The New Battlefield: AI in Cyber Attacks and Cyber Defence

In less than a year, the world has witnessed a stunning acceleration in the adoption and sophistication of artificial intelligence (AI). From a cybersecurity perspective, this transformation is both awe-inspiring and concerning. In this short series, I’ll explore some of the key aspects of this shift and its impact on cybersecurity. What was cutting-edge yesterday is now routine, and new breakthroughs are emerging faster than most organizations can adapt. AI isn’t just another technological advancement - it’s a fundamental turning point, a fork in the road that will shape cybersecurity operations in ways more profound than many of its predecessors. I am of course talking about generative AI, large language models and advanced machine learning.

Since the advent of publicly accessible large language models (LLM) and generative AI (GenAI) (arguably the watershed moment occurred in Nov 2022 with OpenAI’s introduction of ChatGPT 3.5 to the general public) I have been closely monitoring what has been taking place. I recall the first time I heard of “large language models” was in early 2020, shortly after OpenAI had opened up their GPT 2.0, 1.5B parameter model to the public in November 2019.

OpenAI's approach to releasing their GPT models demonstrated remarkable foresight about this technology's potential for misuse. In February 2019, after careful deliberation, OpenAI took a cautious approach with GPT-2 by initially releasing only their smallest 124M parameter version to the public, gradually expanding access to more advanced versions throughout 2019. This strategic release marked a significant shift, making powerful AI technology accessible beyond just research institutions and tech enthusiasts. Despite these precautions, most of OpenAI's feared misuse scenarios have materialized today. The guardrails and limitations now present in publicly available models are a case of closing the barn door after the horse has bolted.

For cybersecurity professionals, this history offers both perspective and urgency. We can appreciate the dramatic evolution in capabilities—from GPT-2 (comparable to a high school student's abilities) to today's GPT-4o (functioning more like a university professor). Of course, this comparison is relative—two years from now, we may well look back at GPT-4o as we do an old "Model-T Ford" today. This extraordinary pace of advancement underscores our critical mandate: we must simultaneously anticipate current risks while proactively reinforcing our defences to adapt to the rapidly evolving landscape of AI-driven security threats, capabilities, and tools.

Around six months ago, I first drafted an analysis of AI's role in cybersecurity, and as I realised that this whitepaper was never been published, I decided to take a step back to reassess where we are today. Just six months later, the AI landscape has transformed our profession at a breath-taking pace. What seemed cutting-edge last year has become table stakes, and new frontiers have emerged that demand our attention. Almost like Moore’s Law for the evolution of computer chips, IT professionals need to adopt a highly dynamic approach to security; akin to being in a marathon where running fast simply means keeping up with the others. Standing still and waiting for clarity should not be on any company’s strategic agenda.

This first instalment of my multi-part article series examines how AI has reshaped cyber threats and defences, exploring the forces driving these swift changes and laying the groundwork for deeper dives into the evolving regulatory, technological, and strategic landscape. Given the extraordinary pace of advancement we're witnessing, I fully expect to be rewriting this entire analysis by 2026 - a testament to both the challenge and excitement of operating at the frontier of AI and cybersecurity.

After closely monitoring and analysing the developments in AI over the past year, I've identified three critical observations that characterize the current AI cybersecurity landscape. These observations reflect not just incremental changes but fundamental shifts that are redefining our approach to digital security.

Observation 1: Acceleration of AI Capabilities - A Double-Edged Sword

Perhaps the most striking shift in recent months is the exponential growth in AI capabilities, fuelled by ever-more-powerful large language models (LLMs) and specialized machine learning frameworks. Security-focused variants of these models are popping up on both sides of the fence:

• Threat Actor Tooling
  Criminal groups now have ready access to off-the-shelf and bespoke AI kits that automate reconnaissance, vulnerability scanning, exploit generation, reverse engineering, and lateral movement across a target environment. What used to require specialized expertise can now be accomplished by operators with minimal technical background. The learning curve for sophisticated attacks has plummeted, and the pace of new threat activity has soared.

• Democratization of defence
  On the flip side, security teams can harness commercial AI platforms to bolster their defences. From real-time anomaly detection and automated patch prioritization to advanced forensic analysis, AI offers new ways to stay ahead of adversaries. The ability to process millions of signals within seconds - combining diverse data streams like threat intelligence feeds, network logs, and user behavioural profiles - can dramatically shorten the window of opportunity for attackers.

This democratization of AI is simultaneously an equalizer and an amplifier: smaller organizations gain access to enterprise-grade protections, while lesser-skilled attackers are supercharged by cutting-edge tools. The net result is an arms race that shows no signs of slowing.

Observation 2: Transformation of Threat Profiles - New Classes of AI-Driven Attacks

While automated attacks and AI-powered phishing kits were already on the rise, new developments enabled by this new technology are fundamentally changing the threat landscape, capturing the attention of security experts Here are three that keep me awake at night:

• Autonomous Attack Platforms: We're witnessing the emergence of fully autonomous offensive systems that identify vulnerabilities, pivot around network defences, and tailor exploits in near real-time. These platforms leverage machine learning to analyse target environments, prioritize high-value assets, and orchestrate multi-stage attacks without human intervention. Traditional "patch and protect" paradigms become increasingly inadequate when facing adversaries that adapt on the fly at speeds no human defender can match.

