Editor’s note: The following is a guest post from Scott Laliberte, managing director at Protiviti.
AI is fundamentally changing cybersecurity, but perhaps not for the reason many technology leaders expect. The most consequential shift may not be a new category of attack. It is speed.
AI can accelerate the discovery, weaponization and exploitation of vulnerabilities. Many organizations, however, still rely on vulnerability management, patching and incident response processes designed for a time when defenders had a larger window to act.
Now, that window is shrinking, and the gap between the speed of an attack and the speed of the response is becoming a major resilience issue.
For CIOs, the task at hand is to make the enterprise faster at defending, responding and recovering. In the AI era, that speed will increasingly distinguish organizations that simply have security programs from the organizations that are truly resilient.
Fighting speed with speed
Cybersecurity has always been an asymmetric contest. Attackers need to find one viable route into an organization, while defenders are responsible for protecting a sprawling technology environment. AI can intensify that imbalance by compressing activities that once required substantial human effort.
Organizations cannot reasonably answer to that acceleration with heavily manual processes. They need to identify where AI can improve the speed and precision of existing defenses without introducing unnecessary complexity or risk.
The software development lifecycle is one place to start. Development teams should use advanced tools earlier to identify coding weaknesses, security flaws and potential exposures before applications reach production. Security teams should continue assessing deployed applications as changes are made to the application and new vulnerabilities and attack paths emerge.
If attackers are using increasingly capable models to expose weaknesses, defenders need comparable capabilities embedded throughout development and operations.
This is an argument for pragmatic adoption rather than indiscriminate automation. Organizations should enable speed where risk is manageable and apply deeper governance where the consequences are greater.
Starting with the fundamentals
AI is accelerating established threats but it’s also creating new security challenges. Agentic AI systems can access information, make decisions and take actions at machine speed, capabilities which make identity, permissions, monitoring and accountability more important.
Identity governance must extend beyond employees and conventional system accounts to encompass AI agents and other nonhuman identities.
AI also makes long-standing data governance shortcomings harder to tolerate. Excessive access, weak classification and oversharing are not new problems, but AI can surface poorly protected sensitive information in seconds. Weaknesses that were once difficult to exploit at scale can become far more consequential in an AI-enabled enterprise.
A proper response should begin with the basics. CIOs need strong data security and modern identity and access management, with governance that extends to AI agents and other nonhuman identities.
Those foundations should carry into security operations, vulnerability management and software development. Workforce readiness matters, too. Employees must recognize AI-enabled threats, while technical teams need the skills to use AI as a force multiplier for defense.
Erasing the CIO-CISO divide
Cyber resilience is not solely a CISO responsibility or a CIO responsibility. It is a shared business capability.
Security organizations identify and prioritize risk. Technology organizations typically implement the changes needed to address risk and keep critical systems running. During a disruption, those responsibilities become inseparable.
Vulnerability management illustrates the problem. Security teams can use scanners, threat intelligence and AI models to identify and prioritize emerging exposures. Technology teams usually control patch deployment, system changes and operational stability. But if both functions have different priorities, even the best intelligence will not translate into faster risk reduction.
App development creates the same interdependency. CIO and CTO organizations build and deploy technology, but security needs to be involved throughout the process, from identifying weaknesses before code reaches production to continuously assessing applications after deployment. Neither function can succeed independently.
Resilience and recovery are also shared. Security teams may identify the threat and understand attacker behavior, while tech teams manage restoration and operational continuity. Both need a common view of the systems that matter most to the business.
Business impact analyses, recovery time objectives and resilience planning should translate that understanding into measurable priorities.
Visibility as defense
Amid attention to advanced models and sophisticated attacks, one requirement can sound surprisingly basic: asset management. It may also be one of the most important.
Organizations cannot secure systems, applications, data repositories, models, agents and identities they do not know exist. AI proliferation makes maintaining that inventory more difficult and more consequential. Asset management must become a shared discipline led by tech teams and informed by security and business stakeholders.
AI security should strengthen the connection among transformation, protection and response. Technology teams drive transformation. Security teams help protect the enterprise. Resilience is achieved when both work with the business to improve response speed and recovery effectiveness.
According to Protiviti's 2027 Top Risks & Opportunities Survey, only 22% of surveyed organizations reported high confidence across all three dimensions, indicating considerable room for improvement. Cyber threats remain the leading near-term risk, while risks associated with implementing AI rose to the second position.
AI will continue to accelerate innovation — but it will accelerate attackers as well. Despite these concerns, companies need to continue innovating while building the governance, operational discipline and collaboration to use it without losing control of the risks.
