COMMENTARY: The cybersecurity industry -- and the world for that matter -- has been captivated over the debate of AI safety.
After the warning that AI could pose an existential threat to humanity within a decade and Anthropic CEO Dario Amodei publishing an essay on pacing the frontier, it’s reasonable for citizens and organizations alike to ask the question of whether we have let AI into our circle too quickly, or if the industry needs to collectively hit the brakes on AI innovation.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
Calling for the pacing of development for frontier AI models makes sense, but that guidance only applies to the individuals and organizations that agree to it. The attackers or other adversary countries may not necessarily comply. So, they will keep adopting every capability that becomes available through open-source, open-weighted models, on the timeline that best suits the specific techniques the adversary wants to employ, the profile of their target, and the ultimate goal of the attack.
As Amodei said in the essay, pacing the development of AI does not mean halting progress. AI labs and cyber defenders largely want the same outcome. As labs slow down to build AI safely, defenders must speed up, while ensuring the security fundamentals are rock-solid. Organizations must start with patching endpoints, employing phishing-resistant multi-factor authentication (MFA), removing standing administrative privileges, and closing the gap between attack speed and response speed to stop most automated adversarial activity.
The harder asymmetry stands between AI-enabled attackers and defenders. Defenders have to be right every time; the attacker needs only one access point. That imbalance stays in place, and the standard for success stays wildly uneven, until defenders can answer an attack the moment it lands.
Attack vs. Defense and the skills gap
We have been at an inflection point for quite a while when it comes to AI-enabled cyber defense thwarting AI-enabled attackers. Adversaries are innovating at an impressive pace and what used to take teams of people with deep expertise to effectively infiltrate an environment now can seemingly happen in seconds.
The OpenAI-Hugging Face incident was a preview of what’s to come. Nothing was particularly novel about the way the platform was attacked. The models exploited the same unpatched flaws, reused credentials, and overly broad permissions that human attackers have leveraged for years, but they did it at a speed with persistence that no human could possibly match.
Cyber defense simply needs to move faster, contrary to the belief that we need to pace AI innovation, and the industry collectively recognizes that. In fact, Gartner predicts that spending on AI cybersecurity will reach $51.3B this year and will grow to $86B in 2027. Simultaneously, our 2026 AI & Cybersecurity Trends Report found that 63% of respondents experienced a significant cybersecurity incident in the past year, but just 14% made AI central to their security operations strategy. As attackers continue to move faster with the use of AI, defenders who do not adapt and employ an AI-forward defensive strategy are fighting with one hand tied behind their back.
When the attacker moves at machine speed and the target moves at bureaucratic speed, the chance of a security incident quickly shifts from a “just in case” scenario to a to a high-probability outcome.
Going back to move forward
AI's pace will test the industry’s fundamentals. The organizations that have them will hold up, and the ones that don't are left exposed.
While frontier AI labs owe it to the world to develop responsibly, security teams must maintain control of the basics to ensure nefarious use of AI does not turn into a lasting business issue.
The malicious intentions of attackers with AI capabilities are much more of a threat than the natural evolution of AI. Security leaders must replace passive trust with operational discipline, ensuring defensive systems can match the speed and scale of the adversary, and remain prepared for the attacks of tomorrow.
Laura Ellis, senior vice president, AI, Arctic Wolf
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
