insights at https://www.cybersecurityinsights.us 

Subscribe to the Cybersecurity Insights channel: https://www.youtube.com/CybersecurityInsights