--- title: "Will AI Help or Hurt Cybersecurity? A Practitioner's View" description: "AI cuts both ways in cybersecurity. Here's what it actually does well, where attackers are winning, and how to keep humans in the loop." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "Person", "@id": "https://christianespinosa.com/#person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "image": "https://christianespinosa.com/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg", "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ], "jobTitle": "Bestselling Author, Keynote Speaker, Entrepreneur", "worksFor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com/" } }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://christianespinosa.com/#website", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "publisher": { "@id": "https://christianespinosa.com/#organization" }, "inLanguage": "en-US" }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://christianespinosa.com/#organization", "name": "Christian Espinosa", "url": "https://christianespinosa.com/", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" }, "founder": { "@id": "https://christianespinosa.com/#person" }, "sameAs": [ "https://www.facebook.com/christian.espinosa.official", "https://x.com/Ironracer", "https://www.instagram.com/christian.espinosa.official/", "https://www.youtube.com/@ChristianEspinosaOfficial", "https://www.linkedin.com/in/christianespinosa/" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Will AI Help or Hurt Cybersecurity? A Practitioner's View", "description": "AI cuts both ways in cybersecurity. Here's what it actually does well, where attackers are winning, and how to keep humans in the loop.", "image": "https://christianespinosa.com/__l5e/assets-v1/92d18297-329d-4a03-9fd6-8fc62b3ac783/will-ai-and-machine-learning-help-or-hurt-cybersecurity-card.png", "datePublished": "2022-09-27T17:43:40+00:00", "dateModified": "2026-06-26T00:00:00+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://christianespinosa.com/blog/will-ai-and-machine-learning-help-or-hurt-cybersecurity" }, "author": { "@type": "Person", "name": "Christian Espinosa", "url": "https://christianespinosa.com/about" }, "publisher": { "@type": "Organization", "name": "Christian Espinosa", "logo": { "@type": "ImageObject", "url": "https://christianespinosa.com/logo.svg" } } }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is AI going to replace security analysts?", "acceptedAnswer": { "@type": "Answer", "text": "No. It replaces the boring parts of the job, which frees analysts to spend their time on judgment work: incident scoping, investigation, communication with the business, and decisions about what to escalate. Teams that use it well end up needing more skilled analysts, not fewer." } }, { "@type": "Question", "name": "What is the single biggest AI-enabled threat right now?", "acceptedAnswer": { "@type": "Answer", "text": "Targeted phishing at native fluency, often paired with a voice deepfake of an executive. It bypasses awareness training because the message no longer looks suspicious. The defense is process: a verification step that does not depend on the channel the request came through." } }, { "@type": "Question", "name": "Should I buy an AI-powered security tool because the vendor says it has AI?", "acceptedAnswer": { "@type": "Answer", "text": "No. Ask what specific decision the model makes, what data it was trained on, what the false-positive rate is in your environment, and what happens when it is wrong. If the vendor cannot answer those four, the AI is marketing." } }, { "@type": "Question", "name": "How does AI change medical device cybersecurity specifically?", "acceptedAnswer": { "@type": "Answer", "text": "Two ways. First, devices that ship with AI/ML features now fall under the FDA's predetermined change control plan guidance, which means you have to govern the model the same way you govern the firmware. Second, attackers can use AI to find vulnerable devices on hospital networks faster than the security team can patch them. Both push more weight onto secure-by-design." } }, { "@type": "Question", "name": "What is the first practical step for a team that has not adopted AI yet?", "acceptedAnswer": { "@type": "Answer", "text": "Pick one painful, repetitive task. Phishing triage is the usual starting point. Run an AI-assisted workflow alongside the human one for thirty days, measure precision and recall, then expand. Do not try to AI-enable the whole SOC at once." } }, { "@type": "Question", "name": "Will regulation slow AI adoption in security?", "acceptedAnswer": { "@type": "Answer", "text": "It will shape it, not stop it. Expect more requirements around model documentation, training data provenance, and human-in-the-loop for high-impact decisions. None of that is bad. It is the same maturity curve every other safety-critical industry has already been through." } } ] } ] --- [Skip to content](#main) [](/) [About](/about)[Speaking](/speaking)[Cybersecurity](/cybersecurity)[Programs](/programs)[Books](/books)[Media](/media) Writing Search Ctrl K[Connect](/connect) [Cybersecurity](/blog/category/cybersecurity) # Will AI and Machine Learning Help or Hurt Cybersecurity? September 27, 2022 4 min read 851 words Every vendor in the SOC is selling me AI. Every attacker on the other side is using it too. The teams winning right now are the ones who stopped treating it as magic and started treating it as a teammate with very specific strengths and very specific blind spots ![](/__l5e/assets-v1/ea874876-04cc-4621-a2db-1e85b22cc637/253fd3662b63.jpg) Published September 27, 2022 Read time 4 min In this essay 1. [01 Where AI is genuinely helping ](#where-ai-is-genuinely-helping) 2. [02 Where AI is hurting us ](#where-ai-is-hurting-us) 3. [03 The human element is not optional ](#the-human-element-is-not-optional) Jump to 1. [01 Where AI is genuinely helping ](#where-ai-is-genuinely-helping) 2. [02 Where AI is hurting us ](#where-ai-is-hurting-us) 3. [03 The human element is not optional ](#the-human-element-is-not-optional) The takeaways 1. 