The Double-Edged Sword of AI in Cybersecurity: Risks and Benefits

AI in cybersecurity works in two directions at once. Defenders use it to detect threats faster and at greater scale, while attackers use the same tools to make their campaigns harder to spot and cheaper to run. According to the 2026 Sagiss Managed Security Report, 72% of workers say phishing attempts are more convincing than a year ago because of AI-written language. It’s important for businesses to understand these dynamics as they make security decisions.

What Is AI in Cybersecurity?

AI in cybersecurity is the use of machine learning and generative AI to detect, analyze and respond to threats. Attackers now use the same tools to make their attacks faster and more convincing.

Machine learning and generative AI are often used interchangeably, but they’re actually separate concepts. Machine learning models train on historical data to recognize patterns and flag deviations from baseline behavior. They can identify signals that a human analyst would need significant time to piece together from raw log data, network telemetry and endpoint activity. Generative AI (the kind that produces text, audio and images) is what attackers have adopted most aggressively. It lowers the skill floor for writing convincing phishing emails by generating realistic voice clips and personalizing messages at scale.

The technology itself is neutral, and its effect depends on who deploys it and how.

How Is AI Used in Cybersecurity Defense?

The defensive use of AI has grown most visibly in security operations, where the volume of data requiring continuous analysis long ago exceeded what human teams can handle alone.

Threat and Anomaly Detection

Security teams monitor enormous volumes of logs, network telemetry, endpoint events, and user activity. Machine learning models process that data continuously to establish behavioral baselines and flag statistical deviations that indicate an intrusion in progress. For instance, a user account accessing file shares at 3 a.m. from a new IP address triggers an alert that a rule-based system would likely miss. AI-powered detection helps analysts catch those signals by processing the raw data volume continuously, something no human team can sustain around the clock.

Alert Triage and Prioritization

Security tools generate more alerts than any team can investigate at the same pace. AI correlates alerts across tools, enriches them with context and ranks them by likely severity. Analysts can focus on what most likely represents a real threat, which reduces the time between detection and response when something serious is happening.

Incident Investigation and Response

When a security incident unfolds, the timeline matters. AI assists by pulling together context (affected systems, similar prior incidents, threat intelligence, network connections) that an analyst would otherwise spend significant time assembling manually. EDR (endpoint detection and response) and MDR (managed detection and response) platforms use AI to correlate activity across endpoints and help investigators understand what happened, in what order, and what the scope of an incident might be.

Phishing and Message Filtering

Email security tools use AI to analyze senders, URLs, message content and sending patterns to flag suspicious messages before they reach employee inboxes. These filters have improved substantially as the training data has grown, and the same generative AI making filters better is also making attacker content more convincing. Filtering alone can’t carry the full weight of phishing defense.

How Do Cybercriminals Use AI?

According to the FBI’s Internet Crime Complaint Center, AI-related fraud losses reached $893 million in 2025. The IC3 notes that the actual figure may be higher, since it captures only complaints that explicitly mention AI. AI-involved business email compromise exceeded $30 million in the same period.

AI-Written Phishing

Where AI has changed phishing most directly is in the quality of the messages themselves. Campaigns that once announced themselves with awkward grammar, odd formatting and generic subject lines now read like ordinary workplace communication. In the Sagiss survey, 57% of workers said AI makes phishing harder to spot because it feels more professional. Another 37% identified well-written messages as the hardest type to verify. For a closer look at how those numbers have shifted, see the AI phishing statistics post.

Impersonation, Deepfakes and Voice Cloning

AI can now reproduce the writing style, voice and video likeness of people employees interact with regularly. In the Sagiss survey, 64% of respondents said an AI-generated message could somewhat or very likely impersonate someone they work with. Attackers no longer need to spoof a domain and hope nobody checks. They can study an executive’s email style, generate a message in that voice and send it to someone who reports to that person. Deepfake phishing attacks add voice and video dimensions to the same threat.

Cheaper, Faster Attack Workflows

The most significant change AI has made to cyberattacks is economic. The underlying techniques are largely the same. AI makes them cheaper and faster to execute. The 2026 Verizon Data Breach Investigations Report (DBIR) found that fewer than 2.5% of observed AI-assisted attack techniques were rare. Attackers are applying AI to run what they already know more efficiently, at higher volume. Personalizing a message with details like a target’s job title or a recent company announcement requires almost no additional effort when AI handles the drafting. The same content can be varied across thousands of targets at once.

Why AI Phishing Slips Past Employees

In phishing awareness programs, the working theory has generally been that employees fail because they don’t recognize the signs. The Sagiss survey data complicates that. Only 7% of respondents said their difficulty verifying suspicious messages came from uncertainty about how to check. The other 93% understand what good practice looks like. The actual problem is doing it consistently under workday conditions.

Trust Signals Attackers Can Now Copy

A phishing message in 2026 can arrive with correct grammar, a natural professional tone, real workplace context, and the writing style of someone the recipient knows. In the Sagiss survey, 42% of workers said they had trusted a message at least once because it sounded like a coworker. That figure reflects how thoroughly AI has undermined the detection cue most training programs rely on.

Grammar and spelling were useful red flags when attackers wrote their own content, but generative AI has made that signal unreliable. A message written by AI and reviewed once before sending can match the quality of any legitimate workplace email.

Time Pressure Does the Rest

When a convincing message arrives during a busy stretch of the workday, most employees process it in the same cognitive mode as any other message in their inbox. The Sagiss survey found that 55% of workers identify rushing between tasks or meetings as the situation most likely to cause mistakes. Another 57% said they had confirmed a request was legitimate only after acting on it. The combination of a well-crafted message and an employee under time pressure is where most phishing succeeds.

