AI in Cybersecurity

AI in cybersecurity refers to the use of machine-learning and generative models to defend computer systems — and, increasingly, to attack them. Defenders apply it to spot intrusions, triage alerts and automate response; attackers apply it to generate convincing phishing, mutate malware and scale social engineering. The result is an arms race in which both sides draw on the same class of technology.

History and Background

Machine learning entered security products in the 2010s primarily as anomaly detection: baselines of "normal" network traffic, endpoint behaviour and login patterns, with deviations flagged as suspicious. Classical models — decision trees, gradient boosting, clustering — powered early user-and-entity behaviour analytics and spam filters, while deep learning improved malware classification by learning directly from raw file bytes or API call sequences.^[1]

The arrival of large language models in 2022–2023 changed the balance. Generative AI lowered the cost of producing grammatical, context-aware phishing emails, of cloning voice and video for business email compromise, and of polymorphic malicious code that rewrites itself at runtime. Security researchers documented malware strains such as LAMEHUG and PROMPTFLUX that call LLM APIs during execution to regenerate their own payloads, defeating signature-based tools.^[2] Defenders adopted the same models for reading logs, writing detection rules and summarising incidents — turning the security operations centre (SOC) from a queue of raw alerts into a ranked shortlist.

Key Concepts

• Dual use. Every defensive capability has an offensive mirror: language models write both detection rules and phishing lures; code models both review patches and discover vulnerabilities.^[1]
• Alert triage. A modern SOC receives thousands of alerts per day. AI agents cluster, enrich and rank them so analysts investigate true positives instead of noise — the single highest-value defensive use of AI today.^[2]
• Adversarial machine learning. Models are themselves attack targets. Evasion attacks perturb inputs so a classifier judges malware benign; data poisoning corrupts training data; model extraction steals a model through repeated queries. Defending models is now a discipline of its own.^[3]
• AI red teaming. Before deployment, organisations probe their own systems with automated attacks — prompt injection, jailbreaks, agent tool misuse — to find failures early. Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 formalise parts of this process.
• Generative social engineering. Deepfake audio and video calls, and phishing written in a target's own idiom and tone, erode the human layer that security training assumed was stable.^[2]

Applications and Impact

AI is now embedded in endpoint detection and response, security information and event management (SIEM), identity analytics and fraud scoring. IBM's annual breach research has consistently found that organisations using security AI and automation extensively detect and contain breaches far faster than those that do not, with materially lower average breach costs.^[3] Banks use it for real-time transaction fraud detection; cloud providers use it for spam, abuse and credential-stuffing defence.

On the offensive side, the measurable shift is scale and personalisation: campaigns that once required a human writer per target can now be generated per victim from public data, in multiple languages, at negligible cost. Industry reporting suggests an AI-assisted component in a large and growing share of attacks, primarily phishing and reconnaissance.^[2]

>See Also

• Cybersecurity Malaysia
• Adversarial Machine Learning
• AI Red Teaming
• Prompt Injection
• AI Guardrails
• PDPA Malaysia