Becoming an AI-forward security organization is no longer optional

By Yassir Abousselham

For most of my career, cybersecurity has been a race between attackers finding weaknesses and defenders discovering and fixing them. We’ve built entire security organizations around this model.

We scan for vulnerabilities, prioritize findings, investigate alerts, assign remediation tasks, and track progress through processes that depend heavily on human intervention. We’ve become better at it over the years, but the underlying operating model hasn’t fundamentally changed.

AI is challenging that model in ways we can no longer ignore. I’ve written previously about how AI is changing the economics of cyberattacks through three forces: discoverability, speed, and persistence. Vulnerabilities that once required considerable expertise and effort to discover can increasingly be identified automatically. Attackers can evaluate potential attack paths, chain weaknesses together, and automate exploitation at a scale that wasn’t previously practical.

An attacker no longer needs to personally conduct every stage of an operation. AI makes it increasingly possible to deploy swarms of autonomous agents, each exploring different attack paths, probing for weaknesses, and adapting its approach.

These agents can be directed against a specific organization or cast a wide net across thousands of potential targets. Unlike human attackers, they don’t need to sleep, don’t lose focus, and can operate in parallel at enormous scale. They can also bring increasingly sophisticated technical capabilities, sometimes matching or exceeding those of experienced human operators on specific tasks.

The implications for defenders are significant. A vulnerability that appeared relatively insignificant yesterday may become the missing link in an attack chain that an autonomous system can discover and exploit tomorrow. Yet many security organizations continue to operate at human speed, following processes designed for a threat environment that no longer exists.

Becoming an AI-forward security organization is no longer optional, and it requires much more than buying AI tools or giving every security engineer access to a chatbot.

We need to fundamentally rethink how security work gets done.

Using AI is not the same as becoming AI-forward

Most security practitioners I speak with are already using AI in some capacity. They’re writing scripts, analyzing logs, researching vulnerabilities, reviewing code, or summarizing investigations. These are useful applications, and I’ve experienced firsthand how much time they can save. But I worry that we’re confusing productivity improvements with transformation. Making existing processes faster is a good starting point, but it doesn’t necessarily change what we’re capable of accomplishing.

Consider a SOC analyst who uses AI to investigate alerts twice as fast. That’s a meaningful improvement, but we’re still generating alerts, assigning them to analysts, and investigating them individually. What if, instead, AI agents could gather evidence across multiple systems, correlate activity, develop and test hypotheses, and resolve routine cases autonomously? Human analysts could focus on ambiguous investigations and consequential decisions rather than manually processing every alert. The goal isn’t simply to make the analyst faster. It’s to redesign the investigation process around a different division of labor between humans and machines.

The same applies to vulnerability management. For decades, we’ve operated a process that starts with scanning, produces findings, and ends with remediation tickets competing with every other engineering priority. AI can help us prioritize those findings faster, but we’re still managing individual vulnerabilities when what we really care about is whether an attacker can compromise something important.

What if defensive agents continuously evaluated our environment for viable attack paths, safely simulated exploitation, proposed fixes, and validated that those fixes eliminated the exposure? Instead of managing an ever-growing backlog, we could focus on the combinations of weaknesses that create meaningful risk.

These capabilities aren’t all mature or reliable enough to operate without supervision today. But that’s not the point. The question shouldn’t be how AI can help us do our existing jobs faster. It should be whether we’re still doing the right jobs, in the right way, given what AI now makes possible.

Rethinking the security organization

We’ve spent decades organizing security around specialized functions: application security, cloud security, identity, vulnerability management, and security operations. Each has its own tools, processes, metrics, and responsibilities.

Specialization remains valuable, but these boundaries don’t necessarily reflect how attacks unfold. An attacker doesn’t care which team owns a weakness. An attack might begin with a vulnerable application, exploit an overprivileged service account, move through cloud infrastructure, and eventually reach sensitive data. What matters is the complete path to the objective, not the individual vulnerabilities along the way.

AI creates an opportunity to operate across these boundaries. Defensive systems can increasingly reason across multiple sources of information, identify relationships between assets and identities, and discover combinations of weaknesses that individual teams might miss. But realizing that potential requires more than connecting an LLM to existing security tools.

