Did AI Kill Cybersecurity?

Summary

AI has not killed cybersecurity, but it has changed who moves first and how fast.

In a DataCamp panel titled "Did AI Kill Cybersecurity?", four security leaders worked through a question the industry keeps dodging: in AI cybersecurity, has generative AI helped attackers or defenders more? The panel brought together Michael Fanning, CISO at Splunk; Marshall Heilman, CEO at Dtex and a seventeen-year Mandiant veteran; Mike Mestrovich, CISO at Rubrik and formerly CISO at the CIA; and Cynthia Overby, who leads cyber resilience work at Rocket Software.

Their read was consistent. Today the edge sits with attackers, mostly because of speed. Phishing has gone multilingual and high-volume, the barrier to entry has dropped, and attacks that once took a team weeks now run in minutes. Nothing genuinely new has appeared yet. Attackers are running familiar plays faster.

Most of the hour went to what changes next. AI agents now act inside enterprises with real access and no judgment, which makes them a new class of insider risk. Malware can query an internal model and rewrite itself as it moves between systems. Defenders face tens of thousands of non-deterministic identities they cannot test the old way. The agreed fix is unglamorous: identity, segmentation, rehearsed recovery, and letting agents act only where the damage stays contained.

This article summarizes the discussion. Watch the full recording for the specific cases and the disagreement over how much control to hand machines.

Key Takeaways

• Today the advantage goes to attackers, and speed is the reason: AI compresses attacks that once took a team weeks into minutes.
• No new category of attack has emerged yet; AI mostly accelerates and scales techniques defenders already know how to fight.
• AI agents behave like insiders with system access and no judgment, so a well-intentioned agent can leak data simply by choosing the wrong place to save a file.
• Malware that queries an internal model and rewrites itself between machines is now real enough to defeat signature-based detection.
• AI threat detection is shifting from spotting overtly malicious actions to reading the intent behind behavior, for humans and agents alike.
• Identity is the highest-leverage control: the panel cited that up to 80 to 90 percent of attacks involve a compromised or abused identity.
• Bounded autonomy works: automate where a regression pipeline or a quarantine limits the damage, and keep a human on any change that could take customers offline.
• The organizations that recover fastest are the ones that have rehearsed recovery, not the ones that manage to avoid every attack.

Deep Dives

The advantage today belongs to attackers, and the reason is speed

Asked whether AI has helped attackers or defenders more, the panel agreed on the short-term answer. Mike Mestrovich, now CISO at Rubrik after directing cyber defense at the CIA, said that "initially, it has primarily helped the attackers." Generative AI made phishing more convincing, produced it in fluent native language, and let low-skill actors run high-volume campaigns. The barrier to entry dropped while the sophistication of attacks climbed, without demanding a matching rise in skill.

Marshall Heilman, CEO of Dtex, tied the attacker's edge to an old asymmetry that AI has sharpened. A defender has to cover everything, while "as a attacker, you only really have to find one," he said. What is different now is tempo. AI-enabled attacks fold work that used to take ten people weeks into minutes. His prescription was blunt: you fight speed with speed. Once internal models mature and teams trust agents to block at machine speed, he argued, the advantage swings back to the defense.

Mestrovich made the longer-term case in structural terms. He counts three ways attackers get in: stolen or compromised credentials, software defects, and configuration errors. AI can go after the last two at a scale defenders never had before, finding and fixing bugs and misconfigurations across large estates. "I think this technology has a significant benefit for the cyber defenders," he said, a benefit that takes time to bank but changes the math. The panel's framing for anyone weighing AI in cybersecurity was that attackers versus defenders is not a fixed verdict. It is a race, and the lead belongs to whoever turns speed into practice first. For now, the side without compliance reviews and change windows is winning it.

Why AI agents are the new insider threat

The strongest agreement of the session was that securing AI agents is now an insider-risk problem. Heilman, whose company works insider cases daily, said most of what they see is negligence rather than malice: someone uploading data they should not, or reaching for access they were never meant to have. AI agents fit that pattern exactly. "They have access to data. They have access to systems, and they're being asked to do things but they have no judgment involved," he said.

He gave a specific case. A publicly traded company let a team build an agent to assemble financial briefings for investor conferences. The agent collected the data, built the presentations, and emailed them to the team. Every visible step was correct. The problem sat one layer down: to email a file, the agent had to save it first, and it picked a random share drive that "happened to be publicly accessible to the entire world." Only active monitoring caught it before the material leaked. No one had thought to ask how the agent was carrying out the instructions, because the output looked right.

