Cyberattacks are becoming more frequent and more sophisticated. Although artificial intelligence can make many processes significantly more efficient, experts warn that it should not be the only solution for protection against cyber threats. Combining AI and people, and having them work together, can bring more balance to practice and make the most of the strengths of both. In this article, we take a closer look at how artificial intelligence (AI) and the human factor connect in cybersecurity.

Using AI to detect and prevent cyberattacks

Using AI in various fields can bring greater efficiency and productivity and save time and money. Artificial intelligence can very effectively take over many tasks that are strenuous and exhausting for people, and it can perform them continuously, without needing rest.

In many situations, AI can eliminate the risk of human error, which is often the result of fatigue and inattention. In the same breath, however, it must be said that artificial intelligence is not infallible either and can present falsehoods as facts and correct information. This can happen, for example, when an algorithm is poorly configured or when the AI has been trained on incorrect data.

The role of AI in cybersecurity

Real-time detection of cyber threats

Traditional systems often respond only once attackers have already penetrated a network or system. AI, however, can analyse user and device behaviour in real time, recognise unusual behaviour patterns and immediately flag risky activities.

Predicting cyberattacks

Thanks to the large amount of data AI draws on, it can effectively recognise in real time patterns that have preceded attacks in the past, or identify unusual behaviour patterns and uncover these anomalies.

Automating responses

AI can automatically isolate infected devices, block communication with suspicious servers or launch incident response procedures even before a human intervenes.

The result is a faster response, early detection of a real cyberattack and thus minimisation of any damage.

AI as a double-edged sword

Although AI is a powerful and efficient cybersecurity tool, it also has its limits. It can also become a powerful weapon in the hands of attackers.

How do cyber attackers use AI?

• Automated attacks: AI can be used for automated protection, but also to generate automated phishing emails and carry out other attacks at scale.
• Deepfakes and next-generation social engineering: a major threat today is the phenomenon of so-called deepfake audio and video, which enables a kind of psychological manipulation of people that until recently we knew only from the boldest science-fiction films. Faked identities, photos, accounts and various sensitive personal and business information are often indistinguishable for a layperson without special technology and can devastate people’s lives and careers.
• Misuse of generative models: generative AI can also be used to create malicious code, automate malicious campaigns or bypass detection mechanisms.

Connecting AI with cybersecurity therefore lies in a balanced cooperation between artificial intelligence and the human factor.

Benefits and risks of AI in cybersecurity

If you use artificial intelligence in cybersecurity, its greatest advantage is the ability to work with huge amounts of data in real time. AI helps assess risks faster, supports security teams’ decision-making and makes strategic planning easier where manual analysis would fail.

At the same time, AI systems must be kept under control. To minimise errors, you need to understand how and why the AI responds in a certain way. Transparency, auditability of decisions and regular review of outputs are important, especially in environments involving sensitive data. Equally important is the ongoing training and updating of AI models so that they work with current, verified data.

Artificial intelligence is not meant to replace the work of security analysts, but to strengthen it. You achieve the best results when technology supports human judgement. With the growing use of AI, there is therefore naturally also a need to address ethical questions, responsible process design and clear rules for protection against data misuse.

This article is an output of the project “Multitenant Cybersecurity Operations Center Delivered as an Open Cloud Service with Machine Learning Elements.” Project code – 09I05-03-V02-00010.