Topic starter
02/08/2026 12:07 pm
TL;DR: AI-assisted phishing attacks have surged 1,265% and AI-generated emails now achieve a 54% click-through rate, while organisations using AI and automation extensively cut breach costs by $1.9 million and shortened breach lifecycles by 80 days, according to Torq and IBM. The security value has moved from summarisation to governed execution, because the real operational gap is not insight but action.
Editorial analysis by NHI Mgmt Group, based on content published by torq: “GenAI in Cybersecurity: Opportunities, Risks, and What Comes Next”.
By the numbers:
- AI-generated phishing emails now achieve a 54% click-through rate, according to torq.
- Organizations using AI and automation extensively reduced their breach lifecycle by 80 days, according to torq.
Key questions
Q: What breaks when an AI agent can act inside the SOC without clear boundaries?
A: The failure is governance, not speed.
Q: Why do autonomous service workflows increase identity risk in IT operations?
A: Because they compress decision time and hide privilege decisions inside process automation.
Q: What are the signs that an AI SOC workflow is too opaque to trust?
A: The main warning signs are summary-only outputs, missing source references, unclear query provenance, and no way for analysts to replay the investigation.
Practitioner guidance
- Define where GenAI may act versus advise Map each SOC use case into advise-only, human-approved action, or bounded autonomous execution so the control model matches the risk.
- Scope AI agents to dedicated service identities Give every AI workflow a non-human identity with narrow permissions, short-lived credentials, and full logging for every tool call.
- Require auditable decision trails for all AI-driven actions Log the input, reasoning output, approval state, and resulting action for every case closed, ticket opened, or containment step taken.
Bottom line: Generative AI is changing security operations by shifting value from summaries and recommendations toward governed action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:12 pm
Governed execution is the new dividing line in security AI. Summarisation, enrichment, and recommendation are no longer enough once a system can trigger downstream action. The security function now depends on whether the AI is operating inside a bounded workflow with auditable outcomes. For identity and access programmes, that means the control question shifts from what the model knows to what identity it can act through, and under what approval model.
A few things that frame the scale:
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Should organisations let AI agents take containment actions automatically?
A: Only with tightly bounded use cases and strong preconditions. Containment actions can have business impact, so the safer model is human approval for high-risk steps, machine assistance for evidence gathering, and clear rollback procedures if the agent misclassifies a case or lacks context.
👉 Read our full editorial: Generative AI is shifting cybersecurity from summaries to execution