Mestrovich scaled the worry up. Every agent an enterprise deploys is another non-human identity acting on its own goals, and there are now tens of thousands of them. You cannot test them the way you tested scripts, because ask an agent to do the same thing three times and it will find three different routes. "The permutations that you have to test are...infinite," he said. He listed agents that published data they should not have, deleted records, and invented figures a company then had to stand behind: they "hallucinated, and they came up with erroneous data that the companies then had to honor because it was published as...company fact." The lesson both drew is that agent security starts with treating agents as identities, watching what they actually do, and never assuming correct output means correct behavior.

Malware that rewrites itself, and detection that reads intent

On AI threat detection and response, Heilman picked the development he finds most striking: malware that changes itself. For years the idea was fiction. "Years ago, people used to talk about polymorphic malware. Malware that could change on its own," he said, and after leading a malware reverse-engineering team, he could confirm it did not really exist. That has changed. Modern samples can call a model and act on the reply, so "it can actually leverage an internal LLM to change how it operates based upon the answers coming back based on what it sees in that environment." A sample can land, alter itself before moving to the next machine, and keep going, which makes finding every instance across an estate far harder.

He connected this to an older tactic he saw from state actors: plant something quiet on a system nobody watches, run the real attack elsewhere, and return months later through the forgotten implant. AI makes that style of persistence cheaper and easier to hide, because the payload can shift daily on systems no one inspects.

If the code no longer looks the same twice, signatures stop working, so detection has to move to behavior. Heilman's team looks for intent rather than known-bad strings. "What is the intent behind the action?" is the question, whether a person or an agent took it. Watching the full chain, the prompt a person gives an agent, the request the agent sends the model, the response, and the resulting action, lets defenders reconstruct what someone actually meant to do. That matters more now, he added, because it is easier than ever to coerce an employee into harm and pin it on an agent. The second move he pushed for is using internal agents to review long spans of history that no analyst could read, surfacing the one account behaving unlike itself across six months of logs.

Where to trust automation, and where to keep a human

The panel split, productively, on how much to automate. Cynthia Overby argued that judgment stays essential and that most current risk comes from internal mistakes rather than outside attackers. Her instincts come from the mainframe world, where change and patch management are matters of discipline and nothing ships until it has been evaluated and tested. "It's not the world of cowboys," she said, and she does not believe push-button response without human oversight is close.

Heilman agreed the answer today sits in the middle, while being honest about the direction. "You can't fight something operating machine speed with someone operating human speed," he said, so over time more control has to pass to agents. The way to do that safely is to bound it. Rather than let an agent take sweeping action across an environment, mature teams quarantine a single machine or account the moment something looks wrong, so a mistaken block hits one user instead of three hundred thousand.

Mestrovich drew the line around reversibility. He would not yet trust fully autonomous defensive action everywhere, but he already runs it where the work is bounded: AI finds software vulnerabilities, proposes patches, and pushes them into the pipeline, currently with roughly a quarter to a third of discovered vulnerabilities patched automatically. The reason he is comfortable is the safety net. "You have an automated testing pipeline where you have the ability to fall back if something goes wrong," he said, which is the same bar a human change would have to clear. Fanning added the operational frame: rank agent actions by severity the way you rank any other change. Quarantining an endpoint is low-stakes and fine to automate. Rotating a credential or auto-remediating source code can knock customers offline or slip a regression past QA, so those keep a human in the loop.

The unglamorous fundamentals that decide outcomes

Pressed on what actually separates strong programs, every panelist returned to basics rather than new tooling. Fanning put identity first, citing that "up to eighty, ninety percent of all attacks involve some type of a compromised or abused identity." Identity and access management, vulnerability management, and endpoint detection feeding a capable SOC were, in his view, the controls to protect when budgets tighten, and manual, high-overhead nice-to-haves were the first to cut. Mestrovich made the same point about identity from the other direction: it used to be a sleepy backwater, and now "that's the new game." Years of over-provisioning access to avoid friction, human and non-human alike, is the debt teams now have to pay down.

Overby's list for clients was equally plain: multi-factor authentication, least privilege, continuous phishing training with real consequences, and rehearsed recovery. She and Mestrovich both stressed practicing recovery for real, taking systems down and restoring them, because the plan on paper never survives contact. As she put it, "organizations that perform the best are not those that never get attacked...they're the ones that detect and contain attack fastest," and the fastest to recover are the ones who have done it over and over.

On where to point energy next, the advice was steady rather than dramatic. Fanning told teams to "operate with a...sense of urgency, but not a sense of panic, and there's a difference between the two," and said there is no secret sauce, only doing known fundamentals better and faster. Heilman urged organizations to track how quickly AI capability is moving, since what was true last week may not hold this week. Mestrovich told everyone to lean into AI or risk being left behind by attackers already using it. Overby offered the optimistic close: AI can move security from reactive cleanup to catching suspicious behavior a human would never spot, which should help smaller teams most of all.