• Hyper-realistic Social Engineering: Through high-quality voice cloning and convincing deepfakes, AI has made distinguishing real from synthetic nearly impossible. Modern attacks analyse targets' digital footprints to craft personalized deception strategies tailored to an individual's role, communication style, and context. These attacks can mimic writing styles and conversational patterns of trusted contacts, significantly boosting success rates and adapting in real-time to overcome suspicion.

• Evasive Malware: AI-enhanced malware represents a significant evolution in the threat landscape, using machine learning to dynamically adapt its behaviour, signatures, and execution patterns. These threats modify themselves to evade detection, leverage legitimate system tools, and employ polymorphic capabilities that render traditional signature-based defences obsolete. The asymmetric advantage for attackers requires defenders to implement more sophisticated behavioural analysis, AI-powered security systems, and multi-layered defence strategies.

For many security teams, these threats push the envelope of what was previously considered possible. The focus is no longer just on patching systems but on staying ahead of an adversary that can continuously morph and evolve at high speed - currently faster than our “default” IT operations are able to patch and risk mitigate. In this rapidly evolving threat landscape, strong security fundamentals become more critical than ever; rigorous access controls, comprehensive asset inventory, regular security awareness training, and diligent patch management form the essential foundation.

Moreover, traditional defences like signature-based antivirus solutions are increasingly inadequate on their own. Organizations must pivot toward advanced endpoint detection and response (EDR or XDR) platforms with behavioural analysis capabilities, AI-powered security operations centres, and zero-trust architectures that assume breach and verify continuously. The most effective defence strategies will combine human expertise with advanced technological countermeasures to detect, respond to, and mitigate these increasingly sophisticated AI-driven threats.

Observation 3. The Evolution of Defensive Capabilities: AI-Powered Countermeasures

Despite the grim picture painted above, defenders have not been idle. AI-based solutions are rapidly changing the way organizations approach security operations, incident response, and long-term risk management. At the bleeding edge, three areas stand out:

• Predictive Threat Intelligence
  Modern AI-driven threat intelligence platforms scavenge the clear, deep, and dark web, identifying malicious chatter, new exploit frameworks, and emerging attacker techniques. By analysing threat signals in real time and correlating them with known vulnerabilities, these systems can forecast impending attacks days or weeks before they become mainstream - a critical edge in proactive defence.

• Self-Healing Systems
  The concept of adaptive, self-healing architectures has evolved from theory to practice. Rather than waiting for human intervention, these AI-augmented environments automatically isolate compromised endpoints, spin up temporary decoys to divert adversaries, and even initiate patching or configuration changes to harden vulnerabilities. All of this happens while business services remain operational, minimizing disruption.

• AI-Human Teaming
  Beyond pure automation, the most successful defensive strategies hinge on collaboration between AI and human analysts (Human-in-The-Loop). Humans provide the creativity, contextual understanding, and ethical oversight, while AI excels at pattern recognition, large-scale data crunching, and lightning-fast responses. In many Security Operations Centres (SOCs), human experts now handle strategic judgments and incident prioritization after AI has filtered and categorized the tidal wave of alerts.

The evolution of defensive capabilities shows promise, but this is just the beginning of a profound transformation in the cybersecurity landscape. As AI continues to reshape both attack and defence strategies, security professionals must develop a comprehensive understanding of these changes across multiple domains.

Preview of Series Topics

This article sets the stage for a deeper dive into how AI is fundamentally altering both the technical mechanics and the strategic decision-making behind cybersecurity. In subsequent instalments of this series, we will explore

1. Regulatory & Compliance Realities
   Navigating the emerging legal frameworks for AI—such as the EU AI Act—and how they impact both defensive and offensive security measures.

2. Advanced Tactics in the AI Arms Race
   An up-to-date look at cutting-edge attack techniques and how defenders can leverage adversarial machine learning, AI Red Teams, and more.

3. AI-Driven Identity & Zero Trust
   The role of AI in continuous authentication, biometric security, and dynamic micro-segmentation.

4. Futureproofing for the Next Wave
   From quantum computing to AI supply chain security, we’ll examine looming trends that demand proactive strategizing.

Don’t see this list as definitive or exhaustive as I have come to realise that as one article is written, there are new topics I need to address.

By staying current on the rapid AI advancements and understanding the shifting threat profiles, cybersecurity leaders can make informed choices about defence investments, staffing, and strategic policy. As the battlefield continues to evolve, the organizations most likely to thrive are those that blend innovative AI capabilities with seasoned human expertise. We must never losing sight of the fact that, while AI can automate processes, it’s the human element that provides context, ethics, and the final critical judgment.

Conclusion and Invitation

The interplay of AI and cybersecurity is reshaping everything from threat hunting to compliance. Attackers and defenders alike are locked in a cycle of continuous innovation, and the stakes have never been higher. In this new era, success belongs to those who actively leverage AI as a force multiplier while recognizing its limitations and potential pitfalls. Failing to integrate AI-driven security today means falling behind tomorrow. Although sounding like a cheap slogan, the time to act really is now.

In the next article, we’ll examine how emerging regulatory standards are imposing new obligations - and sometimes new opportunities - for organizations integrating AI into their security operations and tooling. Until then, I’d love to hear from you: Which aspects of AI-driven threats and defences are you most concerned about? Share your perspectives in the comments, and let’s keep the conversation going.