AI and Cybersecurity: Preparing for a Future Where Skills Converge

Overview #

Artificial intelligence is becoming increasingly integrated into cybersecurity products, IT operations, and business applications. Security professionals are encountering AI through threat detection platforms, automated analysis, incident investigation tools, and systems designed to assist with administrative tasks. These capabilities can improve efficiency and help organizations process information that would otherwise require considerable manual effort.

For IT and cybersecurity professionals, understanding how AI fits into existing technology environments is becoming an important part of professional development. This does not mean everyone needs to become a machine learning engineer or abandon their existing technical skills. It means developing enough familiarity with AI technologies to understand their capabilities, limitations, security implications, and potential applications within the systems they already support.

This article explains how AI is being applied to cybersecurity, where traditional IT experience remains important, and how professionals can begin developing practical skills in this area. It also explores career opportunities that may emerge as these technologies become more closely connected.

How AI Is Being Used in Cybersecurity #

Many cybersecurity products have incorporated machine learning and statistical analysis for years. These technologies help identify patterns in network traffic, authentication activity, endpoint behavior, and other information collected from an organization’s infrastructure. More recently, generative AI capabilities have been introduced to help analysts summarize information, investigate alerts, and interact with security tools using natural language.

Although these technologies are frequently grouped together under the term AI, they perform different functions. Machine learning models may identify unusual activity by analyzing patterns in historical data, while generative AI systems can assist with interpreting information, producing summaries, or explaining possible relationships between security events. Understanding that distinction is useful when evaluating security products and determining whether a particular capability is appropriate for an organization’s needs.

Common applications include:

• Threat detection: Identifying unusual patterns in network activity, authentication attempts, endpoint behavior, or other security events.
• Alert analysis: Correlating related events and helping analysts prioritize information requiring investigation.
• Incident investigation: Summarizing collected evidence, explaining unfamiliar activity, and assisting with investigation procedures.
• Security automation: Supporting repetitive activities such as organizing findings, preparing reports, and gathering information from multiple systems.
• Vulnerability management: Helping teams organize vulnerability information, evaluate relevant context, and prioritize remediation activities.

These capabilities can be valuable in environments where security teams must review significant amounts of information. However, their effectiveness depends on the quality of the information available, how the tools are configured, and whether their results are properly evaluated. Organizations should consider AI an additional capability within their security operations rather than a replacement for established practices and experienced personnel.

Example: Investigating Authentication Activity #

Consider an organization that collects authentication events from Windows servers, cloud services, and identity management platforms. During a normal business day, these systems may generate thousands of successful and unsuccessful authentication records. Reviewing every event manually would be impractical, particularly for a small IT or security team.

An AI assisted security platform might identify repeated failed authentication attempts against an account, followed by a successful login from an unusual location. It could correlate those events with additional information and present the activity for investigation. A generative AI assistant might then summarize the relevant events and suggest which records or account details an analyst should examine.

The important consideration is that unusual activity does not automatically indicate malicious activity. The user might be traveling, connecting through a corporate VPN, or experiencing an application configuration problem. Someone familiar with the environment must still validate the findings before determining whether the account has been compromised or corrective action is necessary.

AI Automation and Operational Risks #

Automation has been part of IT operations and cybersecurity for decades. Tools such as PowerShell, Python, configuration management systems, and monitoring platforms allow administrators to perform repetitive tasks consistently and reduce the amount of manual effort required to maintain infrastructure. AI introduces additional capabilities for analyzing information and assisting with decisions that may be difficult to implement through traditional scripts alone.

For example, an AI system could review a collection of security alerts, group related findings, and prepare a summary for an administrator. It might also suggest remediation procedures or identify configuration settings that deserve further investigation. Those functions can reduce the time required to understand a problem, particularly when the available information comes from several different sources.

However, there are important differences between generating a recommendation and implementing a change. Disabling an account, modifying firewall rules, stopping services, or applying system configuration changes can affect legitimate business operations. An AI system may not understand every dependency within an organization’s infrastructure, and an incorrect recommendation could create an outage or introduce additional security problems.

For this reason, I recommend introducing AI into security operations gradually, beginning with analysis and assistance rather than unrestricted administrative control. Changes affecting production systems should remain subject to appropriate authorization, testing, logging, and recovery procedures. The same operational disciplines we use with traditional automation should continue to apply when AI becomes part of the process.

How Attackers Can Use AI #

AI capabilities are available to attackers as well as security professionals. Generative AI can assist with writing convincing messages, adapting communication styles, creating fraudulent content, and automating portions of technical workflows. These capabilities may increase the speed or scale of existing attacks, even when the underlying attack techniques are not new.

