Topic starter
11/07/2026 1:56 pm
TL;DR: AI is now widely embedded in security operations, but its value is strongest in summarisation, prioritisation, and pattern recognition rather than direct enforcement, according to Zero Networks. The critical issue is not whether AI can analyse faster, but whether its outputs are anchored to deterministic controls that actually contain risk.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “The Role of AI in Cybersecurity: Promises, Pitfalls, and Best Practices”.
By the numbers:
- 99% of U.S. adults engage with AI-enabled products weekly, according to Zero Networks.
- 64% of people don’t know they’re using AI features, according to Zero Networks.
- over 70% of security leaders have adopted or are evaluating AI for their security operations, according to Zero Networks.
Key questions
Q: What breaks when AI is used as a security control instead of a decision aid?
A: The main failure is that AI can identify risk without preventing it.
Q: Why do AI-driven security tools still need deterministic enforcement?
A: Because AI produces probabilistic judgments, not guaranteed outcomes.
Q: How can security teams tell whether AI is only improving visibility, not containment?
A: If AI improves dashboards, alert ranking, or analyst workflow but does not change access decisions or block attack paths, it is only improving visibility.
Practitioner guidance
- Separate AI analysis from enforcement Use AI to summarise telemetry, prioritise alerts, and cluster incidents, but keep revocation, blocking, and segmentation in deterministic control paths.
- Bind AI outputs to actionable control points Connect AI-driven findings to controls that can actually change access, such as conditional access, session termination, or network isolation.
- Review privileged and non-human access paths Check whether service accounts, workloads, and admin sessions still rely on human review after the fact instead of automatic enforcement at issuance time.
Bottom line: AI adds value when it improves context, summarisation, and alert prioritisation, but those functions do not equal control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:07 pm
AI is a context layer, not a control layer. The article correctly separates summarisation and prioritisation from enforcement, which is where many security programmes still blur the line. AI can help analysts decide faster, but it does not establish whether access should exist, continue, or be revoked. The practitioner conclusion is that AI belongs in the decision-support stack, while enforcement remains the job of deterministic controls.
A question worth separating out:
Q: How should organisations govern digital identity when AI is part of the service model?
A: They should treat identity assurance, access control, and AI oversight as one governance chain. If AI is making or influencing decisions in regulated services, the organisation needs auditable identity evidence for the initiating actor, the permissions used, and the policy that allowed the action. Without that linkage, AI governance is hard to defend.
👉 Read our full editorial: AI in cybersecurity is useful for context, not control