Cybersecurity in the Age of AI: What's Changing
By: Casey Cannady : cybersecurity veteran & endpoint security architect
TL;DR
AI is changing both sides of security at the same time. Defenders now have models that can find real, exploitable bugs before attackers do. Attackers now have deepfakes good enough to walk $25 million out of a company on a single video call. And the AI systems themselves have become a target, with prompt injection at the top of the industry's risk list. After nearly 30 years in this field, my read is simple: speed is the new baseline. The organizations that come out ahead will be the ones that shrink their patch windows and put a human verification step in front of every high-stakes request, no matter how real the voice on the call sounds.
AI on Defense
Behavioral baselines and anomaly detection. This is the part of “AI in security” that has quietly worked for years. Models learn what normal looks like for a user, a host, or a network segment and flag the deviations a human analyst would never have time to find. It is especially useful against insider threats and long, quiet intrusions.
Automated response. Orchestration platforms can isolate a host or disable an account in seconds instead of hours. That speed is real, and so is the risk: an automated response tuned badly will lock out your CFO during quarter close. Tune it on low-impact actions first.
Finding the bugs first. This is the genuinely new part. In late 2024, Google's Project Zero and DeepMind teams reported that their Big Sleep agent found an exploitable memory-safety bug in SQLite, one of the most widely deployed pieces of software on earth, and it was fixed before it ever shipped in an official release. That is an AI doing vulnerability research, not autocomplete.
AI on Offense
Deepfakes and social engineering. In early 2024, an employee in engineering firm Arup's Hong Kong office sent roughly $25 million to fraudsters after a video call in which the other participants, including someone presented as a senior executive, were AI-generated fakes. No malware. No exploit. Just faces and voices the employee trusted.
If your payment approval process can be satisfied by a convincing face on a screen, it is not a control anymore. Verify through a second channel you already trust, every time.
Faster vulnerability discovery, for everyone. The same techniques that let Big Sleep find a bug for defenders will find bugs for attackers. When discovery speeds up, the time between disclosure and exploitation shrinks. That puts direct pressure on the least glamorous control in security: how fast you actually patch.
Attacks on the AI itself. Once you put a model in the loop, the model becomes attack surface. The OWASP Top 10 for LLM Applications (2025) ranks prompt injection first and sensitive information disclosure second. In March 2025, NIST published an updated taxonomy of adversarial machine learning attacks covering evasion, poisoning, and privacy attacks, along with the honest admission that many mitigations are still immature.
The Hard Parts Nobody Puts in the Sales Deck
Data quality and bias. A detection model is only as good as the data it learned from. Train it on an environment that was already compromised, and it learns that the compromise is normal.
Explainability. When a model blocks a login or quarantines a server, somebody has to explain why, to the user, to the auditor, and sometimes to a court. “The model said so” does not survive an incident review.
Building AI-Ready Security Teams
Hybrid workflows. The best security operations I have seen use AI to sort and summarize, and humans to decide. Design the handoff on purpose instead of letting it happen by accident.
Continuous tuning. Models drift as your environment changes. Someone has to own retraining, false-positive review, and the question of whether the tool is still earning its license fee.
What's Coming Next
Zero trust gets smarter. Expect AI-driven risk scoring to feed access decisions in real time: who you are, what device you are on, and whether that device is patched.
Quantum is a crypto inventory problem. NIST finalized its first post-quantum encryption standards, including FIPS 203, in August 2024. The migration will not start with math. It will start with finding every place old cryptography lives across your endpoints and applications, and that is exactly the kind of job endpoint management tooling was built for.
Recommendations for Organizations
- Shrink your patch window. Measure time from vendor release to deployed, and treat it as a security metric.
- Add out-of-band verification for payments, credential resets, and access changes, no matter who appears to be asking.
- Keep humans on the decisions that matter, and let AI handle the sorting.
- Treat every AI tool as a data flow. Know what goes into it, where it is stored, and who can see it.
- Start your crypto inventory now, before a deadline starts it for you.
The bottom line: AI does not replace the fundamentals. It punishes organizations that skipped them, faster than ever. Embrace what it can do, stay honest about what it cannot, and keep a human in the loop where the stakes are high.
Sources & Further Reading
- Google Project Zero: “From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code”, the source for the SQLite finding.
- CNN: “Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee” May 16, 2024.
- OWASP: Top 10 for LLM Applications 2025.
- NIST: Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (AI 100-2 E2025), March 2025.
- NIST: FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard, August 2024.
Sourcing note: examples and standards are linked to their primary or original reporting sources. The recommendations and predictions are my professional opinion. Revised September 2026: this post was rewritten with cited, dated examples, and its date line was corrected to match its original April 2025 publication.
Connect with Casey
Have a story, a question, or want Casey to write about a specific topic? DM me and tell me which story you want next.
| Websites | |
| Threads | |
| Bluesky | |
| YouTube |
Casey writes about cybersecurity, AI, nomadic life, and navigating the world as a late-diagnosed AuDHD adult. New posts drop on my professional website.