01 AI is excellent at pattern work: anomaly detection, spam filtering, botnet identification, vulnerability triage. Let it do that. What to do next Open your current vulnerability plan today and identify the one gap you would not want an auditor to find. 2. 02 Attackers use the same tools for better phishing, voice deepfakes, faster password cracking, and malware that hides inside normal traffic. What to do next Add attackers to the next leadership review as a standing item, not a one-time slide. 3. 03 Model output is not a decision. A human still owns the call, the escalation, and the accountability. What to do next Open your current model plan today and identify the one gap you would not want an auditor to find. 4. 04 The hardest part of rolling out AI in a security team is not the technology. It is the team's fear that it replaces them. What to do next Pause for five minutes today, then name the one place in your week where team is playing out and you have been avoiding naming it. 5. 05 Pair AI with people skills and a clear methodology. That combination beats either one alone. What to do next Open your current methodology plan today and identify the one gap you would not want an auditor to find. I walk into any security operations center this year and I hear the same word in every demo: AI. It is in the EDR, the SIEM, the email gateway, the phishing simulator, the developer's IDE, and the slide deck my CISO is about to present to the board. It is also in the hands of the people on the other side of the firewall. That is the part nobody likes to say out loud. The same models I use to spot anomalies are the ones attackers use to write better lures. So the honest answer to "will AI help or hurt cybersecurity" is yes. Both. At the same time. The question that actually matters is whether my team knows where the line is. ## Where AI is genuinely helping Machine learning is good at a narrow set of things, and most of them happen to be exactly what a tired analyst is bad at after hour six of a shift. **Anomaly and fraud detection.** Patterns are what models do. Sudden volume spikes, odd geographies, impossible travel, a service account that has never touched a database server suddenly enumerating one. A model can flag thousands of these per minute without getting bored. A human cannot. **Email and phishing filtering.** Phishing remains the front door. The 2021 report from APWG showed the highest volume of phishing attacks ever recorded, more than triple the level two years prior. Awareness training alone will not close that gap. ML-based filters cut down what ever reaches the inbox in the first place, which is the only training program that scales. **Botnet and behavioral identification.** Bot traffic looks like real users until you compare it to ten million sessions side by side. That comparison is the job. **Vulnerability management.** Most security teams are buried under a CVE backlog they will never finish. AI helps rank what to actually fix this week based on exposure, exploit availability, and asset criticality. Triage, not magic. **Malware classification and data loss prevention.** Models trained on file behavior catch new variants that signatures miss. They also catch sensitive data leaving the building in places humans would never think to look, including images and voice recordings. **SIEM and SOAR augmentation.** This is the one that quietly returns the most time. When the model can confidently auto-contain a known pattern, the analyst gets to spend the hour on the thing that actually requires judgment. ## Where AI is hurting us The same capabilities flip when the attacker picks them up. **Better reconnaissance.** Profiling a target used to take hours of manual scraping. Now it takes a prompt. Pretext quality has gone up accordingly. **Phishing at native fluency.** The grammar-mistake phishing email is dead. Modern lures read like internal comms because a model wrote them in the voice of someone the recipient already trusts. **Voice and video deepfakes.** A few seconds of audio from a podcast or earnings call is enough to clone a voice convincingly. Finance teams are already wiring money based on calls from "the CEO" that the CEO never made. **Ransomware acceleration.** The 2021 Colonial Pipeline incident was the public face of a much larger trend. AI lets attackers automate target selection, encryption, and negotiation. The dwell time keeps shrinking. **Adaptive malware.** Code that watches what the endpoint does and mimics normal traffic until exfiltration is well underway. Signature-based defense has nothing to say to it. **Password and CAPTCHA cracking.