🛡️ AI in Cyber Defense
How defenders use AI to fight back — and why humans are still essential⏱ ~3 min
A commercial pilot has autopilot — it handles routine flying with great precision. But when a flock of birds takes out both engines over the Hudson River, you want Captain Sully, not autopilot. AI in cybersecurity is the same: excellent at processing massive data volumes and detecting known patterns. Essential for scale. But when something genuinely new happens — an attack the AI has never seen, a decision with major legal implications, a judgment call about business context — a skilled human must take the controls.
The Scale Problem — Why AI Is Necessary
A medium-sized company generates roughly 4,000,000 security events per day (login attempts, network connections, file accesses, etc.). A team of 3 skilled analysts working 24/7 can carefully review approximately 4,000 of them — that's 0.12%. Doubling the team to 6 analysts raises coverage to 0.24%. This is not a staffing problem. No amount of hiring can close a 99.88% gap. AI is the only scalable solution to process the volume.
Three AI Defensive Tool Categories (AP Skill 1.5.A)
| Tool Category | What AI Does | What the Human Does | Why Human Review Is Required |
|---|---|---|---|
| Security Configuration Review | Scans firewall rules, access control lists, and security configs; compares against best practices; flags overly permissive or outdated rules | Security technician reviews each flagged item before any change is made | AI doesn't know why a specific rule exists — the business may have a valid reason; removing it blindly could break operations |
| Application Code Vulnerability Analysis | Scans millions of lines of code at machine speed for buffer overflows, SQL injection flaws, insecure dependencies, and known vulnerability patterns | Programmer verifies each finding — is this a real vulnerability or a false positive? What's the correct fix? | AI may flag legitimate code as dangerous (false positive), miss context-dependent logic flaws, or suggest fixes that break functionality |
| Detection Rule Suggestion | Analyzes past attack patterns and global threat intelligence to suggest new rules for IDS/IPS, SIEM, and EDR — continuously updated as new threats emerge | Detection engineer reviews every proposed rule before it goes live | A poorly written rule creates thousands of false positives (alert fatigue) or misses real attacks; one bad rule can overwhelm the entire security team |
AI-Powered Threat Detection: Alert vs. Act (AP Skill 1.5.B)
- •Step 1 — AI Sorts: AI is trained on historical attack data to sort millions of events into 'likely malicious' and 'likely harmless' at machine speed
- •Step 2A — Alert Mode: AI flags suspicious events and sends notifications to human analysts, who investigate, make judgment calls, and decide on response
- •Step 2B — Act Mode: For specific, well-defined, reversible situations, AI takes automatic action — isolating a compromised device from the network, blocking a suspicious IP address, revoking an access token showing anomalous behavior
- •The rule for Act Mode: only reversible, well-scoped actions — never irreversible, high-impact, or legally significant actions without human decision
- •Why speed matters: an attacker detected and stopped in 4 minutes causes a fraction of the damage of one undetected for 4 months
The Two Wrong Extremes
- •'AI is unreliable — we can't trust it'
- •Refuses to use AI tools even for processing volume
- •3 analysts trying to review 4M events manually
- •Attackers go undetected for months
- •Coverage: 0.12% of events reviewed
- •Result: breaches discovered after the damage is done
- •'AI handles security — we don't need analysts'
- •AI takes all actions without human review
- •AI removes a firewall rule it doesn't understand
- •AI blocks a critical business partner's IP
- •AI makes legal/compliance decisions alone
- •Result: operational disruptions, legal liability, missed context
An AI security system detects that a device is rapidly encrypting thousands of files — a signature pattern of ransomware. The AI is 95% confident this is an active ransomware infection. Which action is appropriate for AI to take automatically (Act Mode) without waiting for a human?