Why AI Is Forcing Security Leaders Beyond Detection and Response

Artificial intelligence has fundamentally changed cybersecurity—not just for defenders but also for attackers. AI can now generate convincing phishing campaigns, rapidly mutate malware and automate reconnaissance at a scale that would have required large teams only a few years ago. As attack velocity accelerates, many organizations are discovering that even mature detection and response capabilities struggle to keep pace.

That shift is forcing security leaders to rethink longstanding assumptions. Members of the Senior Executive Cybersecurity Think Tank, a community of experienced cybersecurity executives and practitioners, argue that future-ready organizations will succeed not by responding faster, but by preventing more attacks from succeeding in the first place.

According to IBM’s Cost of a Data Breach Report, organizations that combine AI-driven security with proactive risk reduction significantly reduce both breach costs and response times, reinforcing the business value of moving security “left” before attackers gain a foothold.

Below, Think Tank members share practical strategies for moving beyond reactive security, highlighting the technologies, processes and leadership mindset needed to stay ahead of these AI-powered threats.

“Adversaries now operate at machine speed, with personalized phishing, autonomous reconnaissance and adaptive malware that evades signature-based detection.”

– Kumar Ritesh, Founder, Chairman and CEO of CYFIRMA

SHARE IT

Think Like the Attacker Before the Attack Begins

Few leaders have seen cybersecurity from as many perspectives as Kumar Ritesh, Founder, Chairman and CEO of CYFIRMA. His experience spans national intelligence, IBM Research, PwC consulting and serving as global CISO for one of the world’s largest mining companies. Today, CYFIRMA focuses on helping organizations predict cyberattacks through external threat intelligence rather than simply responding once they occur.

Ritesh argues that AI has permanently altered the economics of cybercrime.

“AI has fundamentally changed the economics of attacking,” he says. “Adversaries now operate at machine speed, with personalized phishing, autonomous reconnaissance and adaptive malware that evades signature-based detection.”

Rather than concentrating primarily on identifying intrusions after they reach the network, he says organizations should shift toward anticipating attacks before they’re launched.

“Security leaders must shift from reactive to preemptive—anticipating attacks before they launch, not investigating them after they land.”

That shift requires three capabilities working together: continuous visibility into an organization’s external attack surface, profiling about which threat actors are targeting the organization and why, and real-time intelligence that connects global attack campaigns with an organization’s specific exposures.

Ritesh believes AI itself must become part of the defensive architecture.

“AI must be met with AI—automating threat correlation, vulnerability prioritization and early warning at a speed no human team can match manually,” he says.

For security leaders, proactive defense is no longer simply another maturity level.

“Proactive security isn’t a posture upgrade,” Ritesh adds. “It’s a strategic necessity.”

Build AI Into Every Security Decision Point

Nirwan Dogra, Senior Software Engineer at Microsoft, has spent more than a decade building large-scale security platforms across Microsoft and Amazon Web Services. His work focuses on AI-powered detection systems, software supply chain security and distributed cloud security infrastructure.

Dogra believes organizations cannot rely on traditional signature-based tools alone because AI enables attackers to generate new malicious variants almost instantly.

“AI lets attackers generate malicious code faster than static signatures can keep up,” he says.

He stresses that technologies such as YARA rules remain valuable, but only as the first layer of defense.

“Pattern-based detection should serve as the fast first pass for known threats, followed by AI-based analysis that reads code like an analyst would—understanding intent, spotting obfuscation and identifying malicious behavior,” he says.

This layered approach becomes particularly important in modern software supply chains, where thousands of packages, dependencies and binaries enter enterprise environments every day. Dogra argues that AI should become embedded throughout software delivery pipelines rather than existing as another standalone security product.

“Every artifact, package and binary entering your supply chain should go through this pipeline before reaching production.”

Ultimately, he believes proactive security is about changing where intelligence is applied.

“The shift isn’t just buying AI tools,” Dogra says. “It’s embedding AI at every ingestion point so proactive detection becomes the default—not reactive response after something already detonated.”

Reduce Exposure Before AI Finds It

Jamshir Qureshi, Vice President of DevSecOps Engineering for MUFG Bank Ltd., works in one of the world’s most highly regulated industries, where resilience depends on anticipating threats before they become incidents. He argues that AI has fundamentally compressed the timeline between vulnerability discovery and exploitation, leaving little room for organizations that rely primarily on detection.