AI for Cyber Defense vs. AI for Cyberattacks

Defenders hold real advantages in this dynamic. They control authentication rules, have visibility into their own systems and carry institutional context that attackers have to work around. AI raises the pace and quality of attacks without changing which defenses work. The urgency of having them in place before they’re tested has increased.

The Security Risks of Your Own AI Tools

Attackers aren’t the only source of AI risk for businesses. The AI tools employees use every day (writing assistants, code generators, summarizers and research tools) create their own security exposure that most organizations haven't fully addressed in policy or practice.

Shadow AI is the most immediate concern. Employees who adopt AI tools without IT approval may connect them to corporate systems, feed them internal data and operate outside established security controls. The 2026 Verizon DBIR found that 45% of employees regularly accessed AI tools on corporate devices, while 67% of AI users accessed these platforms using noncorporate accounts. Depending on the platform and its data-handling policies, information entered into public AI tools may be retained or used for model training, potentially exposing sensitive company information.

Data leakage is a related risk. Even approved AI tools carry exposure when employees paste confidential content into prompts. An acceptable-use policy that specifies what categories of information can’t be processed through public AI tools is a minimal starting control.

Prompt injection attacks are a specific risk for businesses deploying AI in customer-facing or internal workflows. A malicious actor crafts input designed to override an AI system’s instructions, redirecting its outputs, exfiltrating data or executing unauthorized actions. Prompt injection attacks are the OWASP top vulnerability for large language model applications and deserve specific attention from any organization deploying AI-powered tools in production.

NIST’s draft Cybersecurity AI Profile (IR 8596) is in initial preliminary draft status as of December 2025. It addresses both securing AI deployments and protecting against adversarial use of AI, and is worth following as it moves toward finalization.

How Businesses Can Respond to AI-Driven Threats

Addressing AI-driven threats well means working on training, procedural controls and technical layers as separate problems, because each one can fail independently. Managed security services can help cover the gaps.

Retire Grammar-Based Red Flags

Security awareness programs built around spotting typos and awkward phrasing are now behind the threat. Updated training focuses on verifying the identity of a requester and confirming any request that involves money, credentials or access changes through a channel separate from the one that delivered it. Suspicious tone is still worth teaching. A well-written message that requests something unusual deserves exactly the same scrutiny.

Build Verification Into Business Processes

Out-of-band verification means confirming a request through a different communication channel than the one that delivered it. An employee who receives an email requesting a wire transfer calls the sender’s known phone number to confirm before initiating anything. A contractor who gets a message about a credential reset expects an SMS confirmation before the change proceeds. These procedural controls work regardless of how convincing the original message was, because they remove in-the-moment judgment from the highest-risk transactions.

Layer Technical Controls

No single technical control blocks all AI-assisted threats, but layered controls are meaningfully more effective than any individual tool. Multi-factor authentication (including awareness of MFA fatigue attacks that target employees with repeated authentication requests) remains the most important identity control. Email security with AI-powered content analysis, EDR on all endpoints, identity and access management, DNS filtering and tested backup and recovery infrastructure together form a defense-in-depth posture that makes a successful attack substantially harder to execute.

Keep Humans in the Loop

AI security tools make human analysts faster and more effective, handling the data volume that no team could manage manually. The tools process and flag anomalies well. Contextual judgment about what actually matters and what to do about it still takes a person. Security is a team effort between the tools that handle data volume and the people who make the judgment calls. Sagiss holds a CyberVerify AAA rating (placing Sagiss in the top 1% of MSPs globally for cybersecurity practices) and SOC 2 Type II attestation, both of which reflect a program where qualified professionals are central to security operations.

Talk to a Sagiss advisor about protecting your business from AI-driven threats.

Will AI Replace Security Teams? Common Questions

Will AI Replace Cybersecurity Professionals?

No. AI makes security analysts faster and more effective by processing volumes of data that no human team can match manually. Every major security organization describes AI as a tool that augments analysts. The judgment calls that matter most (what to prioritize, how to interpret attacker behavior, how to coordinate response) still require people with context.

Can AI Detect Cyber Threats on Its Own?

AI can identify patterns and anomalies across large datasets faster than human analysts. For that specific task, it’s effective enough to run continuously without direct human oversight. What it can’t do reliably is decide what to do about its findings. The tools generate findings. People act on them, tune the models and handle the edge cases the models haven’t encountered before.

Is AI Making Cyberattacks More Sophisticated?

Attacks are more polished and scalable with AI. The 2026 Verizon DBIR found that fewer than 2.5% of observed AI-assisted attack techniques were rare. Attackers are applying AI to execute known techniques more efficiently, at higher volume and with better quality content. For most organizations, that means more frequent attacks with more convincing messages to defend against.

Can AI Impersonate Coworkers?

Yes. In the 2026 Sagiss survey, 64% of respondents said an AI-generated message could somewhat or very likely impersonate someone they work with. Writing style, professional tone and real workplace context can all be reproduced with current generative AI tools. Voice and video add dimensions that make impersonation harder to detect in real-time communication.

How Can Businesses Use AI Safely?

An approved-tool policy that covers which AI tools employees may use, what categories of data those tools can process and what access controls apply is the minimum starting point. Monitoring for unusual data transfers and restricting confidential content from public AI tools are practical controls that don't require major investment. The NIST AI Risk Management Framework and the draft IR 8596 Cyber AI Profile both provide structured approaches to AI governance worth building from.

Contact Sagiss to discuss managed security services built for SMBs in the Dallas-Fort Worth area.