Artificial intelligence is rapidly becoming one of the most useful technologies in the modern workplace. Businesses are using AI to write content, analyse information, automate repetitive tasks and improve productivity.
But the same technology helping companies become more efficient is also changing the cybersecurity threat landscape.
AI can help attackers move faster, create more convincing scams and automate activities that previously required significant human effort. At the same time, companies are increasingly using AI themselves to detect suspicious behaviour and respond to cyber threats.
This has created a strange new reality: AI is simultaneously becoming a cybersecurity weapon and a cybersecurity defence tool.
Recent research from ISACA highlights the scale of the challenge. Its 2026 research found that 35% of European organisations could not say whether they had already experienced an AI-powered cyberattack. Meanwhile, 71% of professionals surveyed said AI-powered phishing and social-engineering attacks had become more difficult to identify.
That is significant because phishing has traditionally depended on obvious mistakes.
A suspicious email might contain poor grammar, an unusual sender address or an obviously fake request. Generative AI makes it much easier to produce convincing messages that sound professional and closely imitate the language used by real organisations.
Attackers can also use AI to personalise their attempts.
Instead of sending thousands of identical messages, an attacker could potentially generate different messages for different targets based on publicly available information. A company executive could receive a carefully written message that appears to come from a colleague, while an employee in the finance department could receive another designed specifically around their responsibilities.
AI can also accelerate social engineering.
People tend to trust messages that appear relevant to them. The more convincing a fraudulent communication becomes, the harder it can be for employees to distinguish between legitimate requests and manipulation.
Deepfakes add another dimension.
AI-generated voices, images and videos are becoming increasingly sophisticated. In the future, verifying someone’s identity may require more than simply hearing their voice on a phone call or seeing them on a video conference.
But businesses should not view AI purely as an enemy.
The technology can also strengthen cybersecurity operations.
AI systems can process enormous amounts of data much faster than human security teams. They can identify unusual login patterns, detect suspicious network activity and help security professionals prioritise potential threats.
ISACA’s research found that 43% of surveyed professionals believed AI had improved their organisation’s ability to detect and respond to cyber threats, while 34% were already deploying AI specifically for cybersecurity purposes.
The problem is that adoption is moving faster than governance.
The same research found that 82% of organisations allowed AI use, while only 42% had a formal, comprehensive AI policy. That creates an obvious gap between what employees are allowed to do with AI and what organisations can actually monitor.
An employee could unknowingly paste confidential information into an AI tool. Another employee might install an AI-powered browser extension without understanding what information it can access.
This is why cybersecurity strategies need to evolve alongside AI adoption.
Businesses should know which AI tools employees are using, what information those tools can access and which systems are connected to them. Employees also need training on AI-generated phishing, deepfakes and the risks associated with sharing sensitive information.
Most importantly, organisations should stop treating AI as simply another software product.
AI systems can interpret information, generate content and increasingly take actions. Their capabilities can therefore introduce risks that traditional applications do not.
The cybersecurity battle of the coming years will not simply be humans versus machines.
It will be AI-assisted attackers versus AI-assisted defenders, with businesses caught in the middle.
Companies that understand both sides of that equation will be better positioned to take advantage of AI without unnecessarily exposing themselves to the threats that come with it.