“When AI writes polymorphic malware in seconds, detection is already too slow. Leaders need to shift from reactive to proactive resilience,” he says.

For Qureshi, proactive security begins with shrinking the number of opportunities attackers have in the first place. That means reducing unnecessary attack surface by removing unused code, open ports and dormant identities before adversaries discover them.

“Attack surface reduction means eliminating unnecessary code, ports and identities before AI finds them.”

He also recommends moving beyond annual penetration tests toward continuous adversarial validation. AI-powered red teams can simulate sophisticated attackers on an ongoing basis, giving defenders frequent insight into weaknesses while there’s still time to address them.

“Use AI-driven red teams weekly, not annual pentests,” he says.

Finally, Qureshi emphasizes the importance of building systems on immutable foundations. Hardware roots of trust, signed software artifacts and cryptographic verification help ensure that even if attackers gain access, they cannot easily alter critical systems without leaving evidence.

“Hardware roots of trust and signed artifacts ensure even a successful AI breach leaves a tamper-proof trail,” he says. “Stop asking, ‘Did we detect it?’ Start asking, ‘Could AI walk right in?'”

Rather than measuring success by the number of alerts generated or attacks detected, organizations should evaluate how effectively they have eliminated opportunities for compromise.

“Current detection and response capabilities are traditional, slower and reactive. AI has changed the math entirely.”

– Gaurav Kulkarni, Senior Security Manager at Microsoft

SHARE IT

Eliminate Entire Classes of Risk

Gaurav Kulkarni, Senior Security Manager at Microsoft, has spent more than a decade building enterprise security programs across technology, healthcare and financial services. Beyond his day-to-day leadership, he has mentored more than 100 security professionals and frequently speaks on enterprise security strategy and leadership.

Kulkarni believes AI has dramatically changed the economics of cyberattacks, rendering incremental improvements to detection increasingly ineffective.

“Current detection and response capabilities are traditional, slower and reactive. AI has changed the math entirely.”

Instead of trying to respond faster after vulnerabilities emerge, he encourages organizations to remove systemic weaknesses before attackers can exploit them.

“Reacting faster isn’t the answer anymore. The model itself has to change,” he says.

AI itself can help accomplish that objective. By using large language models and AI-assisted variant analysis, organizations can identify every manifestation of a high-risk vulnerability rather than fixing individual instances one at a time.

“Use AI and LLMs proactively by running variant hunts to systematically find every possible manifestation of an organization’s top risk areas before attackers get there first.”

This represents a significant departure from traditional vulnerability management, which often treats each newly discovered flaw as a separate problem. Kulkarni argues that approach no longer scales against adversaries operating at machine speed.

“We can’t keep playing whack-a-mole with vulnerabilities while adversaries are using the same AI tools to chain exploits at machine speed,” he says. “The leaders who adapt will stop asking, ‘Did we catch this attack?’ and start asking, ‘Have we eliminated the defect class that made this attack possible?'”

That proactive philosophy shifts cybersecurity from endless response toward durable engineering improvements that reduce organizational risk over time.

“If your strategy starts at the alert, you’ve already lost the race.”

– Rashid Feroze, Head of Security Engineering at CRED

SHARE IT

Continuously Validate What Attackers Can Exploit

Rashid Feroze, Head of Security Engineering at CRED, has spent more than a decade securing high-growth fintech and e-commerce organizations through rapid expansion and increasingly stringent regulatory requirements. His work spans cloud security, application security, threat detection and response, data protection and emerging AI security risks. He also speaks regularly at conferences including Black Hat USA, BSides, Nullcon and ElasticON.

Feroze argues that AI has invalidated one of cybersecurity’s longest-held assumptions—that defenders can consistently react faster than attackers.

 “Detection and response assumes you can react faster than the attacker. AI breaks that bet.”

Instead of building ever-larger response teams, Feroze says, organizations should focus on “reducing what’s exploitable before anyone has to react.”

That starts with continuous validation rather than periodic assessments. Organizations should continuously test their own environments using the same tactics sophisticated adversaries employ, shifting vulnerability prioritization away from raw CVE counts and toward actual attack paths that reflect how attackers move through enterprise environments.

Finally, he highlights the growing importance of automation in closing the gap between discovery and remediation: “Autonomous remediation closes the gap between finding and fixing.”

