Why Cybersecurity Leaders Must Build an AI Strategy, Not Just Chase Speed

When I first heard the phrase “AI‑driven security,” the image that popped into my mind was a sleek robot scanning code at lightning speed, instantly flagging every flaw. It sounded cool, but it also felt a bit like sci‑fi. Fast‑forward to today, and the reality is a little messier – and a lot more nuanced.

Two recent developments have forced me to rethink how we approach artificial intelligence in cyber‑defense. First, Anthropic’s new language model, Mythos, reportedly trawled open‑source repositories and uncovered more than 23,000 potential vulnerabilities, with over a thousand graded as high or critical. Second, a Microsoft Threat Intelligence brief highlighted that threat actors are already weaponising AI to generate convincing phishing lures, translate stolen data, and even write snippets of malicious code. Those findings are impressive, sure, but they’re also a reminder that raw speed isn’t a substitute for strategy.

Start with the environment, not the tools. Before you hand over any part of your detection or response workflow to an algorithm, you need a clear picture of what you’re protecting. That means a solid asset inventory, an honest adversary profile, and a mapped‑out kill‑chain that shows where the most valuable targets sit. Without that foundation, you’ll end up feeding AI a flood of noise and hoping it magically pulls out the signal.

In my role as CISO at Corelight, I’ve seen teams get dazzled by a new AI platform and drop it straight into their SIEM without asking the hard questions: Which assets matter most? Which tactics do our likely adversaries favour? How does this tool fit into our existing playbooks? The answer, more often than not, is that we’re inserting a shiny new widget into an unsteady framework.

AI augments, it doesn’t replace judgment. One of the biggest misconceptions is that a model can make executive‑level decisions for you. In practice, the best use of AI is to broaden the lens of the people who already make those decisions. Think of it as a co‑pilot that points out turbulence ahead, but you still steer the aircraft. AI can surface patterns you might have missed, suggest board‑room questions, or flag policy gaps – but the final call stays with the human leadership team.

That same principle applies to vulnerability discovery. When Mythos flagged thousands of issues, the raw number was less useful than the insight it gave us about gaps in our own threat model. Those findings forced us to ask: Are we counting every component in our architecture? Are we applying secure‑by‑design principles early enough? Rather than treating the list as a checklist, we turned it into a signal to revisit our design assumptions.

Turn discovery into a faster learning loop. Traditionally, moving a new threat indicator from a security‑week report into a risk register can take weeks, if not months. With AI‑assisted parsing, that timeline shrinks dramatically – sometimes to just a few hours. In practice, we’ve begun automating the ingestion of reputable feeds, letting a model prioritize items based on relevance to our asset map, and then feeding the top contenders to our analysts for rapid validation. The result? Control testing gets reprioritized faster, and penetration‑test scopes become more focused.

But speed without context can be dangerous. An AI model might flag a CVE that looks severe on paper, yet the vulnerable component is never used in your environment. That’s why the learning loop must include a human verification step – not as a bottleneck, but as a guardrail that ensures the model’s confidence aligns with reality.

Build the strategy first. Here’s a quick, three‑step framework I like to share with peers:

1. Map your threat landscape. Asset inventory, adversary personas, and kill‑chain positioning – get these nailed down.
2. Define AI use‑cases that plug real gaps. Whether it’s quicker vulnerability triage, enriched phishing detection, or automated policy compliance checks, the use‑case should solve a documented need.
3. Establish governance. Set clear ownership for model outputs, create an audit trail, and decide how often you’ll retune the model as your environment evolves.

When you follow a roadmap like this, AI becomes a force multiplier rather than a wildcard. It helps you see farther, react quicker, and allocate resources where they truly matter.

In short, the conversation about AI in cyber‑security needs to shift from “How fast can we deploy this tool?” to “What problem are we solving, and how does AI fit into our larger defense strategy?” The future won’t be about robots taking over the SOC; it will be about smart humans using smarter tools – deliberately, responsibly, and with a clear plan in hand.