Security vendors have described their products as intelligent for so long that the word has stopped carrying information. Statistical detection has been standard in this industry since the 1990s; calling it AI in 2026 is a rebrand, not a breakthrough.
Some things have genuinely changed, though, and they cut both ways. This piece separates the real capability shifts from the marketing, on both sides of the fight.
What defenders genuinely gained
Anomaly detection at a scale nobody could staff
A mid-sized company generates an absurd volume of security-relevant events: authentications, process launches, network flows, file operations. Millions per day. No human team reads that.
Behavioural models do something useful here. Rather than matching known-bad signatures, they build a baseline of normal for each user, device and service, then flag departures from it. An account that has logged in from one office for two years authenticating from a new country at 4am, then immediately enumerating file shares, is a departure worth a look.
This is real value, with a real cost: baselines drift, and every false positive spends analyst attention, which is the scarcest resource in any security team.
Triage, which is where the actual time goes
The unglamorous truth about security operations is that most of the work is deciding which alerts are nothing. A model that clusters related alerts into a single incident, pulls in the relevant context automatically, and drafts a first-pass summary saves hours a day.
It is not detecting anything new. It is making existing detections cheaper to act on, and that is arguably a bigger practical win.
Malware classification that generalises
Signature matching fails against a file that has been recompiled. Behavioural classification — what does this program actually try to do — generalises much better. A model that has learned the shape of ransomware behaviour can catch a variant it has never seen, because encrypting a lot of files quickly looks like encrypting a lot of files quickly regardless of the code.
Phishing detection beyond keywords
Modern filters evaluate language, sender history, relationship graphs and infrastructure reputation together. This works considerably better than the keyword and blocklist era. It also has to, for reasons in the next section.
Every genuine defensive win above is about volume: too many events, too many alerts, too many samples. Machine learning is good at volume. It is not what closes the gap on a determined, targeted attacker, and vendors who suggest otherwise are selling.
What attackers gained
It would be dishonest to only describe the defensive side.
Phishing that reads correctly. The most reliable tell for decades was awkward language. That tell is gone. Messages are now fluent, correctly formatted, in any language, and cheap to produce at scale.
Personalisation at volume. Previously you chose between a generic message to a hundred thousand people or a carefully researched one to a single executive. The middle ground — a specifically tailored message to twenty thousand people, referencing each recipient's actual employer, role and recent public activity — is now economically trivial. That middle ground is where the damage is.
Voice cloning. A few seconds of audio is enough for a convincing imitation. This has already produced real losses in urgent-payment scams, and it defeats the very common practice of verifying a request by phoning the person back.
Faster reconnaissance and exploit development. Not magic, but a meaningful reduction in the time and skill needed to get from a disclosed vulnerability to a working exploit. Defenders have less time to patch than they used to.
What has not changed at all
This is the part that gets lost. Look at how intrusions actually begin, year after year, and the list is stubbornly boring:
- Credentials that were phished, reused, or bought from a previous breach
- An internet-facing system with a known vulnerability that was not patched
- A misconfigured cloud resource left publicly readable
- An over-privileged account doing something it should never have been able to do
- A third-party supplier with access and weaker controls
Almost none of that is affected by either side's use of machine learning. The techniques that prevent it are the same as they were five years ago, and they remain unfashionable because they are dull.
The controls that actually pay
Ordered roughly by value per unit of effort.
- Phishing-resistant authentication on everything that supports it. Passkeys or hardware keys, starting with email and administrative accounts. This single control removes the most common initial access route. See our guide to how passkeys work.
- Patch what faces the internet, fast. Know your external surface, and treat exposed-and-exploitable as an emergency rather than a ticket.
- Least privilege, and remove standing administrative access. Most breaches are survivable if the first compromised account cannot reach anything important.
- Backups you have restored from. Offline or immutable, and tested. An untested backup is a belief, not a control.
- Centralised logging with enough retention. You cannot investigate what you did not record, and thirty days is often not enough.
- A rehearsed incident plan. Who decides, who calls the insurer, who talks to customers. Decided in advance, because nobody makes good decisions at 3am.
- Out-of-band verification for money movement. A fixed, known-good procedure that does not depend on recognising a voice.
Notice that none of these are products with intelligence in the name. That is the point.
Evaluating a security product honestly
If a vendor is pitching machine learning, ask:
| Question | What a weak answer looks like |
|---|---|
| What is the false positive rate on a network our size? | "Very low", with no number |
| How was that measured, and on whose data? | Vendor's own lab, no independent test |
| What happens when it is wrong — does it block or alert? | Unclear, or blocks with no override |
| Can an analyst see why it flagged something? | "The model determined it" |
| What does this replace? | Nothing, it is purely additive |
That last one matters most. A tool that adds another alert queue without removing any work has negative value, no matter how good the detection is.
The realistic picture
Machine learning has raised the floor on both sides. Attacks are more convincing and cheaper to run at scale; detection and triage are meaningfully better. Roughly speaking, the two effects offset, and the balance in any given organisation is still decided by whether the boring controls are in place.
The uncomfortable conclusion is that the most effective security investment available to almost everyone remains phishing-resistant login, prompt patching, tight privileges and tested backups. It has been that list for years. It will still be that list when the current vocabulary has been replaced by the next one.