Originally published April 6, 2023. Updated October 28, 2026, to distinguish demonstrated AI capabilities from predictions and deployment challenges.
As technology evolves, so does the realm of cybersecurity. With the rapid advancements in Artificial Intelligence (AI), we're witnessing a significant shift in the landscape. AI has been hailed as a game-changer in many sectors, and cybersecurity is no exception.
AI's Impact on Cybersecurity Offense (The Bad Guys)
AI is helping cybercriminals enhance existing techniques. The UK National Cyber Security Centre's assessment through 2027 identifies uses including social engineering, basic malware generation, vulnerability research and exploit development:
- Phishing emails: AI-powered tools can create convincing phishing messages and remove spelling or grammatical errors that might otherwise raise suspicion. The FBI's December 3, 2024 warning describes criminals using AI-generated text for social engineering and spear phishing.
- Malware development: AI can help generate and modify malicious code. That does not mean the resulting malware is necessarily more effective, adaptable or stealthy. In August 2025, Anthropic reported a case involving the sale of AI-generated ransomware by a criminal with basic coding skills.
- Exploiting vulnerabilities: AI can assist vulnerability research and exploit development. The UK NCSC assesses that AI will further shorten the time defenders have to address disclosed vulnerabilities; this is a forecast, not a guarantee that AI can quickly find or exploit every software flaw.
- Challenging verification systems: AI-generated identity material can help criminals attempt to defeat some verification processes. In November 2024, FinCEN reported increased suspicious activity reports involving suspected deepfakes, particularly fraudulent identity documents used to circumvent identity verification and authentication.
AI's Impact on Cybersecurity Defense (The Good Guys)
On the flip side, AI is also providing cybersecurity professionals with more advanced tools:
- Spam and phishing detection: AI can assist email-security analysis and phishing triage. For example, Microsoft documents AI-assisted classification of reported phishing, while warning that outputs require review.
- Vulnerability identification: AI can help identify vulnerabilities in code and generate fixes automatically in some settings. In DARPA's August 2025 AI Cyber Challenge results, competitors' systems found 54 synthetic vulnerabilities and patched 43; they also discovered 18 real vulnerabilities and provided 11 patches for real vulnerabilities.
- Dynamic patching: Automated patch generation is not the same as safely patching any live system as soon as a flaw appears. DARPA's results demonstrate progress in a competition setting. Our recommendation is to validate generated fixes and test them before production deployment, rather than assume fully autonomous patching is suitable everywhere.
- Enhanced SOC analysis: AI can help Security Operations Center analysts summarize incidents, analyze scripts and develop investigation queries. Microsoft's documentation describes these capabilities but also cautions that outputs can be inaccurate or incomplete and should not replace analyst judgment.
The Asymmetry in AI Deployment
While AI is changing both offense and defense in cybersecurity, its benefits are not evenly distributed. It is too sweeping to say that cybercriminal adoption is universally outpacing defensive deployment. The UK NCSC's assessment through 2027 instead predicts a digital divide between systems keeping pace with AI-enabled threats and those left more vulnerable, while recognizing that AI can also help defenders.
Large organizations may have more resources to implement and oversee AI-driven cybersecurity technologies. Smaller businesses and individuals may face tighter budgets and limited expertise. Our concern is that these constraints can make it harder to keep pace—not that organization size alone determines security. In its September 24, 2026 assessment, New Zealand's NCSC urged leaders to consider whether they have the people, processes and resources needed for faster-moving threats.
Key Takeaways
The advent of AI in cybersecurity is a double-edged sword. Our recommendation is to prioritize cybersecurity and evaluate AI-driven solutions where they offer a demonstrated benefit, rather than assume every business or individual must buy an AI tool to level the playing field. Strong security fundamentals still matter: the FBI recommends strong passwords, multifactor authentication, software updates and independently checking suspicious requests. New Zealand's 2026 assessment likewise concludes that strong cybersecurity fundamentals remain the best defense against human and AI-enabled threats. Collaboration between organizations, cybersecurity vendors and government agencies remains, in our view, crucial to helping defensive measures keep pace with evolving threats.