AI Security - 5 Threats and 3 Solutions for SOCs

What Happened

At RSAC 2026, experts discussed the dual nature of AI in cybersecurity. AI is both a powerful tool and a potential threat. John Morgan from Splunk highlighted that AI agents could become insider threats if not managed properly. The conversation emphasized the need for governance and trust in AI systems to mitigate risks while maximizing their benefits.

The panel also revealed that AI is driving some of the most dangerous attack techniques today. From zero-day exploits to supply chain attacks, AI's influence is pervasive. As attackers increasingly utilize AI, defenders must adapt quickly to stay ahead.

The Threat

The first major threat discussed was the industrialization of zero-day exploits. Joshua Wright noted that AI could generate these exploits at an alarming rate, leading to a potential wave of attacks. Defenders must accelerate their patch management to combat this new reality.

Another significant threat involves supply chain attacks. Wright explained that vulnerabilities can arise from third-party dependencies, complicating the security landscape. With AI potentially amplifying these risks, organizations need to prepare for supplier compromises and ensure software attestations from vendors.

Tactics & Techniques

The complexity of AI is also impacting root cause analysis in industrial systems. Robert M. Lee pointed out that distinguishing between cyberattacks and operational mishaps is becoming increasingly difficult. This complexity can create blind spots for defenders, making it essential to enhance AI governance and monitoring capabilities.

Additionally, overreliance on AI in digital forensics poses risks. Heather Barnhart warned that AI might overlook critical evidence, emphasizing the need for human expertise in the decision-making process. The combination of human insight and AI tools can lead to more effective investigations.

Defensive Measures

To combat these threats, the experts provided actionable strategies. Firstly, organizations should focus on developing customized AI agents that incorporate their unique knowledge and processes. Trust must be built gradually, ensuring humans remain involved until AI can operate autonomously.

Moreover, defenders need to leverage AI to match the speed at which attackers operate. Rob T. Lee demonstrated how AI can significantly reduce the time needed to analyze threats, allowing defenders to respond more swiftly. Collaboration among cybersecurity practitioners is crucial to face the evolving AI threat landscape effectively.

In conclusion, AI's role in cybersecurity is a double-edged sword. While it presents new risks, it also offers powerful tools for defense. By understanding these dynamics, SOCs can harness AI to enhance their capabilities while mitigating potential dangers.