How AI is Transforming Cybersecurity: Threats, Defenses, and the Future of Security Operations

Introduction

Tom Rufalo, CISA, and Ed Holt, Director of Fortinet, opened the webinar by outlining the agenda: how attackers are using AI, how AI‑powered solutions defend networks, which products already embed AI, and the risks of staying with non‑AI tools.

AI‑Enabled Attack Techniques

• Automation & Scale – AI bots can scan for vulnerabilities, launch attacks, and exploit them with minimal human effort, making attacks cheaper and faster.
• Personalized Social Engineering – Generative AI creates convincing phishing emails, deep‑fake audio/video, and realistic fake websites, boosting the success of CEO‑fraud and credential‑theft campaigns.
• Zero‑Day & Malware Creation – AI assists in crafting zero‑day exploits and dynamically mutating malware, increasing the difficulty of detection.
• Brute‑Force & Password Cracking – Machine‑learning models improve password‑guessing efficiency by learning patterns from leaked data.
• IoT Exploits – AI‑driven input attacks target vulnerable IoT devices, expanding the attack surface.

AI‑Powered Defensive Capabilities

• Baseline & Anomaly Detection – Large‑scale data analysis establishes what “normal” traffic looks like; deviations trigger alerts.
• Enhanced Monitoring – AI augments SOC teams across EDR, NDR, and SIEM platforms, delivering faster detection and automated response.
• Reduced False Positives – By correlating massive data sets, AI filters out noise, letting analysts focus on real threats.
• Zero‑Day Detection – Anomaly‑based models can spot previously unknown attack patterns.
• Predictive Analytics – Forecasting techniques anticipate future threats before they materialize.
• Instant Response Automation – AI‑driven playbooks execute containment actions (e.g., block IPs, isolate endpoints) within seconds.

Security Products Leveraging AI

• Endpoint Detection & Response (EDR)
• Network Detection & Response (NDR)
• Secure Email Gateways & Web Filters
• Next‑Generation Firewalls (NGFW) with XDR capabilities
• AI‑enhanced Threat Intelligence platforms
• Security Orchestration, Automation & Response (SOAR) tools

Limitations of Non‑AI Solutions

• Static Signatures – Rely on known patterns; ineffective against novel or polymorphic attacks.
• Delayed Updates – New threats require manual signature updates, creating a detection lag.
• Human‑Centric Monitoring – Limited data visibility leads to higher error rates and slower response.
• Lack of Dynamism – Inflexible tools cannot adapt quickly to evolving threat landscapes.

Fortinet’s AI Vision & Platform

• Company Snapshot – Founded in 2000, ~14,000 employees, 140 cloud locations, 800,000+ customers, and the world’s leading NGFW vendor.
• Security Fabric – A single operating system unifies networking, endpoint, and cloud security, enabling AI‑driven automation across the stack.
• FortiAI (Generative AI Assistant) – Natural‑language interface that pulls from FortiGuard threat intel, runs RAG (Retrieval‑Augmented Generation), and produces actionable playbooks.
• Key Benefits Demonstrated in the Demo
• Rapid incident triage (slow server case) using voice‑driven commands.
• Automated threat hunting, IP blocking, and report generation.
• Seamless hand‑off to forensics and CISO communication.

ROI & Operational Impact

• Detection Time – Independent study: average detection reduced from 21 days to under an hour with AI‑enabled SOAR.
• Analyst Efficiency – One AI‑augmented analyst can perform the work of two to four traditional analysts, expanding coverage from a single campus to multiple sites.
• Cost Savings – Faster containment lowers breach costs (average $9.4 M) and reduces on‑site visits by up to 25 %.

Adoption Checklist for Generative AI in Security Operations

1. Data Governance – Document data sources, processing methods, and storage; ensure compliance with privacy regulations.
2. Risk Assessment – Evaluate internal and third‑party AI risks, especially when using external AI services.
3. Policy Development – Define transparency, accountability, and usage guidelines for generative AI.
4. Use‑Case Inventory – List all AI‑driven applications and assess associated vulnerabilities.
5. Integration Strategy – Embed AI into existing SIEM, SOAR, and analytics tools.
6. Performance Metrics – Track MTTR (Mean Time to Detect/Respond) and continuously refine models.
7. Continuous Evaluation – Monitor AI impact on security KPIs and adjust strategies accordingly.

Future Outlook

• By 2025, 20 % of network configurations will be AI‑assisted; by 2026, 60 % of network operations will rely on generative AI.
• Expected improvements: 25 % better network performance, fewer on‑site visits, and higher user satisfaction.

Closing Remarks

The webinar emphasized that AI is not a plug‑and‑play solution but a strategic journey. Organizations that integrate AI across detection, investigation, and response can outpace attackers, reduce operational overhead, and achieve measurable ROI.

Key Takeaway: Leveraging AI across the entire security stack—from threat hunting to automated remediation—transforms reactive defenses into proactive, scalable operations, dramatically shortening detection times and lowering breach costs while empowering security teams to do more with less.

AI is reshaping cybersecurity by giving attackers powerful new tools, but it also equips defenders with faster, more accurate detection and automated response capabilities. Organizations that adopt AI‑driven security platforms like Fortinet’s Security Fabric can dramatically cut detection times, reduce false positives, and achieve a strong ROI, while those that cling to static, non‑AI solutions risk falling behind in an increasingly automated threat landscape.