Why artificial intelligence and cybersecurity now move together
Artificial intelligence and cybersecurity are now closely linked because AI is both a defensive tool and a new attack surface. In 2026, the main issue is not whether every cyberattack is fully autonomous. The more immediate change is that AI helps attackers move faster, personalize deception, test code, and exploit weak identity controls. At the same time, it gives defenders better ways to triage alerts, analyze malware, search logs, and speed up incident response.
This creates a speed gap. Organizations that add AI without governance may expand their exposure. Organizations that combine AI with identity controls, data security, secure development, monitoring, and tested response plans are better positioned to manage that risk.
For readers following the wider security market, this shift makes AI security less of a future topic and more of a board-level operational concern. Roadsnews will continue tracking related developments in the Cybersecurity section.
What changed from experimentation to operational use
Through 2024 and early 2025, many reports described malicious use of generative AI mainly as a productivity boost: better phishing text, faster reconnaissance, code troubleshooting, translation, and basic automation. By 2026, threat-intelligence reporting had become more direct. Google Threat Intelligence Group said in a May 11, 2026 report that adversarial use of generative models was maturing from early experimentation toward industrial-scale workflows, including vulnerability discovery, exploit development support, defense evasion, and attacks against AI systems themselves.
That does not prove every attacker has advanced AI capability. It does show that defenders can no longer treat AI misuse as a novelty or a narrow phishing problem.
IBM’s July 29, 2026 Cost of a Data Breach reporting added a business-impact view. IBM said one in four malicious breaches in its studied population were AI-enabled, a 56% increase over the prior year, and that these incidents averaged about $6 million in cost compared with a $4.99 million global average breach cost. IBM also reported that more than 20% of organizations experienced a breach targeting AI models or applications, often tied to compromised APIs, applications, plug-ins, or cloud misconfigurations. The pattern is important: many AI incidents are still rooted in familiar weaknesses around access, configuration, software, and governance.
Social engineering is changing as well. Gartner reported on September 22, 2026 that, in a survey conducted from March to May 2026, 41% of surveyed CISOs had seen at least one social engineering incident involving a deepfake during an employee audio call in the prior 12 months, while 36% reported one during a video call. The defensive takeaway is not that employees must become media-forensics experts. It is that high-risk requests now need trusted verification channels, phishing-resistant authentication, and workflow controls that do not depend on spotting poor grammar or suspicious audio.
The new AI attack surface is larger than the model
AI security is often discussed as if the model is the only asset that matters. In practice, the attack surface includes training data, fine-tuning data, prompts, retrieval systems, vector databases, APIs, plug-ins, cloud permissions, agent tools, logs, model endpoints, third-party providers, and the humans who rely on outputs.
A prompt injection issue may become serious only because the application allows the model to call a privileged tool. A data poisoning issue may matter because the model retrieves untrusted documents from a weakly governed knowledge store. A privacy issue may arise because sensitive data is copied into a tool with unclear retention or access rules.
The OWASP 2025 Top 10 for large language model and generative AI applications is useful because it frames AI risk in application-security terms. Its categories include prompt injection, sensitive information disclosure, supply-chain risk, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. These risks overlap with traditional software security, but they also add failure modes around model behavior, retrieval context, and autonomous action.
| Risk area | Why it matters | Practical control |
|---|---|---|
| Prompt and input manipulation | Untrusted instructions can influence model behavior or downstream actions. | Validate inputs, separate instructions from data, restrict tool calls, and test abuse cases. |
| Data and retrieval poisoning | Compromised training, fine-tuning, or retrieval content can mislead outputs. | Control data sources, scan changes, use content provenance, and monitor retrieval results. |
| Excessive agency | Agents with broad permissions can take damaging actions at speed. | Use least privilege, human approval for high-impact steps, sandboxing, and rollback controls. |
| Model and data exposure | AI systems may reveal secrets, regulated data, intellectual property, or training artifacts. | Classify data, enforce access controls, redact sensitive inputs, and monitor outputs. |
| Cost and service exhaustion | Attackers may abuse inference workloads, APIs, or token consumption. | Apply rate limits, anomaly detection, budget controls, and denial-of-service planning. |
Where AI is helping defenders
Defensive AI is most valuable where it reduces time and workload without removing accountability. Common uses include alert clustering, log search, malware explanation, phishing analysis, detection-rule drafting, vulnerability prioritization, threat-intelligence summarization, and incident timeline reconstruction. These applications do not replace analysts. They compress repetitive work so analysts can spend more time validating evidence, choosing response actions, and communicating risk to the business.
IBM’s 2026 breach reporting said organizations using AI and automation extensively in security achieved average savings of about $1.93 million compared with organizations using none. SANS also reported in its 2026 AI in Cybersecurity research that active AI use in cybersecurity rose sharply, but only a minority of practitioners considered their deployment mature.
That maturity gap matters. AI can improve response speed, but it can also create false confidence if outputs are not validated, logged, and tested against real operational workflows.
The strongest defensive pattern is supervised acceleration. Analysts should be able to see what evidence the system used, why it recommended an action, which assets are affected, and what approval is required before containment, blocking, reset, or remediation steps occur. The more automated a security workflow becomes, the more important identity, auditability, rollback, and change control become. See also: AI.
