Quick answer: AI is now a stable part of the attacker toolkit, and it helps defenders too, especially with technical work. But AI in cyber defense only improves security when it’s integrated with your data, fits your processes, and is matched by the capacity to act on its findings. Otherwise it creates a false sense of security, and that’s where the gap between organizations opens.
Key takeaways
- Attackers have used AI from the start: phishing, malware development, reconnaissance and vulnerability discovery.
- Agentic AI now lets one person plan an attack while AI coordinates and executes it.
- AI makes defenders more capable, especially in malware analysis and code review.
- Finding issues faster is worthless if you can’t fix them faster.
- Three priorities for leaders: track the technology, gain visibility of AI exposure, and update your processes.
Why this conversation matters now
At Cyber Security Nordic 2026 on October 28, Paolo Palumbo, Vice President for Agentic Cybersecurity at WithSecure, joined a conversation on how AI has made our defenses better and our risks worse. Paolo has more than two decades in cybersecurity. He joined WithSecure in 2005 and built the company’s first AI malware scanner.
That background shapes the message. We haven’t been blindsided by AI. We’ve tracked it from both sides: as a capability that strengthens our products and services, and as one that threat actors have embraced. This article covers what that means for the security leaders who have to decide what to do next.
How are attackers using AI today?
Attackers use AI across the whole attack chain, and they started early. Paolo’s summary: artificial intelligence is a solid and stable part of the attacker’s toolkit.
While most organizations were experimenting with AI to translate office documents, threat actors were translating phishing campaigns into multiple languages. They’ve used it to help develop malicious implants and back-end infrastructure code. They use it to discover vulnerabilities, research targets and run reconnaissance.
From assistant to actor
The bigger shift is agency. As agentic development and agentic AI become more capable across the industry, threat actors move with it.
Paolo pointed to an attack in February on several entities related to the Mexican government. A single human planned a sophisticated attack with AI. AI then coordinated the attack and executed parts of it. The agencies were breached and a significant amount of data was stolen.
It’s one case among many. As Paolo put it, it would be surprising to learn that a capable threat actor wasn’t using AI this way.
How does AI help cyber defenders?
AI helps defenders most with technical tasks that used to need scarce expertise. Paolo called it a very powerful ally.
Take malware analysis. Reverse engineering once required niche knowledge of assembly languages, computer architectures and operating systems. Today you can often ask AI for help and get very good results. Work that needed several experts can be done by one person.
The same goes for code. Attackers use AI to find vulnerabilities, and defenders can use the same capability to scan their own code base and make their products more secure.
Paolo was careful about the limits: there’s still very much space for humans. AI improves the work of defenders. It doesn’t replace them.
Why does AI create a false sense of security?
Because AI is only a technology, and technology only helps when the organization around it is ready. Paolo named three conditions.
- It’s well integrated. AI needs access to the right data for its output to stay accurate.
- It fits your processes. It has to sit inside the wider fabric of your infrastructure and workflows.
- You can act on what it finds. If AI discovers vulnerabilities in code extremely fast, but you lack the development capacity to fix them or review the pull requests AI generates, you haven’t advanced your security. You’ve created a false sense of it.
This is the gap. Some organizations are nimble and skilled enough to turn a complex tool into something effective. Others say “I have AI, I’m fine.” Managing AI well isn’t trivial, and attackers don’t wait for anyone to catch up.
What should CISOs and security leaders do next?
Paolo’s advice came down to three priorities.
1. Track the technology relentlessly
This may be one of the biggest revolutions we’ve seen. Security leaders and business leaders both need to stay on top of it.
2. Gain visibility of AI exposure and drive it down
Know where AI is used in your organization. Treat the exposure it introduces as a risk to tackle aggressively and reduce.
3. Bring your processes into the AI age
Vulnerability management and incident response are two processes Paolo named. Review them, and make them fit for purpose. A few practical questions:
- Can we fix vulnerabilities as fast as AI can find them?
- Do we have capacity to review AI-generated fixes?
- Does our incident response still work if an AI tool is unavailable?
Frequently asked questions
How are attackers using AI? Across the attack chain: translating phishing campaigns, helping write malicious implants and back-end code, finding vulnerabilities, and researching targets. Increasingly they use agentic AI that coordinates and executes parts of an attack.
Does using AI make a company more secure? Not on its own. AI must be integrated with your data, fit your processes, and be matched by the capacity to act on its findings. Without that, it can create a false sense of security.
What is the AI cybersecurity gap? It’s the widening distance between organizations that can turn AI into effective defense and those that can’t. Attackers don’t care about the gap, and they already use AI.
Will AI replace security analysts? No. AI lets one person do work that once needed several experts, such as malware analysis, but there’s still very much space for humans.
What should a CISO do first? Start with visibility: understand where AI is used in your organization and reduce the exposure it creates. Then review processes such as vulnerability management and incident response.
Watch now: Made Our Defences Better and Our Risk Worse
