AI Arms Both Sides, but Defenders Win on Fundamentals

Over roughly three days, an autonomous offensive AI generated about 17 million events against a target environment and mapped 38 viable attack paths. A defensive AI successfully protected against all 38 attacks.

Torrell Funderburk, founder and CEO of the cyber resilience firm Overspace and a two-time global CISO, recounted that exercise on an August 4 panel on AI and cybersecurity at Ai4 2026. His takeaway? Enterprises aren’t going to outmuscle or outspend adversarial AI attacks; they have to fight smart because defending against a near-infinite volume of machine-generated attacks means going broke burning tokens continuously against an adversary whose marginal cost per attempt keeps falling.

"You have to think in terms of economics and burning tokens and continuously defending against [growing] offensive AI attacks; it doesn’t seem like a very good idea," Funderburk said. His answer is to run local models where it makes sense, and aggressively narrow the defensive surface to what actually matters to the business. "If you try to do everything everywhere all at once, you're going to spend a lot of money and not get the return," he said.

The message that attacker AI capability is cheap, but the economics of defense ran through the entire session, which brought together security leaders from healthcare, fintech, and three AI-adjacent product companies.

Subscribe to the CYBR.SEC.Media newsletter

The AI Asymmetry

The favorable economics for attackers asymmetry threaded through the panel’s entire conversation. Parthasarathi Chakraborty, global vice president and head of security engineering at Broadridge Financial Solutions, described frontier models as an accelerant for adversaries in two distinct ways: they compress the time to find exploitable weaknesses, and they chain findings, converting a set of low-severity issues into a medium- or high-impact path that no individual scanner would have flagged.

The same capability is what makes the technology worth deploying. Krista Arndt, associate CISO at St. Luke's University Health Network, said AI-assisted threat management has surfaced findings her analysts would never have reached: not because they lacked the skill, but because they lacked the hours.

Stephen Franklin, CEO of NetWatch.AI, described his boundary. Frontier models are not, in his testing, doing something categorically new when they identify a vulnerable machine; plenty of tools do that. The difference is what happens next. "It's the speed at which it attacks," Franklin said. Discovery was never the bottleneck. Time-to-weaponization was.

Attackers running at machine speed no longer triage toward high-value targets, because they do not need to. The forgotten workstation in a medical office, the HVAC controller, the OT segment nobody owns: all of it now gets looked at in the same pass. "Everything on my network matters," Franklin said. Programs that were quietly optimized around the assumption that low-value assets would be ignored are running on an assumption that no longer holds.

Alaa Abdulridha, engineering director at SerpApi, added: models fed stale or low-quality data produce false positives at scale, and security teams then spend their scarce hours validating machine output instead of fixing anything. In his testing, models perform well at white-box work like code review and considerably worse at black-box testing, where there is no source to reason over.

Related:

What the panel recommended in defending against AI-driven attacks

While the panel cited threat intelligence and management, autonomous pen testing and code reviews, SOC automation, and much more, when they asked how they were countering AI-generated phishing and deepfakes, they leaned heavily into the security essentials. Funderburk gave an answer that drew agreement across the panel: the same things as before, because it is what works. "Doing the basics right sounds boring, but it's actually very, very effective."

The specific fundamentals the panelists named:

Email authentication enforced, not merely configured. Chakraborty called for SPF, DKIM, and DMARC with the policy set to reject: the difference between having the records and actually blocking spoofed domains.

Phishing-resistant MFA. FIDO-based authenticators, chosen specifically because they do not fail to a spoofable channel.

Out-of-band verification, running in both directions. Arndt's point was that the help desk must confirm the caller is who they claim, and the caller must be able to confirm the help desk is legitimate. Chakraborty added a trigger: when something raises suspicion, break to a channel the attacker does not control.

Change control on credentials and financial processes. Funderburk said the ability to change credentials tied to payment workflows should not be a routine, untracked action.

Behavioral baselining. Franklin argued that roughly a week of telemetry across applications and user behavior establishes an individual's rhythm well enough that deviation becomes the signal. AI makes the baseline richer; it does not replace the need for one.

Microsegmentation to contain blast radius. Arndt's team stood up microsegmentation across their network in 46 days from scratch. The effort was driven by the need to isolate autonomous surgical robotics and notoriously unpatchable biomedical devices, where FDA certification cycles rule out conventional patching.

Identity treated as the perimeter, including non-human identity. Short credential lifetimes, mutual TLS, and the assumption that machine identities now outnumber human ones.

Complete asset coverage. OT, building systems, and the endpoints that were previously deprioritized because a human attacker would not have bothered.

Data quality and inventory as a precondition. Abdulridha and Chakraborty agreed here, with Chakraborty noting that NIST CSF 2.0's govern function makes contextual understanding of the environment an explicit requirement rather than an implied one.

Documented manual fallback. Funderburk warned that organizations retiring human functions in favor of AI need a lock-and-manual mode rehearsed for the day the model or the provider is unavailable. Franklin extended it to third-party concentration risk: a zero-day at a major model provider, in an environment where everything has been handed to that provider, is an availability event with no workaround.

For defenders, the practical implication is not whether to adopt AI: that’s already happened. And, frankly, it will likely soon be the only way defenders can keep up. Those defenders who succeed will be those whose fundamentals are buttoned down well enough to defend against the speed at which AI attacks will be launched. As this panel detailed, the gap between those organizations that can defend against the volume of AI attacks and those that can’t will likely come down to the basics being correctly in place.