Phishing provides a useful example. Many organizations have taught employees to recognize suspicious emails through spelling mistakes, unusual grammar, or poorly written messages. AI generated content can remove those obvious indicators and produce messages that resemble ordinary business communications. As a result, organizations should place greater emphasis on verifying unusual requests, protecting accounts with multifactor authentication, and maintaining appropriate email security controls rather than relying primarily on writing quality to identify fraud.

Voice and video impersonation also introduce challenges for organizations that handle sensitive information or financial transactions. A convincing recording or video call should not automatically be considered proof that a request is legitimate. Independent verification procedures remain important when someone requests account changes, financial transfers, credentials, or other sensitive actions.

At the same time, organizations should not overlook established security fundamentals. Missing patches, exposed services, weak authentication, excessive permissions, and insecure application configurations remain common sources of risk. AI does not eliminate those problems, and adopting new security tools should not replace the basic practices required to maintain a secure environment.

Securing AI Applications and Business Data #

Organizations introducing AI services must also consider the security of those services themselves. Depending on the implementation, AI applications may process internal documentation, employee information, customer records, source code, operational logs, or other sensitive business data. Security requirements should address how that information is collected, transmitted, retained, accessed, and protected.

One concern is the use of external AI services without understanding their data handling policies. An employee might submit confidential information to a public service while requesting help with a technical problem or business document. Even when the intention is legitimate, the organization may have contractual, regulatory, or internal policy requirements that restrict sharing that information with outside providers.

AI applications may also encounter prompt injection attacks, where untrusted content contains instructions intended to manipulate the application’s behavior. For example, an AI assistant reviewing external documents or websites might encounter text designed to redirect its actions or influence its responses. Applications that combine AI with access to internal information or administrative tools require careful permission controls and safeguards against these situations.

Security teams should evaluate AI implementations using many of the same principles applied to other enterprise applications. This includes access controls, least privilege, data classification, logging, vendor assessment, configuration management, and incident response planning. Additional testing may be necessary to evaluate how an AI system handles untrusted input, sensitive information, and unexpected requests.

Technical Skills That Remain Important #

A strong foundation in traditional IT remains valuable when working with AI and cybersecurity. Professionals who understand operating systems, networking, identity management, cloud infrastructure, and application behavior are better equipped to evaluate the information produced by security tools. That knowledge also helps them recognize when an AI generated recommendation is incomplete, inappropriate, or technically incorrect.

Networking is particularly relevant because many security investigations involve communication between systems. Understanding IP addressing, DNS, routing, protocols, and firewall behavior makes it easier to interpret network events and investigate suspicious connections. Similarly, experience with Windows and Linux administration provides useful context when examining authentication records, configuration changes, processes, services, and security vulnerabilities.

Scripting and programming skills can also make AI technologies more useful. Python is widely used for data analysis and AI development, while PowerShell remains a valuable tool for managing Windows systems and collecting operational information. I’ve used PowerShell extensively throughout my career, and the ability to retrieve information, manipulate data, and automate administrative tasks continues to be useful as new technologies become available.

Professionals interested in combining AI with cybersecurity should also become familiar with basic AI concepts. Understanding the differences between machine learning, language models, training data, inference, and model limitations provides a foundation for evaluating products and experimenting with practical applications. Advanced mathematics and model development may be necessary for specialized engineering positions, but they are not prerequisites for every role involving AI.

Practical Learning Exercise: Analyze Security Logs With AI #

A useful starting project is to examine security log data in a controlled environment. This exercise combines traditional IT knowledge with AI assisted analysis and provides an opportunity to evaluate both the benefits and limitations of the technology. It can be completed using a small virtual lab or properly sanitized sample data.

Step 1: Prepare a Test Environment #

Use a virtual machine or another isolated system where you can generate and review ordinary security events. Windows Event Viewer provides access to operating system and security logs, including authentication activity when appropriate auditing is enabled. Linux systems also provide authentication and system logs that can be used for similar exercises.

Before using AI, review the available records and understand what the important fields represent. Identify timestamps, event types, account names, source addresses, and other relevant details. The goal is to become familiar enough with the information that you can independently evaluate the results of an AI assisted analysis.

Step 2: Collect and Organize the Data #

Select a manageable collection of events and export them into a format suitable for examination, such as CSV or JSON. Depending on your environment, you may use PowerShell, Python, or existing administrative tools to retrieve and organize the records. Start with a small dataset rather than collecting an entire organization’s logs.

Remove or replace sensitive information before submitting data to an external service. Production logs can contain usernames, internal addresses, system names, and other details that should not be disclosed without authorization. If you’re working with organizational information, follow your employer’s security and data handling requirements.

