AI in Cybersecurity: Threats, Defences, and the New Battlefield

The AI Attack Surface

AI-Powered Phishing

Traditional phishing was volume-based: send millions of emails and hope a fraction click. AI has changed this. Large language models can generate phishing emails that are indistinguishable from legitimate communication, personalised using data scraped from social media, corporate websites, and breach databases. These emails are grammatically perfect, contextually relevant, and targeted at specific individuals. The click rates for AI-generated phishing are 3-5x higher than traditional phishing, and traditional email filtering struggles to detect them because they do not contain the obvious errors that flagged earlier phishing attempts.

The defence is not better email filtering alone. It is a combination of AI-powered filtering (using models to detect the subtle signals of AI-generated content), phishing-resistant authentication (FIDO2, passkeys) that renders stolen credentials useless, and user training that evolves beyond "look for spelling mistakes" to "verify through a second channel before acting on any request involving money or credentials."

Deepfake Social Engineering

Deepfakes AI-generated audio and video that impersonate real people have moved from novelty to weapon. In 2026, deepfake-enabled fraud is a documented and growing threat. Attackers clone the voice of a CEO and call the CFO authorising a wire transfer. They create video of an executive and use it in a video call to deceive a subordinate. The technology is accessible, the quality is convincing, and the traditional verification methods voice recognition, caller ID are no longer reliable.

The defence requires new verification protocols. Organisations must establish out-of-band verification for any financial transaction or sensitive action: a call back to a known number, a secondary approval, or a cryptographic verification. The assumption that "I heard the CEO's voice" is no longer sufficient evidence of identity. This is a policy and training challenge, not a technology challenge.

Autonomous Malware

The most concerning AI-powered threat is autonomous malware: malware that uses AI to adapt to its environment in real time. Traditional malware follows a predefined attack path. Autonomous malware can reconnaissance the target, identify the most effective attack vector, adapt to defensive controls, and select its own payload based on what it finds. This makes it significantly harder to detect and defend against, because the attack does not follow a known signature.

Autonomous malware is still emerging, not ubiquitous. But the trajectory is clear: as AI capabilities become more accessible, attackers will use them to build malware that is more adaptive, more evasive, and more effective. The defence is not a single tool it is a defence-in-depth architecture that limits what any malware, however intelligent, can accomplish.

Adversarial AI

A less discussed threat is adversarial AI: attacks that target the AI models themselves. An attacker can poison the training data of a security model to make it miss specific threats. They can craft inputs that cause a detection model to misclassify malicious activity as benign. As organisations deploy AI in their own security tools, these tools become targets. Securing AI models is a new discipline that most security teams are not yet equipped for.

AI does not change the fundamentals of security it compresses the timeline. What used to take an attacker days now takes minutes. The defence must compress its timeline too.

Codesigns Cybersecurity & AI Practice

The AI Defence Stack

AI-Powered Threat Detection

The most mature application of AI in defence is threat detection. Traditional security tools rely on signatures known patterns of malicious activity. AI-powered detection uses behavioural models to identify anomalies: activity that deviates from the baseline, regardless of whether it matches a known signature. This catches new attacks that signature-based tools miss. The most effective detection combines both: signatures for known threats, AI for unknown threats.

The key to AI-powered detection is data. A detection model is only as good as the data it learns from. Organisations that centralise their security data in a data lake and feed it to detection models get better results than those that rely on the data embedded in individual tools. This is why security data infrastructure is becoming a strategic investment, not just an operational one.

Automated Response

Detection without response is just observation. AI enables automated response: when a threat is detected, the system takes action without human intervention. Isolate the affected endpoint. Suspend the compromised account. Block the malicious IP. This reduces response time from hours to seconds, which is the difference between a contained incident and a spreading one.

