Notifications
Clear all
Topic starter
11/07/2026 1:56 pm
TL;DR: AI is now widely embedded in security operations, but its value is strongest in summarisation, prioritisation, and pattern recognition rather than direct enforcement, according to Zero Networks. The critical issue is not whether AI can analyse faster, but whether its outputs are anchored to deterministic controls that actually contain risk.
NHIMG editorial — based on content published by Zero Networks: The Role of AI in Cybersecurity, Promises, Pitfalls, and Best Practices
By the numbers:
- Over 70% of security leaders have adopted or are evaluating AI for security operations.
- 83% say they're overwhelmed by alert volume, false positives, and a lack of context.
- 20% of security leaders are confident in their ability to secure their own AI models against cyber threats.
Questions worth separating out
Q: How should security teams use AI without turning it into a control dependency?
A: Security teams should use AI for summarisation, correlation, and prioritisation, then keep containment in deterministic controls such as access policy, segmentation, and revocation.
Q: Why do AI tools create governance risk in identity-heavy environments?
A: AI tools create governance risk because they often sit on top of identities, secrets, and delegated permissions that were never designed for autonomous or semi-autonomous decision-making.
Q: What do security teams get wrong about AI-driven detection?
A: They often assume better detection automatically means better protection.
Practitioner guidance
- Separate AI triage from enforcement Use AI for correlation, summarisation, and prioritisation, but keep access revocation, segmentation, and blocking in deterministic controls that do not depend on model output.
- Map every AI workflow to its underlying identity Inventory the accounts, tokens, service identities, and delegated permissions that power AI-enabled security workflows, including any workload or service account used for automation.
- Require explainability for AI-assisted decisions Document how a model reaches a recommendation, who owns the decision, and what evidence would justify rejecting the recommendation in operations, audit, or board review.
What's in the full article
Zero Networks' full article covers the operational detail this post intentionally leaves for the source:
- How its deterministic automation model maps learned behaviour into enforceable network rules for identities and assets.
- The specific ways the vendor distinguishes AI-style inference from rule-based control in network security operations.
- Practical examples of how AI-assisted analysis can be paired with enforcement without relying on probabilistic decisions.
- The vendor's framing of self-defending network architecture for resilience and reduced operational complexity.
👉 Read Zero Networks' analysis of AI's role in cybersecurity and operational resilience →
AI in cybersecurity: where detection helps and where control fails?
Explore further
11/07/2026 2:07 pm
AI security becomes an identity governance problem the moment it starts influencing access decisions. The article is right to separate analysis from enforcement, because AI cannot be the policy engine if it cannot prove why a decision was made. That matters for IAM and NHI programmes where permissions, tokens, and delegated access still need deterministic control. Practitioners should treat AI as an assistant to governance, not the governor itself.
A question worth separating out:
Q: Who is accountable when AI-assisted security decisions cause an incident?
A: Accountability stays with the organisation that deploys the control, not with the model. Leaders need clear ownership for model inputs, approval thresholds, escalation paths, and override rights so that AI-assisted recommendations remain reviewable under governance and regulatory scrutiny.
👉 Read our full editorial: AI in cybersecurity is useful for context, not control
