Every security technology in history has been dual-use — the same lockpicking knowledge serves the locksmith and the burglar. AI is following the pattern at speed, and anyone entering security now will spend their career with it on both sides of the wall. Here's the honest map.
On the defender's side: scale
Recall the logging waypoint on this trail: a network generates millions of events a day, and humans can read almost none of them. This is exactly the problem shape AI eats — pattern recognition across oceans of data:
- Anomaly detection: machine learning builds a baseline of normal — who logs in when, what talks to what — and flags deviations no static rule anticipated. The "impossible travel" alerts and risk scores from the conditional access waypoint? That's this, in production, today.
- Malware classification: instead of matching known signatures, models learn what malicious files and behaviours look like — catching variants nobody has catalogued yet. Modern endpoint protection leans heavily on this.
- Analyst assistance: LLMs summarising incidents, translating alerts into plain English, drafting the first pass of reports — attacking the alert-fatigue problem from the detection engineering waypoint by making each investigation cheaper.
On the attacker's side: quality at scale
The uncomfortable mirror. Phishing's historic weakness was quality — broken English and generic bait made it spottable. LLMs delete that weakness: fluent, personalised, well-researched lures can now be generated in any language, in seconds, per victim. The spear-phishing effort that once limited attackers to high-value targets now costs nearly nothing per target. Meanwhile deepfake audio and video have already been used in real fraud — staff wired millions after video calls with what appeared to be their own executives. The social engineering waypoint taught that attackers recruit your trust in familiar voices; AI now manufactures the voices.
Notice what survives this arms race unchanged: process beats vigilance, more than ever. "Spot the dodgy email" fails as a defence when the email is flawless — but callback verification on a known number defeats a perfect deepfake exactly as thoroughly as it defeated a clumsy phish. The controls this trail keeps returning to — out-of-band verification, MFA, least privilege — weren't invalidated by AI. They were promoted.
And a new thing to defend: the AI itself
As organisations wire LLMs into their workflows, those systems become attack surface — prompt injection (hiding instructions in content the AI will read), poisoned training data, models tricked into leaking what they were fed. A discipline called AI security is forming around exactly these problems, and it's growing faster than the supply of people who understand both halves. For someone starting out now, that overlap — security fundamentals plus genuine AI literacy — is one of the most promising specialisations on the map. You're standing on the right trail for it.