Automated response requires trust in the AI, and that trust must be earned. Organisations should start with low-risk automated actions (e.g., blocking a known-malicious IP) and expand to higher-risk actions (e.g., isolating an executive's laptop) as the model's accuracy is proven. The playbook should always include human oversight for high-impact actions, with the AI handling the volume and the human handling the judgment.

AI-Augmented Security Operations

Security operations centres (SOCs) are overwhelmed. The volume of alerts exceeds human capacity, and the talent shortage means teams are understaffed. AI augments the SOC by triaging alerts, prioritising the most important, and providing context for investigation. An analyst who used to spend the first hour of their shift reviewing alerts can now focus on the ones the AI has flagged as high-priority, with the context needed to act immediately.

This is not replacing the analyst it is elevating them. The AI handles the volume; the human handles the judgment. The result is a SOC that can process more alerts, respond faster, and focus its scarce human talent on the decisions that require human judgment. Organisations that deploy AI-augmented SOCs see a 40-60% reduction in mean-time-to-respond and a significant improvement in analyst retention, because the work becomes more interesting and less repetitive.

AI-Powered Threat Intelligence

Threat intelligence is the foundation of proactive defence. AI transforms threat intelligence from a manual research activity into an automated, continuous process. AI models can ingest and correlate threat data from thousands of sources, identify emerging threats before they reach the organisation, and map them to the organisation's specific attack surface. This shifts the organisation from reactive to proactive: defending against threats before they arrive, rather than responding after.

Securing AI Itself

As organisations deploy AI in their security tools and business applications, the AI itself becomes an attack surface. Model poisoning, prompt injection, data exfiltration through model queries, and adversarial inputs are all documented attack vectors. Securing AI requires a new set of controls: model validation, input sanitisation, output filtering, and monitoring for adversarial patterns. Most security teams are not yet equipped for this, and it represents an emerging area of investment.

The governance dimension is equally important. AI in security must be explainable: when the AI flags an alert or takes an action, the security team must be able to understand why. Black-box AI that cannot explain its decisions is a liability, not an asset, because it cannot be audited, challenged, or improved. Explainability is not a feature it is a requirement for AI in security.

The Talent Imperative

The AI cybersecurity talent gap is the most acute in the industry. The roles required AI security engineers, ML security specialists, and AI-augmented SOC analysts require a combination of cybersecurity expertise, machine learning knowledge, and data engineering skills that almost no one possesses straight out of education. These professionals are built, not hired, and the organisations that invest in building them will have a structural advantage.

This is where the integrated talent model becomes essential. Organisations need to source AI security specialists for implementation, build internal capability for ongoing operations, and develop the data infrastructure that makes AI effective. Codesigns provides this integrated approach: we source the AI security talent, build the internal capability, and deploy the operating model that makes AI-powered security sustainable.

Looking Ahead: The AI Security Arms Race

• Autonomous defence: AI will move from augmenting human response to autonomous response, with AI handling the full detect-respond-recover cycle for common threats.
• AI-vs-AI: As attackers deploy AI, defenders will need AI to counter it. The security battlefield will become a machine-vs-machine contest, with humans setting policy and overseeing outcomes.
• Regulatory AI security: Governments will regulate AI in security, requiring explainability, auditability, and human oversight for AI-driven security decisions.
• Model security as a discipline: Securing AI models will become a recognised security discipline, with dedicated tools, frameworks, and talent.
• AI-powered deception: Defenders will use AI to create deceptive environments that trap and study attackers, turning AI from a defensive tool into an offensive intelligence tool.

Conclusion

AI is the most significant development in cybersecurity since the advent of the firewall. It changes both the threat and the defence, and the organisations that integrate AI into their security operations will compound their advantage over those that do not. The question is not whether AI will be part of your security posture it is whether you will be the one wielding it or the one attacked by it.

The answer requires more than tools. It requires the talent, the data infrastructure, and the governance to make AI in security trustworthy and effective. At Codesigns, we help you build that capability because the organisation that integrates AI into security first will not just defend better. It will define the battlefield.