Cybersecurity & AI: new threats and how to defend against them

AI has changed both sides of cybersecurity. On offense: hyper-personalised phishing generated at scale, voice deepfakes for CEO fraud, automated vulnerability discovery. On defense: behavioural detection, automated incident response, log analysis at a scale human teams cannot reach. A panorama of the real risks and the defenses that work.

The most concrete threat for SMEs and mid-caps is not the most sophisticated: it is the industrialisation of social engineering. An attacker can now generate contextualised phishing emails — mentioning your real projects, imitating a colleague's style — at zero marginal cost. Classic awareness training, based on spotting crude mistakes, is obsolete.

Your company's AI systems are themselves a new attack surface: prompt injection on your public-facing assistants, training-data poisoning, information exfiltration through model outputs. The AI Act and ANSSI frameworks are starting to regulate these risks; addressing them at design time costs ten times less than after an incident.

On defense, gains are real and measurable: AI-augmented SOCs cut detection and response times by 50 to 80% on common scenarios. For a company without an internal SOC, AI-augmented managed offerings make a level of protection once reserved for large groups accessible.

Our recommendation: treat cybersecurity and AI as one subject, not two separate programmes. Every new AI use case should pass a security review; every security investment should assess AI's contribution. That double lens structures our cybersecurity-AI practice.