AI in Cybersecurity and Fighting Autonomous Threats

Summarize this news article with AI:

Ask ChatGPT Ask Grok Ask Perplexity Ask Claude Ask Google AI 

Artificial Intelligence has drastically changed the digital landscape in the last few years. This is a simple fact across every industry. Today, you’ll find AI being used in almost every platform or service to some extent. But how has that affected the state of modern cybersecurity? By redefining workflows, AI has seeped its way into modern cybersecurity tools, detecting threats faster, automating repetitive tasks, and strengthening security operations. However, this has been a double-edged sword at the same time as AI tools have become increasingly misused and unregulated.

Today, AI could be considered one of the most powerful defensive technologies developed, yet it’s also one of our greatest cyber threats. In this blog article, we’ll attempt to analyze AI use in cybersecurity history books, how generative AI can be used in cybersecurity, and how organizations can be prepared for a dynamic future, powered by AI. First, it’s important to understand that the root problem is not the technology itself, but rather that IT security teams are simply overwhelmed, and this is no new revelation. 

According to a 2025 survey published by Statista, 87% of respondents cited that AI-related vulnerabilities have increased in the past year, the highest among other cyber risks. Each year, the volume, complexity, and velocity of cyber threats continue to increase, with companies and individuals alike facing evolved ransomware campaigns, supply chain attacks, insider threats, cloud misconfigurations, and AI-enhanced phishing attacks.

The core obstacle for many organizations is no longer simply detecting threats but identifying the threats that matter most and responding quickly enough. However, the future of cybersecurity cannot only be determined by AI tools alone. To truly survive the onslaught of AI threats, organizations need a combination of advanced AI-driven detection, automated security operations, and expert human oversight. The most effective approach combines intelligent technologies with Security Operations Centers (SOC), Security Operations (SecOps), and Managed Detection and Response (MDR) services to create a resilient defense against autonomous threats. Now, let’s take a look back at how AI shaped cybersecurity.

The Evolution of AI in Cybersecurity

Now, to fully understand the current state of AI-powered security, it’s important to look back at how AI evolved as a defensive technology over the past several decades. When the AI era began, there were rightful concerns about all the AI-powered cyber threats that could be brought to life; a future that naturally came to fruition within a few months.

From phishing attacks to deepfakes, generative AI and automated threat tools were quickly added to the common cyber criminals' arsenal. By exploiting zero-day vulnerabilities faster and more efficiently than ever before, attackers were suddenly able to use AI to scan for unpatched systems, craft targeted payloads, and launch adaptive malware in a matter of minutes, not days. However, it became very clear that AI was not going anywhere anytime soon either, leaving no choice but to embrace the technology for security purposes instead.

Soon after, organizations and governments were finding ways to implement AI-powered cybersecurity measures for more proactive defenses, and that trend is still going strong today. In fact, in early July, the European Commission presented an Action Plan on Cybersecurity and Artificial Intelligence to support the safe and responsible use of AI while strengthening Europe's cybersecurity.

Sangfor’s very own AI model recently also achieved outstanding results on CyberGym, an internationally recognized benchmark for evaluating AI security capabilities. The Sangfor AI agent faced complex vulnerability challenges for an impressive overall success rate of 86.3%, ranking top four globally amidst global top-tier AI agents such as OpenAI, Anthropic, and Meta. To achieve this feat, Sangfor AI pioneered an "Agent Swarm" collaborative architecture and a rigorous "evidence-governance" mechanism to ensure every step of the vulnerability investigation remains clear and credible rather than relying on simple probabilistic stacking.

The plan also encourages organizations to use AI, including open-source models where appropriate, to detect and address vulnerabilities more quickly and improve their ability to prevent and respond to cyber-attacks. Ultimately, the use of AI in cybersecurity has levelled the playing field a bit when it comes to AI-powered cyber threats, at least. Now, organizations have the same automated mechanics, threat detection, and consistency in their bag as well. Let’s look at how exactly AI in cybersecurity has developed so far.

The Rule and Signature Matching Era

For years, cybersecurity relied heavily on predefined rules and signatures: the traditional antivirus would compare files against known malware databases, intrusion detection systems searched for recognizable attack patterns, and firewalls relied on static policies. While this method was effective against known threats, it struggled when confronted with new ones.

The rise of polymorphic malware was what demonstrated the limitations of signature-based security most succinctly. Suddenly, malicious code was being continuously modified, generating thousands of variants that could bypass traditional detection systems.

Behavioral Analysis and Heuristics

The next level of cybersecurity introduced behavioral analysis. Rather than only searching for known signatures, security tools began to monitor how users, applications, and devices behaved. This meant noting any logins from unusual locations, large data transfers, or suspicious activity. Behavioral analytics helped to identify threats that traditional signatures may have missed.

