The Role of AI in Modern Cybersecurity
The first time I heard a cloned voice read my own article back to me, I laughed. Then I stopped laughing. If a browser tool can do that to a nobody blogger from Sialkot for free, imagine what a funded crew does to a bank in Karachi. Both sides of cybersecurity are automated now, and pretending otherwise is the real vulnerability.
The offence automated first
Ransomware crews franchise their tooling like burger chains. Phishing kits write flawless, personalised English at scale. A CEO's voice can be cloned from a short public clip, and the "urgent transfer" call that follows sounds exactly like him. Defenders did not choose this arms race, but we all have to run in it.
Where AI genuinely earns its keep
- Detection. Behavioural baselines. An account that never touches HR files suddenly downloading them at 3 AM from a foreign network is an anomaly no signature list catches — modern UEBA tools flag it before the data leaves.
- Triage and response. SOAR platforms like Palo Alto Cortex XSOAR and Splunk SOAR absorb the alert flood, while analyst copilots — Microsoft Security Copilot, CrowdStrike Charlotte AI, SentinelOne Purple AI — summarise incidents and draft queries in plain English. Security Copilot can take a malicious script and reverse-engineer a detection rule from it.
- Email. Cloudflare Email Security, Proofpoint and Abnormal use language models plus vision modules to catch pixel-perfect brand impersonations that fool humans. Pindrop analyses call spectrograms to flag synthetic voices mid-conversation.
- Fixing, not just finding. GitHub Copilot Autofix and Snyk's DeepCode emit remediation pull requests a developer can merge in one click, and EPSS scoring ranks which CVE is actually being exploited in the wild rather than which one merely sounds scary.
- At the edge. Cloudflare Workers AI classifies traffic at the nearest point of presence, so malicious requests die milliseconds from where they arrived and never reach the origin.
The honest caveats
Copilots hallucinate indicators of compromise and mitigation steps — require citations and a human review before anything gets blocked or patched. Training pipelines can be poisoned, so guard the pipeline, not just the endpoint. And the skills shortage is real: smaller organisations increasingly buy these capabilities through MSSPs rather than build in-house.
The model that works in serious operations centres is human-led, AI-scaled. One senior analyst with a copilot now handles what used to need a tier-one team. Judgment stays human; speed becomes rented.
We defend inboxes and log files. In Gaza, the thing under attack is the record itself — hospital archives, family photographs, the infrastructure of memory. Protecting ordinary life is the entire point of this profession, and I try to remember whose ordinary life is currently on the line.
The oldest social engineering in Pakistan wears a travel-agent signboard, which is why we run ours the opposite way: license number in writing, payment only by bank transfer to a registered account, hotel names on paper before a rupee moves. That is HTG Travels in Sialkot — verify us before you trust us. We insist on it.
