This article is the second part of the Three Pillars of Enterprise IT Infrastructure series and addresses the security pillar.

In recent years, almost every product in the cyber security market has acquired the label "AI-driven". For enterprise decision-makers, that density has made the task harder rather than easier: which capability delivers a meaningful contribution, and which is an existing feature renamed in marketing language? When evaluating AI-driven cyber security, the question to ask is not "does this product have AI" but "which concrete problem does AI solve here".

This article approaches the subject from three angles: AI's genuine contribution on the defensive side, its counterpart in the hands of attackers, and the new attack surface that AI itself creates. Considered separately, any one of them gives an incomplete picture.

The Defensive Side: AI's Concrete Contribution

AI's value in security comes from its ability to process data at a scale human teams physically cannot match. An organization's network traffic, identity records, endpoint telemetry and application logs generate millions of events daily. Manual analysis at that volume is not possible. The contribution is clearest in the following areas:

Behavioural Analysis and Anomaly Detection

Conventional security products catch known threats by signature; but there is no signature for an attack never seen before. AI-based approaches instead build a model of normal behaviour and flag deviations from it. A user initiating bulk access to a file server they have never touched, at an unusual hour and from an unusual location — that is a signal absent from any signature database, yet unmistakably meaningful. Identity and user behaviour analytics (UEBA) is today among the most effective methods for detecting compromised accounts.

Alert Enrichment and Prioritization

The greatest problem facing security teams is not a shortage of alerts but an excess of them. In an environment producing thousands of alarms a day, the real threat is lost in the noise. AI's contribution at this point is highly concrete: consolidating related alerts into a single incident, enriching it with context, and ranking it by risk score. The analyst's attention then concentrates on the events that genuinely warrant investigation. Reducing false positives raises a team's effectiveness without expanding its headcount.

Automated Response

The interval between detection and response is the single most decisive variable in an attack's impact. AI-driven systems can act within seconds in predefined scenarios: isolating a suspicious endpoint from the network, terminating a risky session, temporarily reducing an account's privileges. The critical point here is that the scope of automation must be deliberately bounded — automation that shuts down a production system on a wrong decision can cost more than the attack itself.

The Offensive Side: The Same Technology, on the Other Front

AI offers attackers the same advantage of scale it offers defenders. This has changed the threat landscape qualitatively:

• Flawless phishing: Phishing emails recognizable by language errors and awkward phrasing are a thing of the past. Messages matching a company's tone, an industry's vocabulary, or even a specific person's writing style can now be produced in minutes.
• Voice and video impersonation: A phone call in an executive's voice, or a short video message, substantially increases the credibility of classic executive-fraud scenarios.
• Accelerated reconnaissance: Gathering open-source intelligence on a target, mapping vulnerabilities and profiling the attack surface are all becoming automated.
• Adaptive malware: Samples that alter their behaviour once they detect they are being observed put pressure on defences built around static analysis.

The practical consequence is this: the conventional cues on which user awareness training relies are no longer reliable. The advice to "be suspicious of spelling mistakes" has lost its validity. Training content needs to shift from looking for cues to verifying process — that is, confirming the request through a second channel.

The Third Dimension: AI as an Attack Surface

As organizations begin using AI in their own processes, a new item joins the list of assets requiring protection. This dimension is still absent from most security assessments:

• Data leakage: Employees entering corporate data into external AI services outside the organization's control. In most organizations this is not yet addressed even at policy level.
• Shadow AI: AI tools in use without the IT department's knowledge. A tool absent from the inventory cannot be secured.
• Prompt injection: An AI assistant with access to corporate data being steered by instructions hidden in the content it processes.
• Over-privileged integrations: AI tools connected to enterprise systems being granted more access than they require.

AI tools, like every other system, must be inventoried, authorized and monitored. It is clear how decisive the governance pillar we set out in the first article of this series becomes under this heading.

Cutting Through the Hype: What AI Does Not Solve

AI is a capability layer; it does not replace basic hygiene. Unpatched systems, shared administrator accounts, an unsegmented network or an incomplete inventory — none of these is compensated for by AI. On the contrary, an AI-driven solution built on weak foundations produces only the illusion of being protected.

AI-based systems are also only as good as the data feeding them. In an environment with incomplete log collection and blind spots, even the most advanced model cannot produce accurate results. The order of investment is therefore clear: visibility and basic hygiene first, AI-driven analysis second.

Five Questions to Assess Your Organization

• What concrete output does the AI capability in your product produce? If the answer is a general phrase such as "smarter protection", no measurable benefit has been defined.
• Are the boundaries of automated response defined? If it is not written down which actions run automatically and which require approval, the risk is not being managed.
• Is your false-positive rate falling over time? If it is not, the system is running but not learning.
• Do you know which AI tools your employees use? If not, shadow AI is an active risk.
• Does your awareness training cover voice and video impersonation scenarios? If not, the content was built for yesterday's threat rather than today's.

The ORBISIS Approach: Capability, Not Label

At ORBISIS we evaluate AI capabilities in security projects through the concrete problem they solve, not as a product label. Across the projects we have delivered for public and private sector clients since 2013, we first analyse the existing level of visibility and basic security hygiene, then identify the points where an AI-driven layer will genuinely make a difference. We position ourselves as a technology partner that does not merely implement technology, but questions how and why it should be implemented.

The next article in this series will address Zero Trust, the architectural expression of the security pillar.

To assess your organization's cyber security architecture together, explore our Cyber Security Solutions and Artificial Intelligence and Data Platforms pages, or get in touch with our expert team.