We need to rethink how information flows between functions, how decisions are made, and which activities can be coordinated or automated. Rather than spending much of their time manually executing repeatable processes, security practitioners will increasingly design, supervise, and improve systems capable of performing those activities continuously.

This should also change how we measure success. We’ve traditionally relied on metrics such as vulnerabilities remediated, alerts investigated, and tickets closed. These tell us how much work we’re doing, but not necessarily how effectively we’re defending the organization. I would much rather understand:

• How many viable attack paths we’ve eliminated
• How quickly we can identify and close new exposures
• Whether our controls can withstand realistic attacks.

AI gives us an opportunity to shift from measuring security activity to measuring defensive effectiveness.

“The question shouldn’t be how AI can help us do our existing jobs faster. It should be whether we’re still doing the right jobs, in the right way, given what AI now makes possible.”

Yassir Abousselham Co-founder Silicon Valley Cyber

AI fighting AI

As attackers become more autonomous, defenders will need comparable capabilities. A human-driven security organization cannot indefinitely scale against adversaries capable of deploying persistent agents that continuously search for weaknesses, experiment with exploitation techniques, and adapt their strategies. Even when individual agents are imperfect, their ability to operate simultaneously and repeatedly changes the economics of an attack.

Imagine a security environment where defensive agents continuously assess infrastructure, applications, identities, and configurations.

• They identify potential attack paths, test whether those paths are exploitable within established safety boundaries, and evaluate whether existing controls would prevent compromise.
• When they discover a weakness, they propose or implement remediation according to predefined policies, then retest to verify that the exposure has been eliminated.
• As applications are deployed, infrastructure changes, and permissions evolve, the process repeats.

Security becomes a continuous control loop rather than a series of periodic assessments and reactive interventions.

We’re not fully there yet. Today’s AI agents can make incorrect assumptions, produce unreliable results, and be manipulated through malicious inputs. An agent with broad privileges and insufficient oversight can create as much risk as it eliminates. We need to introduce autonomy deliberately, starting with narrowly scoped tasks where outcomes can be independently verified, limiting permissions, and requiring human approval for consequential actions. But we shouldn’t confuse the limitations of today’s technology with a reason to preserve yesterday’s operating model.

None of this means abandoning security fundamentals. As AI makes vulnerability discovery and exploitation more accessible, strong identity controls, least privilege, segmentation, and secure software development become even more important.

Identity deserves particular attention as autonomous agents gain access to enterprise systems, retrieve sensitive information, invoke tools, and execute transactions. Unlike traditional automation, these agents can make decisions about how to accomplish a task, sometimes in ways their human operators didn’t anticipate.

We need stronger approaches to delegated authorization, isolation, and accountability, applying the same rigor to the defensive agents we deploy as to the AI applications our businesses adopt.

Transformation starts with the CISO

I believe CISOs now have two distinct transformations to lead. The first is securing the organization’s adoption of AI. Businesses are moving quickly to integrate AI into products, development processes, and internal operations. Security needs to enable that adoption while establishing appropriate controls around data, identity, authorization, and autonomous behavior. I’ve always believed that effective security programs create paved roads that make the secure approach the easiest approach. That philosophy becomes even more important with AI, where excessive restrictions risk driving adoption outside our visibility.

The second transformation is within our own security organizations, and I think it’s receiving far less attention. It’s entirely possible for a company to have a sophisticated AI security governance program while its security team continues operating through manual processes designed a decade ago. As CISOs, we need to challenge every function to rethink how it operates, not simply identify opportunities to use AI.

• Application security engineers should be exploring continuous AI-driven code review and adversarial testing.
• Detection engineers should be experimenting with autonomous investigations.
• Identity teams should be rethinking access governance for both humans and agents.

This requires more than encouraging people to experiment in their spare time. Teams need access to technology, dedicated time to learn, and permission to challenge established processes. We also need to change our expectations as leaders.

If a security engineer tells me AI has reduced the time required to complete a task by 50%, that’s encouraging. But my next question would be whether that task should still exist in its current form. Could we eliminate it, automate the entire workflow, or achieve a better security outcome? Those are the conversations that will distinguish organizations that use AI from those that truly become AI-forward.