Identity systems and software supply chains deserve particular attention because they provide attackers with disproportionate leverage once compromised.

“Identity and supply chain are where attackers get the most leverage,” he says. “Detection still catches what slips through. But if your strategy starts at the alert, you’ve already lost the race.”

Build Security Into the Architecture

Pavel Mishchenko, Manager of Security and IT Infrastructure Systems for Large-Scale Critical Infrastructure Projects, believes the rise of AI requires security leaders to fundamentally rethink how they evaluate risk. Rather than focusing primarily on incident detection, organizations need continuous awareness of how AI systems, identities, data and automated workflows interact—and where those interactions create new vulnerabilities.

“Traditional ‘detect and respond’ security models are no longer able to keep up with the speed of AI-driven attacks,” he says.

Instead of asking what has already happened, organizations should continuously evaluate whether their environments are becoming less secure.

“Organizations must continuously ask, ‘What is becoming unsafe right now?’ across identity, data, models and automated processes.”

That requires visibility extending well beyond conventional infrastructure monitoring. Security teams should correlate user behavior, API activity, AI model decisions and system dependencies to identify emerging risks before they cascade into larger incidents.

For Mishchenko, proactive security is ultimately an architectural discipline rather than an operational function.

“Security in this model stops being reactive and becomes part of system design,” he says.

Organizations should continuously model attack scenarios, test dependencies and identify cascading risks before adversaries exploit them.

Shift From Alerts to Continuous Exposure Management

Bhavya Bhandari, Cybersecurity Risk Management Leader, Financial Services at Ernst & Young US LLP, has spent more than 15 years leading cyber risk, governance, regulatory compliance and resilience initiatives for global financial institutions. His work centers on translating complex cyber risks into measurable business outcomes for executive leadership and boards.

Bhandari believes organizations should replace detection-led strategies with intelligence-driven security programs that continuously reduce exposure.

“Security leaders should adapt by shifting from reactive, detection-led models to more proactive, intelligence-driven approaches,” he says.

That means developing continuous visibility into enterprise risk, actively managing exposure and automating remediation wherever possible. He also highlights several capabilities that can help organizations identify weaknesses before attackers exploit them.

“Attack surface discovery, threat-led penetration testing, real-time identity monitoring and adversary simulation help organizations identify and reduce risk earlier before threats are exploited.”

His perspective reinforces a recurring theme throughout the Think Tank’s recommendations: Organizations gain resilience not by responding faster after compromise, but by making compromise substantially more difficult in the first place.

Putting Proactive Security Into Practice

• Adopt a predictive mindset. Anticipate attacks using external threat intelligence, attack surface visibility and AI-driven threat correlation rather than relying solely on incident response.
• Embed AI throughout the software supply chain. Use AI-assisted analysis alongside traditional signature-based scanning so every package, dependency and binary is evaluated before reaching production.
• Continuously reduce your attack surface. Eliminate unnecessary systems, identities and services while validating defenses through ongoing adversarial testing rather than annual exercises.
• Engineer away recurring vulnerabilities. Use AI to identify and eliminate entire classes of defects instead of repeatedly fixing individual vulnerabilities.
• Validate continuously and remediate automatically. Prioritize exploitable attack paths, continuously test environments from an attacker’s perspective and automate remediation whenever practical.
• Design security into AI systems. Continuously model risk across identities, data, APIs, models and automated workflows so security becomes part of system architecture.
• Treat exposure management as an executive discipline. Combine continuous visibility, threat-led testing, identity monitoring and automated remediation to reduce organizational risk before exploitation occurs.

The Shift From Response to Resilience

Artificial intelligence has shifted the advantage in cybersecurity toward attackers, compressing the time between discovery and exploitation to near real time. In that environment, strategies built primarily around detection and response are increasingly operating as safety nets rather than primary defenses. The organizations that continue to rely on them alone will find themselves reacting to outcomes they can no longer meaningfully influence.

What emerges from the Senior Executive Cybersecurity Think Tank’s insights is a clear direction of travel: Security must become predictive, continuous and embedded. Leaders who reduce attack surfaces, validate continuously, apply AI defensively and design resilience into systems from the start will be better positioned to limit exposure before it becomes impact. The goal now  is no longer to respond faster than attackers—it is to make successful attacks harder to begin with.