TruePillar Healthcare
TruePillar Finance
In 2025, every cybersecurity vendor claims to have AI. It's in the product names. It's in the marketing collateral. It's in the earnings calls. And for security leaders trying to make rational investment decisions, it's become nearly impossible to separate genuine capability from marketing hype.
Is the vendor using large language models or simple keyword matching? Are they applying machine learning to detection or just adding a chatbot interface to their SIEM? Is their "AI" actually improving security outcomes, or is it just a pricing multiplier?
This article is a framework for answering those questions. It's not a product review. It's a practical guide to understanding what AI in cybersecurity actually means, where it delivers value today, where it's overhyped, and how to build a strategy that works for your enterprise.
The Taxonomy of AI in Security
Before evaluating claims, you need a vocabulary for what "AI" actually means. Most vendors lump fundamentally different technologies under the same umbrella.
Automation
What it is: Rule-based systems that execute predefined actions based on triggers.
What vendors call it: Often mislabeled as "AI-powered automation"
Where it works: Playbook execution, basic alert triage
Where it fails: Adapting to novel threats
Traditional Machine Learning
What it is: Statistical models trained on historical data to identify patterns and make predictions.
What vendors call it: "Machine learning" (legitimate) or sometimes "AI" (stretched)
Where it works: Anomaly detection, classification, behavioral baselining
Where it fails: Adapting to rapidly evolving threats without retraining
Deep Learning
What it is: Neural networks with multiple layers that can identify complex patterns without explicit feature engineering.
What vendors call it: "Advanced AI," "deep learning" (legitimate)
Where it works: Image analysis, natural language processing, sophisticated malware detection
Where it fails: Explainability, requires large training datasets
Generative AI / Large Language Models
What it is: Models trained on vast text corpora that can generate human-like text, summarize, and reason.
What vendors call it: "Generative AI," "LLM-powered" (legitimate if accurate)
Where it works: Investigation summarization, report generation, natural language interfaces
Where it fails: Factual accuracy, security decision-making, hallucinations
Autonomous AI
What it is: Systems that can act independently, making decisions and taking actions without human intervention.
What vendors call it: "Autonomous security," "AI-driven response" (often aspirational)
Where it works: Narrow, well-defined, low-risk contexts
Where it fails: High-stakes decisions, novel situations, adversarial environments
┌┐└┘"If a vendor can't tell you what type of AI they're using—and what its limitations are—assume the claim is marketing, not engineering."
Where AI Actually Delivers (Today)
After evaluating hundreds of deployments across financial services, healthcare, and technology enterprises, we've identified four areas where AI consistently delivers measurable value.
False Positive Reduction
The most significant—and least glamorous—impact of AI in security is false positive reduction.
The Problem: A typical SOC generates thousands of alerts per day. The majority are false positives. Analysts spend 60-70% of their time triaging noise rather than investigating genuine threats.
How AI Helps: Machine learning models trained on historical data can accurately classify alerts by confidence level, automatically suppressing known false positives and prioritizing high-confidence detections.
What It's Not: This isn't magic. It requires quality training data, ongoing model tuning, and continuous validation. Models degrade over time and need refreshing.
Behavioral Analytics
Traditional detection relies on signatures and rules. Behavioral analytics uses machine learning to establish baselines of normal behavior and detect deviations.
The Problem: Attackers increasingly use legitimate tools and credentials. Signature-based detection misses "living off the land" techniques.
How AI Helps: Models learn what normal looks like for users, devices, and applications. They detect anomalies—unusual login locations, atypical data access, abnormal process execution—that may indicate compromise.
What It's Not: Behavioral models generate anomalies, not certainty. Each anomaly requires investigation. Successful deployments integrate anomaly detection with investigation workflows.
Investigation Assistance
Generative AI excels at summarization and natural language interaction—perfect for accelerating investigation workflows.
The Problem: Investigating a security alert requires gathering data from multiple sources: endpoint logs, network flows, identity systems, threat intelligence. This takes time, especially for junior analysts.
How AI Helps: LLMs can ingest disparate data sources and generate coherent summaries. Analysts can ask natural language questions: "Show me all lateral movement from this endpoint in the past 24 hours." AI translates to queries and returns structured results.
What It's Not: LLMs hallucinate. They can produce confident-sounding answers that are factually incorrect. Outputs must be validated. These tools assist analysts—they don't replace them.
Phishing Detection
Email remains the primary initial access vector. AI has proven exceptionally effective at identifying sophisticated phishing.
The Problem: Modern phishing bypasses traditional filters. Attackers use legitimate infrastructure, personalized content, and social engineering. Phishing kits now include AI-generated text.