Governance is becoming the control plane
Several public frameworks now point in the same direction: AI risk management should be integrated with existing cybersecurity programs rather than treated as a separate experiment. NIST’s AI Risk Management Framework 1.0, published on January 26, 2023, organized risk activity around governance, mapping, measurement, and management. On July 26, 2024, NIST released the Generative AI Profile and SP 800-218A, a secure software development profile for generative AI and dual-use foundation models. Those publications pushed organizations toward lifecycle controls, secure development practices, and explicit treatment of generative AI risks.
NIST then published the initial preliminary draft of IR 8596, the Cybersecurity Framework Profile for Artificial Intelligence, on December 16, 2025, with public comments due January 30, 2026. Its focus areas include securing AI system components, conducting AI-enabled cyber defense, and thwarting AI-enabled cyberattacks. That structure is useful because it recognizes three realities at once: AI systems must be protected, AI can strengthen defense, and AI can amplify adversary activity.
CISA and partner agencies have followed a similar path. CISA released its Roadmap for Artificial Intelligence on November 14, 2023. CISA, the UK National Cyber Security Centre, NSA, and other partners issued secure AI system development guidance in November 2023. In April and May 2026, CISA, NSA, and other Five Eyes partners released guidance on careful adoption of agentic AI services, emphasizing alignment with existing cybersecurity frameworks, limits on autonomy, layered defense, strong identity management, oversight, threat modeling, monitoring, and regular security assessment.
The message is consistent: AI security is security engineering, identity governance, data protection, and operational resilience applied to a faster and more complex environment.
A practical security roadmap for 2026
Security leaders do not need to solve every AI risk at once, but they do need a structured plan. The following priorities can help organizations turn broad AI concern into measurable action.
- Build an AI inventory. Track approved and unapproved AI tools, embedded AI features in SaaS platforms, internal models, third-party models, APIs, agents, data flows, owners, and business purposes.
- Classify use cases by impact. A summarization tool for public content should not carry the same approval process as an agent that can modify infrastructure, approve payments, access customer records, or change security settings.
- Secure identities and permissions. Apply least privilege to users, service accounts, APIs, plug-ins, and AI agents. Non-human identities need ownership, credential rotation, audit logs, and runtime enforcement.
- Protect data before it reaches the model. Use data discovery, classification, masking, retention rules, and access controls. Do not rely on acceptable-use policies alone to prevent sensitive data exposure.
- Test prompts, outputs, and tool calls. Red-team prompt injection, unsafe retrieval, excessive agency, data leakage, and output handling. Test how the application behaves when the model is wrong, manipulated, or unavailable.
- Monitor behavior continuously. Log prompts, retrieved context, model responses, tool use, permission changes, API calls, and high-risk decisions in a way that security teams can search and investigate.
- Strengthen supplier and software controls. Review vendors for data handling, model access, plug-in security, incident notification, logging, and control evidence. Apply secure development practices to internal AI applications.
- Update incident response. Add scenarios for prompt injection, agent compromise, model or data leakage, poisoned retrieval sources, deepfake-enabled fraud, and AI-assisted phishing. Run tabletop exercises before a real incident.
What security leaders should not assume
First, do not assume AI removes the need for fundamentals. Most current AI-related incidents still intersect with identity, APIs, cloud configuration, software supply chains, data exposure, and human approval workflows. Second, do not assume employee awareness training is enough. AI-driven social engineering can cross email, voice, video, messaging, and collaboration platforms, so verification must be built into business processes. Third, do not assume vendor AI features are automatically governed. Many AI capabilities arrive as product updates inside tools already used by the business, which means procurement, security, privacy, and legal teams need a shared review process.
Finally, do not treat AI governance as paperwork. Useful governance defines who owns a system, what data it can use, what actions it can take, how it is monitored, when a human must approve, how incidents are reported, and when the system should be paused or rolled back. In 2026, the organizations that benefit most from AI in cybersecurity will be the ones that pair automation with control.
Frequently asked questions
Is AI making cybersecurity better or worse?
Both. AI helps attackers scale deception and speed up technical workflows, but it also helps defenders search, summarize, detect, and respond faster. The outcome depends on whether organizations deploy AI with strong governance, identity control, data protection, testing, and monitoring.
What is the biggest cyber risk from AI?
The biggest practical risk is not one single model flaw. It is uncontrolled deployment: unapproved tools, sensitive data exposure, excessive permissions, weak API security, poor logging, and agents that can act without clear oversight. These weaknesses can turn ordinary security gaps into faster-moving incidents.
How should companies secure AI agents?
AI agents should be treated as high-risk software and non-human identities. They need least privilege, approved tool lists, sandboxing, human approval for consequential actions, detailed logging, rollback plans, and regular red-team testing. Autonomy should increase gradually only after controls are proven.
Is AI-generated phishing still the main concern?
AI-generated phishing remains important, but it is no longer the only concern. Deepfake impersonation, AI-assisted malware, automated reconnaissance, exploit support, prompt injection, poisoned retrieval content, and attacks against AI applications are now part of the broader risk picture.