Artificial intelligence (AI) is a broad term for algorithms that perform tasks associated with human intelligence. It includes machine learning, natural language processing, and generative AI. In cybersecurity, data-driven AI is commonly used to find patterns in existing data, assess risks, and support decisions; generative AI can also create content and synthetic data. The distinction matters when choosing a tool for a security task. section 1.6 section 12.1.1
A practical AI-assisted security workflow has four parts:
- Collect relevant logs, network traffic, and endpoint activity. section 10.4
- Analyze the data for anomalies or patterns that may indicate a threat, including correlations a human analyst might miss. section 10.4 section 10.0
- Automate an appropriate response where warranted, such as quarantining a device or blocking traffic. section 10.4
- Use incidents and analyst feedback to refine the model, then measure whether detection and response actually improve. section 10.4
AI is not a substitute for security controls or human judgment. Incomplete or biased training data can produce missed threats, disproportionate risk assessments, or false alarms. Track true positives alongside false positives: excessive alerts can cause fatigue and make genuine threats easier to overlook. Validate models and use their findings alongside rule-based and signature-based detection, behavioral analysis, and human oversight. Defenders must also account for attackers using AI in phishing, malware, and social engineering. section 1.6 section 1.7 section 10.4
Make a threat-detection investment legible
A healthcare organization invests $500,000 in AI-powered threat detection to protect patient data and maintain operations. Its executive presentation reports incident response time falling from 24 to 4 hours, no successful ransomware attacks in the past year, and a 100% HIPAA audit pass rate. These are clearer decision inputs than an alert count alone. The presentation also estimates breach-prevention savings; that estimate should remain distinct from observed outcomes. section 4.3.4
Figure 13.1 AI synthetically generated pipeline
A separate generative-AI workflow shows how a structured prompt can produce fictitious security data that is organized in a pandas DataFrame, analyzed with Python, and turned into charts or reports. Check generated data and conclusions for accuracy, bias, and privacy concerns before using them to guide decisions. section 13.6 section 13.11
