AI is transforming both cyber offense and defense, but the attackers hold distinct advantages.  AI tools can be used for attacks and defense but the attackers are less concerned with quality or problems.  They can use risky or unvetted technology with impunity as they aren’t overly concerned if it causes harm.  The result is they employ such tools much earlier than the defenders.  AI powered social engineering is a good example.   Defenders face two problems.  First, security tools don’t magically appear.  They are a response to a problem and represent an investment by enterprises.  So, before they are commissioned, there must be a problem to address.  That means the attackers are winning somewhere first.   Secondly, defenders don’t have that luxury of being reckless when it comes to new technology.  Their risk appetite is much less because a security tool that creates loss, is just an insider attack conducted by incompetent security.  An improper AI powered social engineering filter may delete important messages or be vulnerable to being hijacked by hackers. Cybersecurity must wait for tools to be properly designed, tested, vulnerabilities closed, and vetted for their operational environment.  Roll-out is often slow for any system that has strong capabilities to do harm. So, there is a time lapse between when attackers use new tools, such as AI advancements, and when defensive tools will appear and be confident to do no harm.   This is the attacker’s advantage that compounds the benefit they hold in maintaining the initiative of when, where, and how attacks will occur.  As for AI cybersecurity, there is good news.  Despite these challenges, AI-driven defense is catching up and we will see defensive tools restore some balance by the end of the year. Check out my full 2026 Cybersecurity Predictions (prediction number 8 to be precise) for details. https://matthewrosenquist.substack.com/p/top-10-cybersecurity-predictions   Clip from my keynote delivered to the Nemertes group.   More information at http://nemertes.com/ and http://nemertes.substack.com/    Follow Matthew on  -          LinkedIn: https://www.linkedin.com/in/matthewrosenquist/  -          SubStack: https://substack.com/@matthewrosenquist     Visit Cybersecurity Insights at https://www.cybersecurityinsights.us   Subscribe to the Cybersecurity Insights channel: https://www.youtube.com/CybersecurityInsights

Security Boulevard is a leading cybersecurity news and information portal, offering articles, analysis, and insights on cybersecurity threats, vulnerabilities, and best practices. From the latest trends in cyber threats to expert commentary on security technologies and compliance frameworks, Security Boulevard provides resources for security professionals, IT leaders, and business executives seeking to protect their organizations from cyber attacks and data breaches.

Security Boulevard

Cyber attackers gain an asymmetric advantage from AI because they can adopt unvetted, risky tools immediately without concern for collateral damage, while defenders must wait for tools to be properly designed, tested, and vetted before deployment. This creates a time lag where attackers operate with AI-powered capabilities—such as social engineering—before defensive countermeasures exist. Additionally, defensive tools are reactive by nature, meaning attackers must succeed somewhere first before investment in defenses is justified. Despite this structural disadvantage, AI-driven defense is reportedly catching up and may restore some balance by end of 2026.

Why Cyber Attackers Benefit More from AI Technology than Defenders