We don’t have time

One of the most common objections I hear from security leaders is that their teams are already overwhelmed. There are critical vulnerabilities to remediate, compliance obligations to meet, incidents to investigate, and projects the business expects us to deliver. Finding time to experiment with AI, let alone redesign entire workflows, can seem unrealistic. I’ve spent years managing security organizations where the amount of work consistently exceeded the resources available, so I understand the challenge.

But I think we’re drawing the wrong conclusion. The fact that our teams are overwhelmed is precisely why we need to change how we operate. If we continue working the same way, the situation will only get worse.

• AI-assisted engineering teams are generating and deploying new features faster than ever, increasing the volume of code and the pace of change we need to secure.
• At the same time, AI is accelerating vulnerability discovery across our software supply chain, exposing weaknesses at a scale that threatens to overwhelm traditional remediation processes.
• Meanwhile, attackers are becoming more capable and persistent.

We cannot expect to keep pace simply by hiring more people or asking existing teams to work harder.

Transformation requires an investment, but it doesn’t have to come at the expense of existing priorities. Rather than treating AI adoption and process redesign as separate projects, we should embed them into our day-to-day operations.

Every time we investigate an incident, remediate a vulnerability, or perform a security review, we should ask how that process could be improved, automated, or eliminated. By making continuous improvement part of how we operate, we can progressively transform our workflows while delivering on existing commitments. Over time, these incremental changes compound, freeing up capacity to address risks we’ve historically accepted because we lacked the resources to manage them.

There’s also a learning advantage to starting early. Becoming AI-forward isn’t something you accomplish by purchasing a platform. Teams need to understand where AI performs reliably, how it fails, how to integrate it into existing systems, and when human oversight remains necessary. That experience takes time to develop, and organizations that begin building it now will be better positioned to take advantage of future capabilities.

What happens to security professionals?

We also need to acknowledge what this transformation means for the people working in cybersecurity. Many responsibilities that currently consume significant human effort will become increasingly automated. Some roles will change substantially, and others may eventually disappear. But that doesn’t mean security expertise becomes less valuable. Understanding how systems fail, how attackers operate, how to evaluate risk, and how to design effective controls will remain essential. What’s changing is how that expertise gets applied.

A security engineer who can design and supervise AI-powered defensive systems may accomplish what previously required several engineers performing repetitive tasks. An incident responder who can orchestrate autonomous investigations can spend less time gathering evidence and more time making consequential decisions. The value increasingly shifts from performing individual tasks to designing systems that perform those tasks effectively and reliably.

As leaders, we have a responsibility to help our teams make that transition. We should invest in developing new capabilities and create opportunities for practitioners to apply their expertise differently. But we also need to be clear about expectations. Learning to use AI is no longer an optional professional development activity. It’s becoming a core competency for security practitioners, much as understanding cloud computing became essential as enterprise infrastructure moved to the cloud.

The time to transform is now

Almost every week, I encounter a new AI capability that challenges my assumptions about what’s possible. Something that seemed technically difficult or impractical a few months ago suddenly becomes accessible. That pace of change can be uncomfortable, particularly for security professionals accustomed to carefully evaluating technology before deploying it. But we don’t have the luxury of waiting until the technology stabilizes, nor can we design a perfect long-term strategy when the underlying capabilities are evolving so quickly.

What we can do is start transforming our organizations with the capabilities available today, learn from the experience, and continuously adapt. We should be deliberate about where we introduce autonomy, rigorous about validating results, and disciplined about managing the risks AI introduces. But we should be equally aggressive about challenging established processes and finding better ways to operate.

For decades, we’ve built security organizations around the limitations of human capacity. We’ve divided responsibilities into specialized teams, created processes to manage overwhelming volumes of information, and accepted that we can only investigate, assess, and remediate a fraction of the risks in our environments. AI gives us an opportunity to challenge those limitations and fundamentally expand what our organizations can accomplish.

The threat environment is already changing. Attackers are gaining the ability to discover weaknesses, explore attack paths, and operate with a level of speed and persistence that human-driven defenses cannot sustainably match.

Our response must go beyond adopting new technology. We need to rethink how our security organizations operate, how our people create value, and how we measure success. Becoming AI-forward is no longer optional. It’s now a fundamental responsibility of security leadership.