Topic starter
11/11/2026 6:05 pm
TL;DR: AI improves defender speed, but WithSecure says the security gain depends on data integration, process fit and the ability to act on findings. Security operations become brittle when tooling outpaces remediation and incident response.
Editorial analysis by NHI Mgmt Group, based on content published by WithSecure: “AI in Cyber Defense: Why Having AI Doesn’t Mean Being Secure”.
Key questions
Q: Why does faster AI detection fail to improve security automatically?
A: Faster AI detection does not improve security automatically because detection only surfaces suspicious activity.
Q: How should security teams govern AI in cybersecurity operations?
A: Security teams should govern AI in cybersecurity operations as a workflow control, not just a detection feature.
Q: How do agentic AI systems change attacker operations?
A: Agentic AI changes attacker operations by letting one human coordinate research, phishing, malware development and exploitation steps with machine assistance.
Practitioner guidance
- Map AI exposure across security workflows Inventory where AI influences detection, triage, code review and remediation so leaders can see which processes now depend on machine output.
- Measure remediation throughput against AI output speed Compare the rate of vulnerability discovery with the rate of review, fix and validation to identify where AI is only expanding backlog.
- Update incident response for AI dependency Test whether incident handling still works when an AI service is unavailable, delayed or produces low-confidence results in the middle of an event.
Bottom line: AI is now a two-sided force in cyber operations, helping defenders while also lowering the effort required for complex attacks.
Glossary terms: Agentic AI, AI-Assisted Automation, Vulnerability Management, Incident Response
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:08 pm
AI has moved from support function to operational dependency in cyber defence. The important shift is not that AI can help analysts, but that organisations increasingly depend on it to compress tasks that were previously slow and specialist-heavy. That changes the control question from adoption to governance. Security leaders now need to understand where AI improves decision-making and where it creates blind trust in outputs that the organisation cannot verify or action reliably.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between AI assistance and agentic AI?
A: AI assistance generates or suggests output for a human to review and act on, while agentic AI can independently plan and execute multi-step actions within defined permission boundaries. The key difference is delegated runtime authority: an agent may call tools, access data, or trigger workflows without step-by-step human input, so scope limits, approvals, logging, and revocation matter.
👉 Read our full editorial: AI strengthens cyber defense only when teams can act on it