In Advanced Persistent Threats (APTs), attackers remain hidden inside networks for months. However, behavioral monitoring became the first indication that something was off. This era marked an important shift from detecting known threats to identifying suspicious activities.

Deep Learning and Machine Learning Adoption

Pretty soon, the amount of data in the modern digital landscape exploded, and machine learning became the new route to follow. With this sudden rise in data, human analysts were simply not equipped to manually review every security alert, which is when we first turned to automation. Machine Learning is a specific approach within AI that allows machines to learn and improve from experience without explicit programming. Instead of giving precise instructions, ML algorithms learn patterns in large volumes of data to make predictions or decisions.

Machine Learning allowed cybersecurity platforms to detect anomalies automatically, correlate security events, and identify emerging attack patterns, all while prioritizing high-risk incidents and reducing false positives. It became particularly valuable in email security, endpoint protection, and network analytics, where enormous amounts of data needed real-time analysis.

AI and SOC Automated Operations

Today, cybersecurity has entered a new phase, and AI is no longer limited to just being the sniffer dog at the airport, simply detecting threats. Instead, it’s being used across several facets within cybersecurity. Most modern security platforms have automated threat investigations, incident triage, and initial response actions. Security Operations Centers now use AI to handle routine tasks while analysts focus on strategic investigations. This shift allows security teams to respond faster while improving operational efficiency.

While AI creates powerful defensive opportunities, it also introduces significant new risks. Understanding these risks is essential for developing effective cybersecurity strategies.

Evaluating Emerging AI Risks

AI has been the subject of much debate since its arrival. With many people seeing the positives of the technology by itself, the risks associated with it can be overwhelming, especially for organizations. Let’s look at some of the reasons why AI has become such a thorn in the side of cybersecurity. 

The Accelerating Complexity of AI-Assisted Attacks

Today, AI has allowed threat actors to use increasingly sophisticated techniques, while widening the attack surface almost exponentially. Attackers can now use AI to improve nearly every stage of the attack lifecycle. With the help of generative AI, threat actors can write convincing phishing emails, generate malicious code, and create social engineering content, all while automating reconnaissance on networks and conducting large-scale attack campaigns.

Threat actors no longer need advanced technical expertise to launch sophisticated attacks. As a result, organizations face a growing volume of highly personalized and increasingly effective threats. Anthropic recently released its findings on AI-enabled cyber threats, noting that threat actors are now using AI in the later and more complex stages of their cyber operations, cyberattacks are becoming more autonomous, and the fact that AI can be used to chain together many parts of the attack means that the old ways of differentiating high- from low-risk actors are no longer as effective.

Inadvertent AI System Overreach and Autonomous Database Intrusion

AI systems can also create a lot of unintended consequences. As organizations give AI tools more access to critical business systems, secure boundaries become the major concern. By allowing this level of trust and autonomy, AI agents suddenly have access to sensitive databases, and automated workflows can make unauthorized changes, leaving data and privileges open to exploitation.

In July, an autonomous AI agent powered by two OpenAI models went rogue during a test, accessed the open web, and hacked a prominent startup by itself in an “unprecedented incident.” The AI agent then located and used logins to access four other unnamed “publicly available services” in addition to the US startup, Hugging Face. Now, while fully autonomous cyberattacks remain relatively rare today, the risk remains tremendous. However, it’s important to note that the threat mostly comes from poorly governed AI deployments.

Shadow AI Hazards

Shadow IT is the use of personal or unauthorized systems, devices, software, applications, and services, all without the explicit approval of your organization's IT department. This can be simply using your personal email at work or deploying your own cloud services. Today, however, we have to deal with Shadow AI, where workers are increasingly using unapproved AI tools for daily tasks.

This can include uploading confidential documents to public AI platforms, sharing proprietary code with external AI assistants, using unauthorized AI plugins, or connecting AI tools to enterprise data sources. According to research findings, 67% of enterprise AI usage occurs through unmanaged personal accounts on corporate devices, while 86% of organizations have no visibility into how data moves to and from AI tools. This creates substantial AI risk involving intellectual property leakage, regulatory compliance exposure, and sensitive data disclosure.

While these emerging AI risks show no sign of slowing down, the reality is that most organizations are simply not equipped to address them. So, how do you address this discrepancy?

