What’s happening
Security companies are adding AI agents that investigate alerts and respond automatically, while criminals use AI to write phishing messages and find vulnerabilities faster. Humans still approve most major defensive actions.
Timing: LATER — roughly 3–7 years before this becomes structural.
Why it matters
When attacks happen in seconds, a security team that reacts in hours loses. Every organization will need automated defence — and clear rules for what that automation is allowed to do.
What would make it real
- Organizations let AI isolate systems and block attacks without waiting for approval
- Insurers require automated defences as a condition of cyber coverage
- Standards emerge for testing and certifying security AI
What would kill it
- Defensive AI causes costly outages by blocking legitimate activity
- Attackers find ways to fool or hijack defensive agents
- Regulation limits autonomous responses