Kevin Korte

Cybersecurity is not an IT feature one can procure. It is a governance responsibility. It is about deciding what the organization values, which risks it will accept, who is accountable when something goes wrong, and how it recovers when controls fail. No AI platform can make those decisions for the board or leadership team.

The uncomfortable truth is that AI can make a poorly governed organization faster, more automated, and more vulnerable at the same time. Government guidance is already explicit. AI cannot replace basic security practices such as identity and access management, updates, and incident response.

The Fantasy of Autonomous AI Security

Security is not principally a data-analysis problem. Data can help identify threats. Security operations centers receive more alerts than human analysts can realistically examine. AI can help correlate signals across sources. It can reduce repetitive work and help analysts focus on the threats that matter. Thus, AI can augment capable people who understand their environment and can make informed decisions.

But cyber incidents are rarely clean technical puzzles. They are messy organizational events. A suspicious login may be an attacker, a traveling employee, a poorly designed integration, a supplier account with excessive access, or a broken internal process. The right response depends on business context and the acceptable consequences.

An automated system may recommend actions. In a controlled, low-risk situation, that might even execute them. Yet, in a hospital, payment system, or critical public service, the same action can create operational harm that exceeds the original threat. Thus, scope and circumstances matter. AI shouldn’t decide on its own.

Otherwise, handing over cybersecurity to AI does not remove risk. It changes the risk. The organization moves from the risk of human error to the risk of automated error at machine speed.

AI Automation Creates New Attack Surfaces

AI as a technology adds dependencies. If an AI can investigate broadly and respond automatically, it becomes one of the most privileged systems in the enterprise. Consequently, an attacker no longer needs to compromise every security control individually. They may only need to manipulate what the AI sees, what it trusts, or what it can do.

This can happen in various ways, from malicious user inputs to compromised tickets. A company I recently worked with used the same internal backend AI for most of their internal system, from document retrieval to their cybersecurity defense. An attacker convinced a sales rep to enter a prompt into the document retrieval agent that disabled a key cyberdefense mechanism, opening the door for an attack.

No one had considered how the agentic systems would introduce further risks because they could invoke tools dynamically across multiple contexts. Even the U.S. National Security Agency has warned that these patterns create new security concerns around trust boundaries, agent misuse, serialization, and dynamic tool invocation.

Admittedly, the attack wasn’t AI’s fault. However, it should remind us that AI is not a magic pill that solves every cybersecurity issue. Essential security requirements still apply in an AI world.

AI is not a shortcut, nor does it eliminate the need for cybersecurity maturity. It makes the absence of maturity more consequential.

Security Requires Ownership, Not Delegation

The greatest danger is not that AI will occasionally make a mistake. We all make mistakes. The problem is that AI provides a convenient excuse to abdicate responsibility. “We have an AI security platform” can become the modern equivalent of “IT has it handled.” It sounds reassuring, but it obscures accountability for cyber resilience.

An AI system can detect anomalies and draft recommendations. But it cannot decide how much operational risk the organization should tolerate. Nor can it determine whether the company’s crown-jewel data has been identified correctly. Those are leadership tasks that arise from a board’s risk management perspective.

AI can support that governance. It cannot replace it.

The same applies to employee awareness. AI-driven phishing and impersonation are becoming more convincing, more personalized, and faster to produce. A machine may detect some of these threats, but security still depends on people who understand the real-world consequences of a fraudulent request. Effective defense combines technology with realistic, ongoing, human-centered training.

An enterprise that outsources its judgment to AI will become easier to manipulate, not harder.

Build AI-Augmented, Accountable Defense

The future is not human security versus AI security. It is accountable human leadership supported by well-governed AI.

Start with fundamentals. Know where critical assets and data reside. Enforce identity controls and least privilege. Test backups and recovery. Maintain an incident-response plan that has been exercised under pressure, not simply approved in a slide deck.

Then introduce AI where it demonstrably improves a defined process. Use it to reduce alert fatigue, summarize investigations, find correlations, improve threat hunting, and automate routine containment actions that are clearly reversible. Test it in the organization’s actual environment, including noisy data, incomplete information, and adversarial conditions. Validate its outputs against evidence rather than treating fluent explanations as facts.

Most importantly, retain human accountability where consequences become material. If an action can disrupt operations, expose customer data, alter access privileges, or affect a critical service, a named and authorized human should own the decision.

The organizations that succeed with AI in cybersecurity will not be those that hand the keys to an algorithm. They will be those that use AI to make skilled teams more capable, leadership more informed, and operations more resilient.

Cybersecurity cannot be outsourced to intelligence, artificial or otherwise. It must be owned.