Step 3: Evaluate AI Assisted Analysis #

Use an approved AI tool to summarize the events and identify patterns that might deserve additional investigation. You could ask the system to group repeated authentication failures, identify unusual sequences, or explain what certain event types might indicate. Compare its findings with the original records to determine whether the results are accurate.

Pay particular attention to incorrect assumptions, omitted events, and explanations that are not supported by the data. An AI system may produce a convincing interpretation while misunderstanding the meaning of an event or overlooking important context. Learning to recognize these limitations is part of developing the judgment needed to use AI effectively.

Step 4: Add Automation #

Once the basic analysis works, experiment with collecting and preparing the information through a script. You might automate the export of selected events, normalize timestamps, remove duplicate records, or generate a simple report. Keep the scope limited to reading and analyzing information rather than automatically modifying security settings or responding to suspected threats.

Document how your project works, which assumptions it makes, and where human review remains necessary. A small project that you fully understand is more useful for professional development than an elaborate implementation assembled from AI generated code without proper validation.

Career Opportunities Combining AI and Cybersecurity #

As organizations continue adopting AI, several existing technology roles are likely to incorporate additional responsibilities involving AI systems and automation. Security analysts may use AI assisted investigation tools, security engineers may work with AI enabled platforms, and cloud or infrastructure professionals may become responsible for deploying and maintaining the systems that support AI applications. The exact responsibilities will vary by organization, but the combination of operational knowledge and security experience should remain useful.

Software and application security professionals may encounter additional work involving AI applications, including protecting sensitive data, evaluating application permissions, and reviewing how AI systems interact with external services. Professionals working in governance, risk management, and compliance may also participate in evaluating AI vendors, developing organizational policies, and assessing the risks associated with automated business processes.

For someone already working in IT or cybersecurity, I would recommend identifying how AI is affecting their current responsibilities before pursuing an entirely different career. A systems administrator might explore AI assisted operations and automation, while a security analyst could focus on improving investigation workflows. These are practical ways to develop relevant experience without abandoning the technical knowledge and professional background they’ve already accumulated.

Individuals entering the industry should continue developing fundamental IT skills while learning how AI tools are used in actual business environments. Certifications and courses can provide structure, but practical exercises, troubleshooting experience, and the ability to explain technical decisions remain important. Employers will have different requirements, so reviewing actual job descriptions and identifying recurring skills is a useful way to evaluate potential career directions.

Summary and Recommendations #

AI is becoming an increasingly important component of cybersecurity, but its value depends on how effectively it is integrated with existing technology, operational procedures, and professional expertise. It can assist with analyzing events, organizing information, supporting investigations, and improving repetitive workflows. It also introduces additional security risks involving data protection, application behavior, automation, and misuse by attackers.

For professionals preparing to work with these technologies, my recommendation is to continue building strong IT fundamentals while gaining practical experience with AI tools. Begin with small projects involving information you understand, verify the results independently, and learn enough about the underlying technologies to recognize their limitations. Developing that combination of skills provides a more useful foundation than concentrating exclusively on whichever AI product or career title happens to be popular at the moment.

As with any major technology change, continued learning will remain important. Understanding how AI interacts with existing infrastructure, applications, and security practices will help professionals evaluate new opportunities and make informed decisions about their careers.

Want to Explore How AI Fits Into Your Career? #

Understanding these technologies is one thing, but figuring out how they apply to your own professional situation can be considerably more complicated. You might already have years of IT experience and wonder which AI skills would be worth adding to your background. Perhaps you’re working in cybersecurity and want to explore automation, or you’re considering a career change and aren’t sure where to begin. Everyone brings different experiences, interests, and professional goals to the table.

These are exactly the kinds of questions we can explore together through my mentorship program at Cyberspace Innovations. I’ve spent decades working with technology, infrastructure, cybersecurity, and IT operations, and I enjoy helping people understand their options and make informed career decisions. Through the program, members can submit questions directly to me and receive personalized guidance based on their particular circumstances, rather than following a generic career roadmap.

We can discuss the skills you already have, which areas of AI or cybersecurity might be worth exploring, and what kinds of practical projects could help you develop your experience. If you’re uncertain whether a particular certification, training program, or career direction makes sense, that’s something we can discuss as well. My goal is to help you make thoughtful decisions about your future while building knowledge you can actually use.

If you’d like to discuss your own career direction, explore our membership options at Cyberspace Innovations and join the mentorship program. I’d be happy to hear what you’re working toward and help you explore the possibilities.

Stay hungry for knowledge, my friends. Mahalo!