The double-edged sword of AI in cybersecurity

How AI-driven defences could prevent an uphill battle with modern cyberthreats

In 2024, the UK government reported that 50 percent of businesses had experienced some form of cyber security breach or attack in the prior 12 months, with such attacks becoming increasingly sophisticated. Battling the latest cyberattacks involves leveraging the agility and intelligence of AI to maintain robust security postures. Here, Nathan Charles, our Head of Customer Experience, explores the role of AI in cybersecurity, its applications, challenges and the future of AI-powered threat protection.

Evolving cyber threats

Digital threats are in constant flux. Cybercriminals are employing their own innovations in advanced ransomware, phishing and zero-day exploits to target both public and private sector organisations. Concerns arise as traditional protection methods struggle to maintain the pace set by new cyberattack strategies, only exacerbated by increased Internet of Things (IoT) devices, cloud computing and remote working which encourage vulnerability.

Criminals have not shied away from trending AI either. Employed by threat actors, AI can now generate sophisticated attacks like phishing content and automated reconnaissance to maliciously catch out their victims. Combatting AI-driven attacks is tricky, however adopting the same tactic in a cybersecurity solution is the best option to keep organisations one step ahead.

AI's role in cybersecurity

AI provides an adaptive approach to cybersecurity. Methods like machine learning, natural language processing and behavioural analysis enable threat detection at greater speeds with higher success rates compared to traditional methods like firewalls and anti-virus software.

Beginning with prevention, AI-powered systems can analyse expansive datasets and identify patterns which indicate malicious activity. Machine learning algorithms also frequently learn new patterns in data which refines their detection capabilities meaning they are less likely to miss any suspicious activity. For example, AI cybersecurity systems in financial organisations will analyse user behaviour, learn them and send alerts when unusual transactions or erratic logins are detected, triggering a rapid prevention response.

Other preventative tactics include predictive intelligence, where AI analyses historical data and dark web activity to detect early signs of cyberattacks. Intel could detail the latest attack pathways with unique risk scores evaluating the likelihood of them happening. Organisations can use these insights to refine their defence systems accordingly and establish what vulnerabilities need additional protection.

If prevention fails, AI-driven cybersecurity enables automated incident responses that follow breach alerts. By integrating AI in response platforms, organisations can slash the time it takes to mitigate an attack. This is particularly useful in large-scale incidents where immediate containment is critical to limit downtime and potential financial losses.

AI-driven incident response systems also learn from attacks that do occur. Each incident provides new data that is used to improve future responses and strengthen a businesses’ defence posture, meaning that organisations can adapt in real time with the cyberthreats. 

AI brings its own hurdles

Even with its advantages, AI is not faultless. AI-driven cybersecurity presents a new set of challenges for businesses to consider. While learning is one of AI’s greatest assets, it can pose as a problem when the AI model encounters inaccurate or incomplete data. Often, it takes human knowledge to curate datasets that reduce biases that may lead to false positives or negatives paired with AI retraining with fresh data to maintain effective AI-lead defence systems.

Cybercriminals have even caught on to this by introducing adversarial attacks to manipulate AI defences. Known as ‘data poisoning’, hackers introduce malicious data designed to deceive defence algorithms, bypassing security measures. AI security researchers are developing adversarial training to combat these concerns, where AI models are exposed to manipulated data which they can then identify for improved resilience.

AI-driven threat detection also draws in ethical and privacy concerns. This is because it is being used to analyse user behaviour and frequently handle sensitive data, which is where EU legislation General Data Protection Regulation (GDPR) has influence to keep such data safe and contained. Effective AI threat detection systems must be transparent, detailing how their algorithms work and how decisions are made in line with regulations like GDPR. 

Finding the balance

A multi-faceted collaboration between humans and AI is necessary for a successful approach to modern cybersecurity. Pairing advanced AI systems with human analysts provides critical context for decision making. As AI handles the heavy lifting of data analysis, human expertise applies the context needed to interpret AI’s findings accurately.

AI also excels at performing repetitive tasks, saving human analysts from the more tedious, time-consuming activities. Automated AI defences allow for incident investigators to spend more time focusing on the complex strategic planning and management of the data allowing for improved mitigation.

One example comes from tech giant Microsoft, recently introducing AI agents within its Security Copilot to alleviate repetitive tasks for cybersecurity teams as the relentless pace and complexity of cyber attacks surpass human capacity.

Human oversight of AI cybersecurity systems also enables better ethical and training management. Consider AI as a new employee. By using efficient communication, businesses can teach AI models ethical standards to adhere to and provide continuous guided training to ensure these models stay free from data biases and are up to date with emerging threats.

AI's next move in cybersecurity

We expect AI’s future in cybersecurity will see advancements in autonomous threat management, collaborative AI systems and explainable AI. Additionally, AI will begin integrating itself within emerging technologies like quantum computing and blockchain, which will enhance cybersecurity capabilities.

Companies are expected to lean further towards agentic AI, like Microsoft’s AI agents, to reduce workload and increase response times. These agents perform pre-approved actions based on their own analyses and are efficiently used in triaging notifications and mitigating email phishing attacks which remain one of the most common attacks with 84 per cent of UK business’s cyber breaches reported as email phishing.

A combination of AI driven cybersecurity and quantum computing could advance defence systems even further. If we take machine learning, quantum-AI in cybersecurity would rapidly increase the speed of this process without compromising on accuracy. This means that anomalies in large datasets can be found faster and dealt with in real-time.

Modern cybersecurity requires a proactive approach. AI provides businesses with the opportunity to catch up with today’s cyber criminals. Its predictive intelligence adds a new level of sophistication to cybersecurity which is crucial as hackers harness the same tools in their attacks. By combining AI with humanity to address ethical concerns and data quality challenges, organisations will realise AI’s potential as a cyber defence powerhouse.

To learn more about how we can help defend you and your organisation against the threat posed by AI-driven cyber-attacks, visit https://www.oryxalign.com/cyber or email us at hello@oryxalign.com.