Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More
Why is AI becoming essential for cybersecurity? Because every day, in fact every second, malicious actors are using artificial intelligence to widen the scope and speed of their attack methods.
For one thing, as Adam Meyers, senior vice president at CrowdStrike, told VentureBeat in a recent interview, “The adversary is getting 10 to 14 minutes faster every year. As their breakout times shrink, defenders have to react even faster — detecting, investigating and stopping threats before they spread. This is the game of speed.”
Meanwhile, Gartner wrote in its recent study, Emerging Tech Impact Radar: Preemptive Cybersecurity, that “[m]alicious actors are exploiting generative AI to launch attacks at machine speed. Organizations can no longer afford to wait for a breach to be detected before taking action. It has become crucial to anticipate potential attacks and prioritize preemptive mitigation measures with predictive analysis.”
And for its part, Darktrace’s latest threat report reflects the new, ruthless mindset of cyberattackers willing to do whatever it takes to gain the speed and stealth they need to breach an enterprise, exfiltrating data, funds, and identities even before security teams know they’ve been hit. Their weaponization of AI extends beyond deepfakes into phishing email blasts that resemble legitimate marketing campaigns in scale and scope.
One of the most noteworthy findings from Darktrace’s research is the growing threat of weaponized AI and malware-as-a-service (MaaS). According to Darktrace’s recent research, MaaS now constitutes 57% of all cyberattacks, signaling a significant acceleration toward automated cybercrime.
AI is meeting cybersecurity’s need for speed
Breakout times are plummeting. That’s a sure sign that attackers are moving faster and fine-tuning new techniques that perimeter-based legacy systems and platforms can’t catch. Microsoft’s Vasu Jakkal quantified this acceleration vividly in a recent VentureBeat interview: “Three years ago, we were seeing 567 password-related attacks per second. Today, that number has skyrocketed to 7,000 per second.”
Few understand this challenge better than Katherine Mowen, SVP of information security at Rate Companies (formerly Guaranteed Rate), one of the largest retail mortgage lenders in the U.S. With billions of dollars in transactions flowing through its systems daily, Rate Companies is a prime target for AI-driven cyberattacks, from credential theft to sophisticated identity-based fraud.
As Mowen explained in a recent VentureBeat interview, “Because of the nature of our business, we face some of the most advanced and persistent cyber threats out there. We saw others in the mortgage industry getting breached, so we needed to ensure it didn’t happen to us. I think what we’re doing right now is fighting AI with AI.”
Rate Companies’ strategy to attain greater cyber resilience is anchored in AI threat modeling, zero-trust security, and automated response, which offers valuable lessons for security leaders across industries.
“Cyber attackers now leverage AI-driven malware that can morph in seconds. If your defenses aren’t just as adaptive, you’re already behind,” CrowdStrike CEO George Kurtz told VentureBeat. The Rate Companies’ Mowen, for example, is battling adversarial AI with a series of working defensive AI strategies.
Fighting AI with AI: what’s working
VentureBeat sat down with a group of CISOs, who requested anonymity, to better understand their playbooks for fighting AI with AI. Here are six lessons learned from that session:
Improving threat detection with self-learning AI is paying off. Adversarial AI is at the center of an increasingly large number of breaches today. One quick takeaway from all this activity is that signature-based detection is struggling, at best, to keep up with attackers’ latest tradecraft.
Cyberattackers aren’t stopping at exploiting identities and their many vulnerabilities. They’re progressing to using living-off-the-land (LOTL) techniques and weaponizing AI to bypass static defenses. Security teams are forced to shift from reactive to proactive defense.
DarkTrace’s report explains why. The company detected suspicious activity on Palo Alto firewall devices 17 days before azero-day exploit was disclosed. That’s just one of many examples of the rising number of AI-assisted attacks on critical infrastructure, which the report provides data on. Nathaniel Jones, VP of threat research at Darktrace, observed that “detecting threats after an intrusion is no longer enough. Self-learning AI pinpoints subtle signals humans overlook, enabling proactive defense.”
Consider automating phishing defenses with AI-driven threat detection. Phishing attacks are soaring, with over 30 million malicious emails detected by Darktrace in the last year alone. The majority, or 70%, are bypassing traditional email security by leveraging AI-generated lures that are indistinguishable from legitimate communications. Phishing and business email compromise (BEC) are two areas in which cybersecurity teams are relying on AI to help identify and stop breaches.
