# AI could make cybersecurity a never-ending process > Source: > Published: 2026-10-20 10:01:00+00:00 Over the past few months, it’s become clear that modern [AI](https://www.fastcompany.com/section/artificial-intelligence) systems are quite adept at discovering software vulnerabilities and finding ways around cybersecurity defenses. Unintended real-world breaches executed by models from leading AI companies like [OpenAI](https://www.fastcompany.com/91577796/openai-ai-agent-rogue-hacks-startup-hugging-face-how-happened) and [Anthropic](https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals) during training exercises have drawn widespread concern, and while those companies have restricted access to their most capable models, experts have indicated it’s only a matter of time before [less constrained AI systems](https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities) have similar capabilities. Already, businesses are [seeing a rise in cyberattacks](https://www.reuters.com/legal/government/us-companies-face-rise-cyber-attacks-2026-09-23/), at least partly attributed to AI assistance.  And increasingly, the best defense lies in . . . artificial intelligence. “We hear a lot about adversaries and attackers using it, and that’s certainly the case,” says Bartley Richardson, chief AI & autonomous systems officer at the cybersecurity firm [CrowdStrike](https://www.crowdstrike.com/en-us/). “What we don’t hear as much about is how are we advantaging defenders with the use of AI.”  CrowdStrike is one of a number of cybersecurity businesses deploying AI on the defensive side. In September, the company [announced a tool called SafeMind](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-launches-frontier-models-for-cybersecurity-with-nvidia/) that purposely takes advantage of AI’s offensive capabilities, deploying custom models and harnesses designed to probe simulated versions of customer infrastructure. SafeMind also deploys defensive AI systems to detect the attacks, fend them off, and close any security holes that are discovered. Both sides then learn from the experience and try again, says Richardson.  “We not only make the changes in the environment before we give it back to the offense and say try again, but we also have a whole manifest—a whole log of every single change that we made to the environment,” he says. “We give that to the offensive harnesses as well.” Such tools may be coming in the nick of time. Like AI coding systems, which have evolved from answering questions to generating, testing, and deploying complex code, AI hacking agents have become increasingly potent. They don’t just scour code for logic flaws but also probe live systems for vulnerabilities, potentially refining their attacks until they translate sets of subtle bugs into step-by-step pathways for unauthorized access. “We are seeing a measurable increase in the volume and velocity of all of these attacks,” says David Cooper, cyberstrategy activation leader at EY, the big accounting and tech consulting firm. “We see it in our security telemetry clients, security operations centers—we’re seeing an uptick.” Provided they aren’t detected and someone is willing to pay for the necessary computing power, they can work essentially indefatigably to find a way in to real-world systems, experts say. And they can find ways to chain together minor flaws in software to achieve ever-escalating access, devising complicated exploit processes that previously would have been found only by determined human experts. “They can take a sequence of actions, and that is what really matters in cybersecurity, especially in zero-day attacks,” says Mona Rahimi, associate professor of software engineering in the Department of Computer Science at Northern Illinois University. That’s part of why defense teams are also turning to AI. In addition to exploiting security holes, it can help point them out to security experts to fix or, increasingly, repair them itself. Alongside the rise in cyberattacks has come a parallel increase in patches released by software vendors, with Microsoft recently reportedly [unveiling its largest security update in history](https://blog.qualys.com/vulnerabilities-threat-research/2026/10/13/microsoft-patch-tuesday-october-2026-security-update-review), says Cooper. Companies he works with have essentially universally deployed AI to help probe and patch their own systems, and EY has recently worked with [CrowdStrike](https://www.crowdstrike.com/en-us/) on security issues, including as a design partner on SafeMind.  “There’s different levels of adoption, but all of the companies that we work with are using some set of AI tools to help accelerate this,” says Cooper. That comes after the research firm [Cybersecurity Ventures estimated](https://cybersecurityventures.com/cybercrime-statistics-worldwide-the-2026-global-picture/) that global cybercrime costs hit $10.5 trillion in 2025, and a [World Economic Forum report warned](https://www.weforum.org/publications/global-cybersecurity-outlook-2026) earlier this year that “AI is supercharging the cyber arms race.”  EY and CrowdStrike are far from the only companies helping their clients address AI issues. Leading AI labs including [OpenAI](https://openai.com/daybreak/), [Microsoft](https://www.microsoft.com/en-us/security/business/ai-powered-cybersecurity/project-perception-agentic-system), and [Anthropic](https://www.anthropic.com/glasswing) have each launched projects to probe and harden digital systems, and security firms have augmented their products to enable AI to spot and even correct vulnerabilities before outsiders take advantage of them.  “We’re just seeing an explosion in rapid remediation, which is something that is foreign, I think, to the world that we typically have lived in,” says Joni Klippert, cofounder and CEO of [StackHawk](https://www.stackhawk.com/). Even before modern AI, StackHawk focused on detecting vulnerabilities in software as it actually runs, rather than simply in source code. “The things that you can find only by testing when an application is running are really valuable, and they’re usually really critical problems,” says its cofounder and chief security officer, Scott Gerlach. And one advantage defenders have, he says, is more complete knowledge of the system, including proprietary source code and details of various infrastructure and its configurations. That knowledge doesn’t necessarily have to live in human heads, and AI can often be quicker at probing and repairing legacy applications that people haven’t touched in some time, Gerlach says. “The more automation that you add to this process, the faster it goes, and the more things get fixed,” he says. Still, many organizations naturally prefer to have a human in the loop before allowing AI to make radical changes to their computing environments, both because AI can make mistakes and because humans can make informed decisions based on competing priorities, like ensuring critical systems aren’t shut down or slowed to unacceptable levels by would-be security upgrades. AI itself can, in some cases, propose or take steps to help balance those needs, like restricting access to critical software that can’t immediately be patched. But while attackers may be willing to shut down or degrade performance to accomplish their goals, security personnel often don’t have that luxury. “We cannot really maximize security at any cost,” says Rahimi, the Northern Illinois University professor. “Because we still want to maintain our service.” The problem isn’t limited to commercial software. A number of efforts have sprung up to help find and fix vulnerabilities in open source software, the often volunteer-maintained code that’s critical to the internet and the systems on it. Among them is [Akrites](https://www.linuxfoundation.org/press/linux-foundation-and-industry-leaders-launch-akrites-to-defend-critical-open-source-software-against-ai-enabled-cyber-threats), announced by the Linux Foundation and industry partners in June, intended to coordinate security reports about open source tools and deliver reliable documentation, concrete examples, and sometimes even patch code that upstream project leaders can incorporate to fix their code. Akrites’s debut came after various open source projects reported being inundated with AI-generated bug reports and suggested code changes, including security fixes of varying quality.  “This has been a very substantial burden on upstream, who almost exclusively are unpaid volunteers,” says Christopher Robinson, CTO and chief architect for Akrites and the [Open Source Security Foundation](https://openssf.org/).  Akrites is prioritizing open source projects used within critical infrastructure, including financial services and telecommunications, he says. Open-source operating systems, databases, programming languages, and other tools [have long been the backbone](https://www.fastcompany.com/91484150/every-business-is-an-open-source-business) of many production systems, in many cases becoming de facto standards and offering power and flexibility unmatched by commercial tools. But those projects often rely on the work of small groups of coders or even individuals to keep them up to date and can even cease to be updated if project maintainers retire or become occupied with other work. In cases where a project has no active maintainer or isn’t in a position to accept patches, Akrites can work to release a forked version—a modified copy—and find someone to serve as a kind of maintainer of last resort, Robinson says.  It’s still unclear how long the surge of detected security flaws and fixes will continue, or whether it will slow down after the new AI tools have helped clear a backlog of undiscovered bugs. Developers are also likely to increasingly use AI tools to probe their own code before it’s released. As Robinson points out, coding AI tools alone aren’t a complete solution, since they can introduce bugs of their own. For the time being, says Ami Luttwak, cofounder and CTO of [Wiz](https://www.wiz.io/), [a cybersecurity company acquired by Google earlier this year,](https://www.wiz.io/blog/google-closes-deal-to-acquire-wiz) AI’s hacking capabilities are continuing to grow, akin to a burglar who one week can enter through a first floor window and, two weeks later, can find a way to the second story. “Every day, every week, every month, there’s new capabilities that AI can do,” says Luttwak.  Wiz operates its own [Scan for Good initiative](https://www.wiz.io/blog/scan-for-good-critical-ai-exposures) in collaboration with Google DeepMind, using AI to help critical infrastructure organizations, governments, healthcare institutions, and nonprofits find and fix security holes. And as AI continues to grow in potency, such scans will likely be a regular need for all sorts of institutions and businesses, he says.  “This concept of static security controls is dead,” Luttwak says. “It will be a cat-and-mouse game, and we believe that every company needs to continuously do AI scans for protection.”