AI As A Standalone Cybersecurity Solution 

AI is a hot topic. Set to revolutionise the way we live, work and interact with technology, it is shaping our future extensively. In almost every industry sector AI is altering processes, driving innovation, and transforming business models, ushering in a new era of efficiency and opportunity. And the world of cybersecurity is no exception. 

Presenting somewhat of a double-edged sword, AI is tipped to make cybersecurity more challenging by empowering threat actors to be more sophisticated, effective and believable on the one hand, whilst also offering improvements in defence mechanisms, leading to huge accelerations in the capability of threat detection.

There’s a lot of noise about how we can leverage AI in security and, whilst I agree its use will be beneficial, what concerns me is the inference that AI, like some of the security products and services hailed before it, could become a standalone solution which will somehow negate the requirement for an effective Security Operations Center (SOC). 

In my opinion, this is what the threat actors want. For us to absolve ourselves of responsibility, accountability and judgement and put our trust in a tech solution. 

The reality is that the same reasons that make AI a compelling threat are the very reasons that should make us pause and proceed with a good deal of caution and scepticism when considering AI as a security solution.  
AI models are fed by data and their reliability is dependent on the quality of the data they ingest.  If the data is contaminated or unreliable, the results can be biased and can even create a new attack surface for threat actors to exploit. AI models also make decisions in ways that humans can't easily understand and are readily open to manipulation.

A potential attacker for example, could trick the machine learning model into misclassifying threats to enable them to make breaches undetected thus posing a significant risk to cybersecurity.  

Whilst not a cybersecurity issue, Amazon’s attempt to lead the world in AI driven recruitment is a great example of this. Trained to find applicants by following patterns in resumes/CVs that had been received over the preceding decade, the high numbers of men in tech meant that the AI ‘learned’ that males were a preference for the company and started to penalise any reference to women or female. Amazon thought it was giving the AI the responsibility, but it didn’t, it gave it the authority to act on its behalf. The result almost managed to set the company’s diversity objectives back decades and was a huge problem to fix.

AI’s inability to contextualise is another reason why it shouldn’t be relied upon as a sole cybersecurity solution. It doesn’t have human-like situational awareness, judgment, or prioritisation abilities. It doesn’t understand the nuances of the wider environment it’s being used in, the industry or market context. Human intuition is essential in cybersecurity, enabling threat levels to be assessed in context, prioritised based on risk, and adjusted accordingly. Without it, AI may misinterpret situations, leading to ineffective responses and increased vulnerability to evolving threats.

Behind every cyber attack is a human ready to adapt; to change their method and evolve their approach. Relying solely on AI tools and removing the human element risks facing adversaries that outpace the machine's capabilities.

That human expertise is also the reason why a SOC centre is essential. Yes, an AI security model may well be able to process massive amounts of data and flag threats with amazing speed. But then what? Most IT teams are already drowning in alarms and alerts, they need guidance and support from other human experts, not another data source without direction.

Just as threat actors try to rush, distract and manipulate their victims, we shouldn’t be distracted from our security goals by the shiny thing that is AI. The risk hasn’t changed. The threat is just faster, stronger and harder and a standalone AI cybersecurity solution won’t suffice in beating it.

Image: Ideogram

Chris Stouff is Chief Security Officer at Armor

You Might Also Read:

AI-Driven Cyber Security Is Booming:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« A Deep Dive Into Deepfakes & The Threat To Digital Identity Verification
2024 & Beyond: Top Six Cloud Security Trends: »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Redbud

Redbud

Redbud is a specialist search and recruitment firm for Information Security professionals.

National Institute of Information and Communications Technology (NICT) - Japan

National Institute of Information and Communications Technology (NICT) - Japan

NICT is Japan’s sole National Research and Development Agency specializing in the field of information and communications technology.

Secarma

Secarma

Secarma provides penetration testing, security assessments, consultancy, and training services to ensure your digital infrastructure is secure from cybersecurity threats.

Excellium Services

Excellium Services

Excellium’s Professional Services team combines expertise and experience that complements your in-house security resources.

MyCyberSecurity Clinic (MyCSC)

MyCyberSecurity Clinic (MyCSC)

MyCyberSecurity Clinic's main goal is toward establishing an international reference centre for excellence in the field of digital forensics and data recovery services.

Secure-IC

Secure-IC

Secure-IC provide end-to-end, best-of-breed security expertise, solutions, and hardware & software technologies, for embedded systems and connected objects.

Spin Technology

Spin Technology

SpinOne is a SaaS data protection platform designed to monitor, secure, and back up your G Suite and O365 data, improve compliance, and reduce IT costs.

Voodoo Security

Voodoo Security

Voodoo Security is a specialized information security consulting firm focused on security assessments, risk and compliance analysis, and cloud security.

Quantinuum

Quantinuum

Quantinuum is the combination of Cambridge Quantum with Honeywell Quantum Solutions, structured to drive the future of quantum computing.

Commonwealth Cyber Initiative (CCI)

Commonwealth Cyber Initiative (CCI)

The Commonwealth Cyber Initiative is establishing Virginia as a global center of excellence at the intersection of security, autonomous systems, and data.

CyberSafe

CyberSafe

CyberSafe is a Portuguese company with a focus on cybersecurity solutions and services including network security, managed security, incident response and forensic analysis.

CyberUK

CyberUK

CYBERUK is the UK government’s flagship cyber security event and the authoritative event for the UK’s cyber security community.

VinCSS

VinCSS

VinCSS Internet Security Services JSC is a leading organization working in the field of researching, developing, producing products as well as providing cyber security services.

Limes Security

Limes Security

Limes Security GmbH is the leading OT Security expert in the German-speaking region of Europe.

Sendmarc

Sendmarc

Sendmarc automates the process of protecting your domain from being used in email impersonation and phishing attacks.

Leaf IT

Leaf IT

Leaf IT are a pioneering cloud-first MSP, dedicated to helping businesses in the UK and Ireland. We focus on delivering tangible results for our clients through IT transformation.