AI didn’t change what attackers want. It changed what it costs them to get it. People ask me whether AI is…
Laurent H. — CEO & Founder CYBERR & HEELR
AI didn’t change what attackers want. It changed what it costs them to get it.
People ask me whether AI is good or bad for security. I think that’s the wrong question. The better question is: who gets more out of each dollar spent on AI? Right now, the answer depends on where you’re standing.
Inside your systems, defenders have the edge. Your logs, your traffic, and your users’ normal behavior are data an attacker can’t fully see. Models trained on that data catch anomalies in minutes, not weeks. IBM’s 2025 breach report found that organizations using AI and automation extensively saved about $1.9M per breach and contained incidents months faster.
At the human layer, attackers have the edge. A cloned voice or a deepfaked executive costs almost nothing to produce, and the person on the receiving end has to work out what’s real, usually under time pressure. Arup lost roughly US$25M after an employee joined a video call in which every “colleague” was synthetic. No system was breached. No alert fired.
So the strategy isn’t “buy more AI.” It’s three things:
Automate the parts machines can actually verify, such as detection, patch testing, and anomaly triage.
Redesign the parts only humans can verify. No payment moves on a single call or video.
Use callbacks to known numbers. Require two approvers.
Give people the authority to say “let me check.”
Govern your own AI use. Shadow AI tools and weak access controls are quickly becoming the breach.The tools are the same for both sides. The process around them is where you win.What’s one control your team added this year because of AI-driven threats?
#Cybersecurity #AI #CISO #Leadership
10 reactions · 5 comments
Topics: #leadership, #ai, #ciso, #cybersecurity
Comments
Schomer: Excellent piece. The Arup example proves that the legacy perimeter is completely blind to identity-based impersonation. The control that moves the needle isn't adding another passive security layer; it’s building a hardened ingestion and validation pipeline that runs below the application layer. When you automate patch testing and anomaly triage deterministically, you take the human error out of t
James W.: Its not a matter of 'is AI bad' as that question is just far to broad on its face. Personally, I despise LLM but love Agentic models. Additionally, regardless of personal feelings on the issue everything regarding AI needs to be taken in context; how its configured/deployed, what is the basic ask, are there correct guidelines and guardrails placed upon the engine, and most importantly should this
Schomer: Appreciate the perspective, James. You hit on the exact reason why I separate the roles of AI and strict logic in this framework. Agentic models excel at high-context anomaly triage and dynamic pattern matching—capabilities standard LLMs struggle with in high-stakes environments. However, even the best agentic systems introduce a degree of non-determinism. That is why the control plane must be dec
Ravimurthy M.: Physical AI in OT: Unlocking Industrial Intelligence While Preserving Safety, Security and Operational Resilience Physical AI represents a fundamental evolution in Operational Technology, moving industrial environments from traditional automation and human-led decision-making towards intelligent systems capable of perceiving, reasoning, optimising and, increasingly, acting upon physical processes
Ben N.: Great article, Laurent! You absolutely nailed it — especially your take on how AI is reshaping the landscape. Sharp insights and spot‑on analysis.”