** If you still have anything that depends on a password alone, assume the model already has it. MFA is the floor, not the ceiling. ## The human element is not optional Here is the part the demos never cover. The model is good at the answer. It is bad at the question. It does not know your business, your regulatory exposure, your patient population, your vendor relationships, your last incident, or the political reason a particular system cannot go down on a Tuesday. A human still has to own the decision. That is where most rollouts fall apart, and it is rarely a technical problem. It is a [people problem](/blog/why-do-technical-people-struggle-with-people-skills-and-how-can-companies-fix-it). Engineers see the new tool as a threat to their identity as the smartest person in the room. They resist it, or they over-trust it, and either failure mode produces the same outcome: worse security than they had before they bought it. The teams that get this right do two things at the same time. They roll the technology in, and they invest in the soft skills, the communication patterns, and the decision rights that let humans and models actually work together. That is the entire premise of the Secure Methodology and the [book](/books/the-smartest-person-in-the-room) it came from. AI in cybersecurity is not a war of AI versus AI. It is humans plus AI versus humans plus AI. The side with the better humans wins. > “Technology is neither good nor bad. It depends on who is holding it and what they are trying to do with it.” Frequently asked ### Is AI going to replace security analysts? ### What is the single biggest AI-enabled threat right now? ### Should I buy an AI-powered security tool because the vendor says it has AI? ### How does AI change medical device cybersecurity specifically? ### What is the first practical step for a team that has not adopted AI yet? ### Will regulation slow AI adoption in security? [](/blog/will-ai-and-machine-learning-help-or-hurt-cybersecurity) Share this essay [X ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fwill-ai-and-machine-learning-help-or-hurt-cybersecurity&text=Will%20AI%20and%20Machine%20Learning%20Help%20or%20Hurt%20Cybersecurity%3F) [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fwill-ai-and-machine-learning-help-or-hurt-cybersecurity) [Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fwill-ai-and-machine-learning-help-or-hurt-cybersecurity) [Email](mailto:?subject=Will%20AI%20and%20Machine%20Learning%20Help%20or%20Hurt%20Cybersecurity%3F&body=https%3A%2F%2Fchristianespinosa.com%2Fblog%2Fwill-ai-and-machine-learning-help-or-hurt-cybersecurity)Copy link ![Christian Espinosa, headshot](/__l5e/assets-v1/de07e44b-a8e0-4bcc-bcb0-13aec15421f1/headshot-front.jpg) About the author [Christian Espinosa](/about) · Founder & CEO, Blue Goat Cyber I'm the founder and CEO of Blue Goat Cyber, a medical device cybersecurity firm where my team has supported 250+ FDA submissions with zero failing to clear on cybersecurity. I previously founded and sold Alpine Security. I host The Med Device Cyber Podcast and wrote The Smartest Person in the Room and The In-Between: Life in the Micro, with Medical Device Cybersecurity: An In-Depth Guide out in 2026. Air Force Academy grad, 24x Ironman, climber of two of the Seven Summits. Keep reading - [ ### Why People Still Beat Technology in Cybersecurity The companion argument: technology keeps advancing, the human layer keeps lagging, and that is where the breaches happen. Read essay → ](/blog/the-future-of-cybersecurity-innovations-in-technology-still-not-as-critical-as-people) - [ ### Building a Cybersecurity Team With the Secure Methodology If AI is the teammate, this is the operating manual for the rest of the team. Read essay → ](/blog/how-to-build-a-cybersecurity-team-from-scratch-using-the-secure-methodology) - [ ### Ransomware: Should You Pay? Ransomware is the most visible place AI is reshaping the threat landscape. The decision framework matters more than ever. Read essay → ](/blog/ransomware-should-you-pay) [← Previous essay What Is Total Intelligence, and How To Build a Cyber Team to Lead with It - Christian Espinosa ](/blog/what-is-total-intelligence-and-how-to-build-a-cyber-team-to-lead-with-it)[Next essay → What Is Zero Trust Architecture, and Why Should Your Organization Shift to It? - Christian Espinosa ](/blog/what-is-zero-trust-architecture-and-why-should-your-organization-shift-to-it) Related, Cybersecurity ### Need medical-device or offensive security expertise? Blue Goat Cyber, Christian's firm, runs FDA-aligned premarket submissions, penetration testing, and SBOM/SOUP analysis for medtech and high-stakes industries. [Explore Blue Goat Cyber](/cybersecurity) Christian Espinosa Bestselling author, keynote speaker, and Founding CEO of [Blue Goat Cyber](https://bluegoatcyber.com/). Helping technical leaders develop the soft skills that turn brilliance into impact. [](https://www.linkedin.com/in/christianespinosa/)[](https://x.com/Ironracer)[](https://www.instagram.com/christian.espinosa.official/)[](https://www.youtube.com/@ChristianEspinosaOfficial)[](https://www.facebook.com/christian.espinosa.official) Explore - [About](/about) - [Timeline](/timeline) - [Speaking](/speaking) - [Cybersecurity](/cybersecurity) - [Programs](/programs) Read - [Books](/books) - [Guides](/guides) - [Blog](/blog) - [Media](/media) - [Podcast Interviews](/podcasts) - [Success Stories](/success-stories) Connect - [Contact Christian](/connect) - [LinkedIn ↗](https://www.linkedin.com/in/christianespinosa/) - [Blue Goat Cyber ↗](https://bluegoatcyber.com/) - [Resources](/resources) © 2026 Christian Espinosa. All rights reserved. [Privacy](/privacy-policy)[Terms](/terms-of-use)