Artificial Intelligence and Cyber Security

Artificial intelligence is the most significant force reshaping cyber security today. The World Economic Forum’s report Empowering Defenders: AI for Cybersecurity, published in May 2026 in collaboration with KPMG, describes AI as the biggest driver of change in the field, with 94% of cyber leaders identifying it as a defining force and 77% of organisations already using it in their cyber operations. This is no longer a technology on the horizon; it is already embedded in both the attacks organisations face and the tools they use to defend themselves.

The challenge is that AI operates on both sides of the security equation simultaneously. The same capabilities that enable defenders to detect threats faster and respond more effectively are enabling attackers to conduct operations at greater scale, with less expertise and with greater precision. Understanding this dual-use reality is essential for any manager seeking a strategic perspective on where the field is heading.

How AI is Being Used to Attack

AI-enhanced phishing and social engineering: generative AI enables the production of highly convincing, personalised phishing emails, voice-cloning attacks, and deepfake video calls at scale and at speeds previously impossible. AI can analyse a target’s publicly available social media presence, professional history and communication style to generate messages that are individually tailored and difficult to distinguish from legitimate communications. The WEF reports that AI-generated spear phishing, deepfakes and synthetic identity attacks are already in active use. The NCSC’s assessment of the impact of AI on cyber threats to 2027 found that AI will almost certainly continue to make elements of cyber intrusion operations more effective and efficient.

Automated vulnerability discovery: AI systems can conduct vulnerability scanning and exploit development at machine speed, significantly compressing the time between a vulnerability being discovered and an attack being launched against it. The NCSC identifies AI-assisted vulnerability research and exploit development as the most significant near-term AI cyber development, enabling skilled actors to discover and exploit previously unknown vulnerabilities at a pace human researchers cannot match. The Verizon 2025 DBIR found a 34% increase in the exploitation of vulnerabilities as an attack vector, and AI-driven acceleration of this vector is expected to intensify.

Lowered barriers to sophisticated attacks: AI tools reduce the technical expertise required to carry them out. Capabilities that previously required significant skills, investment and time are becoming accessible to a much wider range of threat actors through the availability of AI-powered attack toolkits. The NCSC’s assessment found that the majority of cyber threat groups will focus on using or repurposing commercially available and open-source AI models to enhance their capabilities.

Deepfake fraud and impersonation: AI-generated audio and video impersonation of executives and trusted individuals is being used to conduct business email compromise and authorisation fraud at scale. Finance teams instructed by a convincing deepfake video of a CEO to authorise a payment represent a new category of threat that technical controls alone cannot address. The WEF Global Cybersecurity Outlook 2026 found that 87% of respondents identified AI-related vulnerabilities as the fastest-growing cyber risk over 2025.

How AI is Being Used to Defend

Accelerated threat detection: AI-powered security monitoring systems can analyse enormous volumes of network traffic, log data and user behaviour in real time, identifying anomalous patterns that would take human analysts significantly longer to detect. IBM’s 2025 data found that organisations using AI extensively in security operations achieved an 80-day reduction in breach lifecycle, a substantial improvement in the speed of detection and containment that directly translates into lower breach costs.

Automated incident response: AI systems can be configured to take initial automated response actions when certain threat indicators are detected, such as isolating a suspected compromised device, blocking a malicious IP address, or requiring re-authentication for a suspicious session, without requiring human intervention at the speed of the automated threat. The NCSC’s Laboratory for AI Security Research has made significant progress in developing AI agents capable of defending networks with minimal human intervention.

Improved vulnerability management: AI tools can prioritise vulnerability remediation by predicting which vulnerabilities are most likely to be exploited in the near term, using threat intelligence and attack-pattern data. This enables security teams to direct limited patching resources to the highest-risk vulnerabilities rather than working through backlogs in order of discovery.

Enhanced security awareness training: AI is enabling the development of more personalised, adaptive and realistic security training. Phishing simulations can be tailored to an individual’s specific role and communication patterns; training content can adapt to the demonstrated knowledge gaps of individual learners; and realistic simulation exercises can be generated at a scale and frequency that generic training programmes cannot match.

The Manager’s Perspective on AI in Security

For mid-level managers, the immediate practical implications of AI in cyber security fall into several categories. First, the threat environment your team faces is evolving rapidly: the phishing emails, fraudulent payment requests and impersonation attempts your team will encounter in the coming years will be increasingly sophisticated and increasingly difficult to identify through traditional awareness alone. Building a culture of verification, scepticism and confident reporting is more important than ever.

Second, the security tools your organisation uses are increasingly AI-powered. Understanding what those tools do, their limitations, and the human oversight they require is part of effective security governance. AI-powered tools can produce false positives and false negatives; they can be manipulated by attackers who understand how they work; and they require ongoing human oversight and calibration to remain effective. The introduction of AI to security operations does not reduce the requirement for human judgement: it changes the nature of that judgement.

Third, your organisation is likely already using AI tools in its operations in ways that create security implications. The WEF AI and Cyber report notes that 72% of employees who access generative AI tools through personal rather than corporate accounts pose data leakage risks. As a manager, understanding which AI tools your team uses, how they are governed, and what data they may process is a direct security responsibility.