AI and cybersecurity: the attacker already uses GPUs

For years, the best defense against phishing was the attacker's clumsiness: spelling mistakes, generic greetings, implausible urgency. That era is over. Malicious emails are now written with generative models in flawless English, they mimic the tone of your real supplier, and they land right when you usually pay invoices. The cost of launching a convincing attack has collapsed; the volume has surged.

What has changed on the attacker's side

• Tailored phishing: emails personalized per victim using public information from LinkedIn and the corporate website, generated by the thousand in minutes.
• Cloned voices and videos: "CEO fraud" is now done with synthetic audio that impersonates your CFO asking for an urgent transfer.
• Mutating malware: malicious code that rewrites itself to evade static antivirus signatures.
• Automated reconnaissance: agents that scan your perimeter looking for vulnerable versions, leaked credentials, and open doors.

Defending with the same technology

The good news: the asymmetry cuts both ways. The same models that write the scam can detect it, and an anomaly-detection system spots patterns a human misses at three in the morning. In practice, defensive AI helps on four fronts: analysis of incoming email that weighs intent, not just the sender; detection of anomalous behavior across accounts and networks; automatic triage of alerts so the security team looks only at what matters; and automated response that isolates a compromised machine in seconds, not hours.

The question is no longer whether your company will use AI in security. It's whether it will use it before whoever is targeting it does.

The risk that lives inside: the AI you already use

There's a second, less obvious front: your own AI. Every tool the team adopts on its own is a new channel through which data can leak — prompts containing customer information, documents uploaded to free services, agents with more permissions than they need. Governing that usage isn't bureaucracy: it's closing the back door. A tool inventory, a clear policy on what data can go into each one, and minimum permissions for any automated agent eliminate most of the risk without slowing anyone down.

Where to start

You don't need a movie-grade SOC to take the first steps. Start with what pays off most: turn on multi-factor authentication everywhere (yes, everywhere), train the team with simulations of AI-generated phishing — make it look like the real attack they'll receive — inventory which AI tools are in use and what data they touch, and define a second-channel verification protocol for any payment or account change requested by email or voice. With that foundation, the jump to AI-driven detection and response is made on solid ground.

Perfect security doesn't exist, but today's imbalance does have a remedy: the defender should think, at the very least, with the same tools as the attacker.