“Leveraging AI is the best defense against AI-powered attacks,” said Deepen Desai, chief security officer at Zscaler. The Rate Companies’ Mowen emphasized the need for proactive identity security: “With attackers constantly refining their tactics, we needed a solution that could adapt in real time and give us deeper visibility into potential threats.”
AI-driven incident response: Are you fast enough to contain the threat? Every second counts in any intrusion or breach. With breakout times plummeting, there’s no time to waste. Perimeter-based systems often have outdated code that hasn’t been patched in years. That all fuels false alarms. Meanwhile, attackers who are perfecting weaponized AI are getting beyond firewalls and into critical systems in a matter of seconds.
Mowen suggests that CISOs follow the Rate Companies’ 1-10-60 SOC model, which looks to detect an intrusion in one minute, triage it in 10, and contain it within 60. She advises making this the benchmark for security operations. As Mowen warns, “Your attack surface isn’t just infrastructure — it’s also time. How long do you have to respond?” Organizations that fail to accelerate containment risk prolonged breaches and higher damages. She recommends that CISOs measure AI’s impact on incident response by tracking mean time to detect (MTTD), mean time to respond (MTTR), and false-positive reduction. The faster threats are contained, the less damage they can inflict. AI isn’t just an enhancement — it’s becoming a necessity.
Find new ways continuously to harden attack surfaces with AI. Every organization is grappling with the challenges of a constantly shifting series of attack surfaces that can range from a fleet of mobile devices to large-scale cloud migrations or a myriad of IoT sensors and endpoints. AI-driven exposure management proactively identifies and mitigates vulnerabilities in real time.
At Rate Companies, Mowen stresses the necessity of scalability and visibility. “We manage a workforce that can grow or shrink quickly,” Mowen said. The need to flex and adapt its business operations quickly is one of several factors that drove Rate’s strategy to use AI for real-time visibility and automated detection of misconfigurations across its diverse cloud environments.
Detect and reduce the number of insider threats using behavioral analytics and AI. Insider threats, exacerbated by the rise of shadow AI, have become a pressing challenge. AI-driven user and entity behavior analytics (UEBA) addresses this by continuously monitoring user behavior against established baselines and rapidly detecting deviations. Rate Companies faced significant identity-based threats, prompting Mowen’s team to integrate real-time monitoring and anomaly detection. She noted:
“Even the best endpoint protections don’t matter if an attacker simply steals user credentials. Today, we operate with a ‘never trust, always verify’ approach, continuously monitoring every transaction.”
Vineet Arora, CTO at WinWire, observed that traditional IT management tools and processes often lack comprehensive visibility and control over AI applications, allowing shadow AI to thrive. He emphasized the importance of balancing innovation with security, stating, “Providing safe AI options ensures people aren’t tempted to sneak around. You can’t kill AI adoption, but you can channel it securely.” Implementing UEBA with AI-driven anomaly detection strengthens security, reducing both risk and false positives.
Human-in-the-loop AI: essential for long-term cybersecurity success. One of the main goals of implementing AI across any cybersecurity app, platform or product is for it to continually learn and augment the expertise of humans, not replace it. There needs to be a reciprocal relationship of knowledge for AI and human teams to both excel.
“Many times, the AI doesn’t replace the humans. It augments the humans,” says Elia Zaitsev, CTO at CrowdStrike. “We can only build the AI that we’re building so quickly and so efficiently and so effectively because we’ve had literally a decade-plus of humans creating human output that we can now feed into the AI systems.” This human-AI collaboration is particularly critical in security operations centers (SOCs), where AI must operate with bounded autonomy, assisting analysts without taking full control.
AI vs. AI: The future of cybersecurity is now
AI-powered threats are automating breaches, morphing malware in real time and generating phishing campaigns nearly indistinguishable from legitimate communications. Enterprises must move just as fast, embedding AI-driven detection, response and resilience into every layer of security.
Breakout times are shrinking, and legacy defenses can’t keep up. The key is not just AI but AI working alongside human expertise. As security leaders like Rate Companies’ Katherine Mowen and CrowdStrike’s Elia Zaitsev emphasize, AI should amplify defenders, not replace them, enabling faster, smarter security decisions.
Do you think AI will outpace human defenders in cybersecurity? Let us know!
