Defend with AI
Attackers are using AI. Your defenders should be using it too.
Two connected halves of the same conversation: putting AI to work on the security tasks where it genuinely helps, and adapting your controls to the things AI has made cheaper, faster or more convincing for an attacker.
Two halves
One is an opportunity. The other is a change you did not ask for.
Most organisations are dealing with both at once, usually with the same small team. Treating them as separate programmes is how one of them gets neglected.
Do the work faster and better
Security work involves a great deal of reading, correlating, summarising and writing up. Those are exactly the tasks where AI earns its place — provided somebody has thought about where the output goes and who checks it.
- Alert triage — cutting the time between an alert arriving and someone understanding it
- Investigation support — pulling context together so an analyst starts informed
- Threat analysis — making sense of intelligence in the context of your estate
- Detection engineering — drafting, reviewing and documenting detection logic
- Security knowledge search — finding the runbook, the previous case, the policy
- Incident summarisation — turning a timeline into something a stakeholder can read
- Reporting and evidence review — the write-up that always lands last and late
- Repetitive analyst workflows — the parts of the job nobody joined to do
Controls that reflect what you now face
Very little here is a brand-new category of attack. What has changed is the cost, the volume and the plausibility — which is enough to make some existing controls stop working as well as they used to.
- Phishing and social engineering — better written, better targeted, at scale
- Impersonation and deepfake-enabled fraud — voice and video as an approval route is no longer safe
- Automated reconnaissance — your public footprint reviewed faster and more thoroughly
- AI-assisted attacker workflows — lower skill floor for work that used to need expertise
- Misuse of public AI tools — staff pasting things they should not into tools you do not control
- Data leakage through AI — information leaving by a route your controls never anticipated
- Attacks against your AI systems — agents and applications as a target in their own right
- Prompt manipulation and over-permissioned actions — persuading a system to exceed its remit
How we approach it
Start where the team is actually losing time.
-
01
Find the real bottleneck
Where the hours go, which work gets deferred, and which decisions are slow because the context is scattered.
-
02
Apply AI where it holds up
Pick the tasks where the output can be checked, the input is available, and being wrong is recoverable. Leave the rest alone for now.
-
03
Adjust the controls
Revisit the controls that AI-enabled threats have quietly weakened — approval routes, identity checks, awareness, and what staff can send where.
Where this is aimed. The point is to give your security people better reach, context and speed — not to remove them from the process. AI moves where their attention goes; it does not remove the need for judgement, and a system that summarises an incident confidently and incorrectly is worse than no summary at all. An autonomous SOC is explicitly not something we are offering.
A note on your own tooling
Security AI is still AI.
An assistant pointed at your alerts, cases, logs and runbooks is holding some of the most sensitive material in the organisation.
It deserves the same boundary questions as any other deployment: who can use it, what it can read, which tools it can call, what it can do unattended, and how you would know if any of that stopped being true.
The tool you bought to watch everything is, by definition, a tool that can read everything.
Start with the workload
Which part of the security week would you buy back first?
That is usually a better opening question than which product to trial. Tell us how the team currently spends its time, and where you think the threat picture has shifted.