AI and Cybersecurity: One Key in Two Hands

The guard to whom we hand the keys of our digital fortresses may be the very spy studying their weak points. This is the reality of AI in cybersecurity today: the same weapon is drawn in the hands of defender and attacker alike. A model trained to find vulnerabilities can, with a slight adjustment, exploit them.

How did the equation flip?

Defence once rested on “lists”: known malicious signatures, updated whenever a new virus appeared, so the attacker usually stayed ahead. Then machine learning arrived, and systems began to watch for anomalous behaviour rather than signatures alone, catching an intrusion by its strange rhythm. Experiments such as MIT’s AI² system show that pairing a human analyst with the algorithm improves detection accuracy. But the key itself has reached the adversary’s hand: no sooner had the defender mastered the language of patterns than the attacker did too.

The attacking front advances

Reality contradicts the marketing brochures that treat AI as a ready-made cure. Generative models write phishing messages in flawless language, free of the clumsiness that used to betray the fraudster, and the World Economic Forum’s Global Risks Report 2026 lists cyber insecurity among the foremost risks. The core dilemma is structural: the defender must succeed every time, while the attacker needs to succeed only once. Many researchers believe AI has magnified this imbalance, and experts consider it likely that the cost of automated attacks has fallen.

On the other hand, IBM’s Cost of a Data Breach study (2025 edition) shows that organisations that expanded their use of AI security and automation saved about 1.9 million US dollars per breach and shortened its lifecycle by around 80 days. So the yardstick is no longer preventing every breach, but speed of detection and time to recovery: the smart fortress is the one whose wound closes before the bleeding spreads.

Deepfakes: the erosion of trust

A deepfake can fabricate a voice speaking in a manager’s accent and ordering an urgent transfer, or a face moving in a video call. The deeper danger is not the single deception but the erosion of trust: when every voice becomes suspect, the tacit contract on which human dealings rest collapses.

The defence is itself a target

Intelligent defence systems face “adversarial attacks”: carefully crafted inputs that fool the model into classifying the malicious as safe, or the “poisoning” of its training data. The US National Institute of Standards and Technology (NIST) classifies these attacks in a detailed taxonomy. A system’s robustness is measured not by its accuracy in ideal conditions but by its resilience against an adversary trying to corrupt it. Organisations that replace the human expert with an automated system in the name of efficiency may trade a known weakness for an unknown one.

Four pillars

1. Zero trust: no automatic trust in any party, inside or outside.
2. Human in the loop: the algorithm speeds up detection; contextual and ethical judgement belongs to the human mind.
3. Continuous adversarial testing: ethical penetration testers breach the system before its enemy does.
4. Training people against social engineering: the sturdiest firewall falls to a poisoned attachment opened by a hurried employee.

In the Kingdom

The National Cybersecurity Authority was established by royal order (6801, dated 11/2/1439 AH) as the national reference that sets controls and builds capabilities, and cybersecurity has been tied to the digital transformation path in line with Saudi Vision 2030. Digital immunity cannot be imported like hardware; it is cultivated in national talent that understands the adversary and stays a step ahead.

Most likely we are heading into an era in which the attacker’s algorithms and the defender’s confront each other at a speed beyond our perception. The question is not how to build a machine that guards us, but how to keep the human in place as judge and conscience. A blade does not choose its direction; the mind that grips it does. AI cannot decide for us; we take the means to our security in proportion to our care that the human remains the hand on the handle, and we ask God for success and protection.