Until a few years ago, cybersecurity was a game between people: those who attacked and those who defended. Today there is a new player on the field, artificial intelligence, and it plays for both teams. Understanding how the relationship between artificial intelligence and cybersecurity is changing helps you defend yourself better and avoid being dazzled by marketing promises.
What do we mean by artificial intelligence in cybersecurity?
In cybersecurity, “artificial intelligence” refers to systems capable of analysing large amounts of data, recognising patterns and anomalies, and generating text, voices or images. Very different techniques sit under the same label:
- machine learning, which learns from data what is “normal” in order to flag what is not;
- generative AI, such as ChatGPT and similar tools, which produces text, code, images, audio and video;
- rule-based systems, which are not “intelligent” in the strict sense but are often sold with the AI label.
How do cybercriminals use AI?
AI has not invented new crimes: it has made the old ones faster, cheaper and more convincing.
- Tailor-made phishing. Error-free emails, in the right tone, personalised with information taken from websites and social media. The Clusit Report 2026 (Clusit is the Italian Association for Information Security) records a 66% increase in serious incidents based on phishing and social engineering in Italy in 2025. → How to spot phishing
- Fake voices and videos (deepfakes). A few seconds of audio are enough to clone a voice. In 2025 in Italy, the voice of the Minister of Defence was imitated to ask well-known business people for money. → The CEO voice deepfake scam
- Automation. Searching for vulnerable systems, login attempts, translating scams into every language: all at scale, at very low cost.
- Help with writing malicious code, which lowers the barrier to entry for less experienced criminals.
How does AI help defenders?
For a small organisation, the problem is not a lack of data but too much of it. A firewall, an antivirus and a mail server produce thousands of lines of logs every day. No office owner can read them, and neither can most technicians.
This is where AI, and intelligent automation more generally, is genuinely useful:
- Recognising what is unusual: a computer sending large amounts of data abroad at 3 a.m., a login from a country never seen before.
- Connecting different signals: ten seemingly harmless events that, taken together, reveal an attack in progress.
- Reducing false alarms: learning the office’s habits so as not to disturb anyone unnecessarily.
- Explaining in plain language: turning “alert ET MALWARE on 192.168.1.23” into “The reception PC tried to connect to a site known for spreading viruses. The connection was blocked”.
What AI can do for security, and what it cannot
| It can | It cannot |
|---|---|
| Analyse large volumes of events in a few seconds | Guarantee that no attack will succeed |
| Flag behaviour that is out of the ordinary | Understand the context of an office on its own without a learning period |
| Reduce unnecessary alerts | Avoid mistakes and false alarms entirely |
| Summarise a problem in simple words | Replace the technician when a computer needs checking and cleaning |
| Apply a response straight away (block, isolate) | Make up for missing backups or weak passwords |
A principle we consider fundamental: security decisions should not be left to people whose job is not security. The system blocks and isolates on its own, with clear rules and limited, reversible actions; the owner gets an understandable explanation, the technician the details, and everything is logged.
Promises to be wary of
The security market is full of slogans. Some warning signs:
- “Total protection” or “100% secure”: it does not exist.
- “The AI blocks everything”: no system can guarantee that. Be wary of anything that acts without explaining what it did and why, and without a log you can check.
- “It makes you GDPR/NIS2 compliant”: a product helps demonstrate security measures, but compliance concerns the organisation, not a device.
- No explanation of what the AI does and what data it uses.
AI, data and rules: what you need to know
If an AI-based security system analyses the office’s traffic, it also processes personal data (of employees and clients). So it must be clear where the data ends up, how long it is kept and who can see it. In addition:
- the European Regulation on artificial intelligence (AI Act) introduces gradual transparency and AI literacy obligations for those who develop and use AI systems;
- in Italy, Law 132/2025 requires professionals who use AI to inform their clients.
We discuss this in detail in the article on how to use ChatGPT and generative AI in your office without risk.
Our approach with Strega Defence
In Strega Defence, the “heart” that decides what gets through and what does not is a traditional, verifiable firewall (OPNsense). On top of it sits a platform that collects the signals, discards the noise, recognises the situations that matter and explains them in plain language: what happened, how serious it is, what it makes sense to do. Decisions are made by the system: it blocks the threat and, if a computer behaves abnormally, isolates it until the technician checks it. Every action is explained and logged. This is the use of automation that we consider most useful and most honest for a small office: no technical decisions left on the owner’s shoulders. Discover Strega Defence.
To work out where to start, try the 10-question security checklist.
Frequently asked questions
Does artificial intelligence make cyberattacks more dangerous?
It makes them more convincing and cheaper. Error-free phishing emails, cloned voices and automated attacks reach more people with less effort. Basic defences, however, such as verifying requests and two-factor authentication, remain effective.
Is an antivirus or firewall with artificial intelligence more secure?
Not necessarily. AI is useful for recognising anomalies and reducing false alarms, but the quality depends on how it is designed, how it is updated and who supervises the decisions. What counts is the result: useful, understandable and timely alerts.
Can AI replace the IT technician?
No. It can lighten their workload, filtering out the noise and reporting problems clearly, but important decisions, interventions and maintenance require a competent person.
What is a false positive?
It is an alarm that reports a danger that is not actually there. Too many false positives are harmful, because they lead people to ignore alerts, including the real ones. Reducing them is one of the main goals of automation in security.
Do AI-based security systems process personal data?
Often, yes, because they analyse traffic, logins and devices that can be linked to people. That is why you need to know what data is collected, where it is stored, for how long and who can access it, and inform employees and collaborators.
Sources and further reading
- Rapporto Clusit 2026 – dati principali (in Italian) — Clusit, 11 March 2026.
- ENISA Threat Landscape 2025 — ENISA, October 2025.
- Regulation (EU) 2024/1689 on artificial intelligence (AI Act) — EUR-Lex.
- Legge 23 settembre 2025, n. 132 – Gazzetta Ufficiale n. 223 del 25/09/2025 (PDF) (in Italian) — Gazzetta Ufficiale, Italy’s Official Journal.
- Truffa con la voce clonata di Crosetto: le vittime (in Italian) — Calcio e Finanza, 11 February 2025.
- About OPNsense — OPNsense.
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
