Let's be direct about something the industry is still dancing around: AI does not sit on one side of the security equation. It is on both sides at once. The organisations pretending otherwise, whether they are evangelising AI as a security saviour or treating it purely as a threat, are setting themselves up for a hard lesson.

The World Economic Forum found that 94% of security leaders name AI as the single biggest change driver in cybersecurity right now. That is not a statistic about the future. It describes the current operating environment. And it cuts in two directions that security leaders have to hold in mind at the same time.

‍

The Case for AI in Defence Is Real and Backed by Data

IBM's 2025 Cost of a Data Breach report is unambiguous: organisations with AI and automation embedded in their security operations detected and contained breaches 108 days faster than those without. In breach economics, 108 days is an enormous gap. It is the difference between a contained incident and a notifiable event with regulatory, financial, and reputational consequences.

The mechanism is straightforward, and underappreciated. Traditional SOC operations run on rules, with alerts firing when predefined thresholds are crossed. AI adds behavioural baselines, anomaly detection, and pattern correlation across volumes of data that no human analyst team can match at speed. It reduces alert noise, speeds up triage, and lets less experienced analysts operate at a higher standard by supporting their judgement rather than replacing it.

In a region where ISC2 estimates a shortfall of 2.6 million cybersecurity professionals across Asia Pacific, AI is not a luxury. It is a practical response to a talent equation that is not going to resolve itself any time soon.

‍

The Threat Side of AI Is Already Here

FraudGPT costs $200 a month. It writes convincing phishing emails, generates social engineering scripts, and produces functional malware variants. The skill barrier that once filtered the adversarial population has effectively been removed. What used to require a capable human operator with months of experience now requires a subscription.

In early 2026, the first confirmed AI-orchestrated cyberattack was disclosed. In that campaign, AI autonomously performed 80 to 90% of the operation, including reconnaissance, target selection, phishing generation, and initial access. A human set the objective. AI executed the campaign. This is not a warning about where the threat is heading. It describes where it already is.

Deepfake fraud reached $1.1 billion in losses globally in 2025. Voice cloning of executives to authorise wire transfers. Video deepfakes used to bypass identity verification. These are not sophisticated nation-state techniques. They are available to organised criminal groups and, increasingly, to individual threat actors.

‍

The Shadow AI Problem Inside Your Own Organisation

Here is the risk that is hardest to discuss honestly inside an organisation: 57% of employees are using personal AI accounts for work. One in three is entering sensitive data, including customer records, financial models, internal strategy, and legal correspondence. Gartner measured an average of 223 data incidents per organisation per month from this behaviour alone.

The instinct is to frame this as a policy enforcement problem. It is not. These employees are productive people trying to do their jobs better. The real issue is that governance has not kept pace with behaviour. Data loss prevention, CASB, and information protection controls were not architected for AI tool data flows. External AI platforms may retain input data for model training. They may store it in jurisdictions with different data protection regimes. In most cases, the organisation has not reviewed the data processing practices of the AI tools its employees use every day.

Governing AI is not about blocking productivity. It is about making sure the organisation knows where its data is going, who can access it, and what protections are in place, the same standard we apply to any third-party data processor.

‍

Conclusion

The organisations I respect most in this space have approached AI with the same governance discipline they apply to any high-risk technology, neither with fear nor with uncritical enthusiasm. They are deploying AI in their security operations because the evidence for it is strong. And they are governing employee AI usage because the risk of not doing so is measurable and growing.

Most organisations sit in the governance gap between AI adoption and AI oversight right now. Closing it is not optional. It is the defining security governance work of 2026.