Why AI Products Alone Are Not Enough: The Imperative of "Human-AI Collaboration"

Most organizations might look at the automatic detection and benefits of AI-powered tools and think of the AI as a complete cybersecurity solution. However, the reality is much more nuanced. While AI significantly enhances security capabilities, it cannot entirely replace the role of experienced security professionals. The strongest defense model ultimately combines machine intelligence with human expertise, and here are some of the reasons why:

Highly Adaptive Threat Vectors: Cybercriminals are continuously adapting. Once they understand how a security model operates, they tend to modify their tactics, creating an endless cat-and-mouse dynamic that AI alone cannot overcome. While AI systems excel at pattern recognition, they may struggle when facing new methods that fall outside of their training data, which is why human analysts remain essential for interpreting ambiguous situations and identifying emerging attack techniques.

Lack of Deep Business Context: AI tools can be used to analyze technical signals, but it lacks the context to make informed decisions. Flagged behavior could sometimes simply be legitimate projects, migrations, and deployments. While an AI platform can detect unusual activity, a human analyst can figure out whether the activity needs security intervention. Without business context, automated decisions can lead to unnecessary disruptions.

Irreplaceable Value of Human Expertise: Experienced analysts provide capabilities that AI cannot easily replicate. They ensure strategic decision-making, context-based analysis, executive communication, and regulatory response management. Humans are ultimately more equipped to make judgment calls involving business risk, legal considerations, customer impact, and operational continuity.

Global Response Asymmetry: Cyberattacks occur at any time, and many organizations have limited internal security resources. This creates an asymmetry where attackers have continuous opportunities while security teams often have limited coverage. This is why AI-powered automation should be combined with globally distributed MDR and SecOps teams that provide 24/7 monitoring and response capabilities.

Maintaining a comprehensive security plan involves more than AI at the end of the day. This is why you should put your trust in platforms and teams that understand the bigger picture when it comes to cyber threats. 

Staying Secure with Sangfor: Athena AI Engine, Global SecOps, and MDR

Strong cybersecurity requires multiple layers of protection that work together. Sangfor addresses this challenge through a combination of AI-powered technologies and expert-managed security services. 

Step 1: The Secure Architecture

At the foundation of the ideal security model is the Sangfor Athena AI Engine, which enhances detection, analysis, and response capabilities across the security ecosystem. Using advanced AI models, threat intelligence, and behavioral analytics, the platform identifies threats more accurately and efficiently.

The Sangfor Athena Next Generation Firewall is a pioneering platform, being the world’s first next-gen firewall to integrate with NGWAF for network and web application security in a single appliance, the first with a built-in SOC Lite module for rapid threat assessment and incident response, and the first to natively integrate with a holistic security ecosystem.

By integrating AI-driven intelligence, Sangfor’s Athena NGFW helps to identify suspicious behavior that may otherwise evade traditional perimeter defenses, improving application awareness, user identity correlation, intrusion prevention, and advanced threat detection.

The Sangfor Athena Network Detection and Response (NDR) platform also provides deep visibility into network activity, ensuring real-time visibility into network traffic and using AI-driven behavioral analytics to detect lateral movement, advanced attacks, and insider threats that evade traditional tools. With the right tools in place, you can turn to the human experts next.

Step 2: The Expert Management

Technology alone is not enough in the face of evolving cyber threats. This is why Sangfor combines AI-driven detection with professional SecOps and Global MDR services. The Sangfor Security Operations solution builds on existing infrastructure, integrating Sangfor’s XDR and MDR platforms alongside third-party security products, equipping organizations with a systematic and future-proof security fabric.

• Drastic Noise Suppression: One of the biggest challenges facing most SOC teams is alert fatigue. With thousands of daily alerts, analysts can get overwhelmed. Sangfor's Athena XDR uses Operations GPT, a 24/7 virtual security assistant, to automatically analyze alerts, identify false positives, and provide clear, natural-language explanations of legitimate threats.
• 24/7 Global Coverage: Sangfor’s Athena MDR security experts monitor your network and endpoints around the clock, checking every alert and taking immediate action against threats and vulnerabilities based on pre-approved response plans.
• Proactive Threat Hunting: Athena XDR also uses GenAI to automatically trace security incidents back to their root causes, visually presenting key forensic evidence such as malicious file executions, command-line scripts, and C&C domain names.

Ultimately, Sangfor provides a cohesive and strategic cybersecurity plan of action that combines both AI and human analysis to ensure the safety of organizations.

Conclusion

As AI reaches new heights, it’s important to understand the risks and benefits of the technology, and how it applies to your organization. While there are considerable and evolving risks born from the use of AI, the technology itself can be used to combat those vulnerabilities when managed in the right hands. 

Are you ready to secure your organization from emerging AI cyber threats with unified protection? Assess, manage, and fortify your business with Sangfor Athena solutions today and embrace innovation aligned with safety.

FAQ