How AI Helps: Machine learning models analyze hundreds of email attributes—sender reputation, content patterns, linguistic analysis, URL structures, attachment characteristics—to identify malicious messages with high accuracy.
What It's Not: No detection is perfect. AI models miss novel techniques. Human-in-the-loop verification remains essential for high-risk messages.
The Hype Cycle: What's Overpromised
For every area where AI delivers, there are three where marketing outruns reality.
Autonomous Response
The Promise: AI that detects and responds to threats without human intervention. Close the loop. Stop attacks instantly.
The Reality: Autonomous response in high-stakes environments remains aspirational. The consequences of a false positive containment are catastrophic—taking down a critical system or blocking a legitimate user. Most enterprises restrict autonomous response to low-risk, well-defined scenarios.
What Works: Human-in-the-loop response with AI-recommended actions. Analysts review and approve AI-generated response plans before execution.
Predictive Threat Intelligence
The Promise: AI that predicts future attacks before they happen. Know what adversaries will do next.
The Reality: Prediction requires data that doesn't exist. AI models can forecast based on historical patterns—predicting likely attack vectors or targeting trends—but cannot predict specific attacks with any reliability.
What Works: AI-powered trend analysis that helps prioritize defenses based on likely adversary behavior. Not prediction—probabilistic forecasting.
Full-Spectrum Threat Detection
The Promise: AI that detects every threat, every time. Zero false positives. Perfect security.
The Reality: No detection technology is perfect. AI models have blind spots. Adversaries are actively developing techniques to evade detection. And AI systems generate false positives—they're just different false positives than traditional tools.
What Works: Layered detection combining AI, traditional signatures, behavioral analytics, and human threat hunting. Defense in depth applies to AI too.
AI That Replaces Security Teams
The Promise: Do more with less. AI eliminates the need for human analysts. Security on autopilot.
The Reality: AI augments analysts; it doesn't replace them. The organizations achieving the best outcomes use AI to amplify human capabilities—not eliminate them. Analysts who leverage AI are more productive, but they remain essential for judgment, context, and high-stakes decisions.
┌┐└┘"If a vendor promises to replace your security team with AI, run. They don't understand security—or AI."
The Adversarial AI Gap
While defenders debate the merits of AI, adversaries are already deploying it.
AI-Generated Phishing: Attackers use LLMs to craft personalized, grammatically perfect phishing messages at scale. These bypass traditional language-based detection.
Automated Reconnaissance: AI tools analyze target organizations, identifying key personnel, organizational structures, and potential vulnerabilities faster than human attackers.
Evasion Techniques: Adversaries are developing AI that generates malware variants designed to evade detection—iterating until a variant bypasses security controls.
Deepfake Social Engineering: Voice and video deepfakes are being used in sophisticated social engineering attacks against executives and finance teams.
The Gap: Defensive AI is reactive, trained on historical attack patterns. Adversarial AI is proactive, generating novel techniques designed to evade existing defenses. The gap is widening.
Building a Practical AI Strategy
How should security leaders approach AI? Not as a silver bullet, but as a toolset to be deployed thoughtfully.
Audit Your Current Capabilities
Before buying new AI tools, understand what you already have:
- → What machine learning capabilities exist in your current tools?
- → Are you using them? Are they configured properly?
- → What data is available for training models?
- → What gaps exist in your detection coverage?
Define Use Cases, Not Features
Don't buy "AI." Buy solutions to specific problems:
- → "We need to reduce alert volume by 50% to improve analyst productivity."
- → "We need to detect phishing that evades our existing filters."
- → "We need to accelerate investigation workflows for our junior analysts."
Define the problem, measure the current state, and evaluate vendors on their ability to improve the metric.
Evaluate Rigorously
When evaluating AI security vendors:
- → Ask about the model. What type of AI? How was it trained? What data? How often is it retrained?
- → Ask about testing. How is model performance measured? What are the false positive and false negative rates?
- → Ask about explainability. Can the model explain its decisions? Or is it a black box?
- → Ask about adversarial resilience. How does the model perform against adversarial AI?
Pilot Before Committing
Deploy new AI capabilities in controlled environments before scaling:
- → Run parallel detection for 30-90 days
- → Measure performance against existing tools
- → Validate false positive rates in your environment
- → Train analysts on new workflows
- → Establish human oversight mechanisms
Build for Human-AI Collaboration
The most effective AI deployments don't replace humans—they enable them:
Volume: triage, filtering, prioritization. Documentation: summarization, reporting.
Complexity: investigation, judgment, response. Decisions: high-stakes actions.
The Future of AI in Security
Where is AI in security heading over the next three years?
Agentic AI
AI systems that can take actions within defined boundaries, with human approval for high-risk decisions. Not fully autonomous—but capable of executing routine response actions with supervision.
AI-Native Security Operations
Security platforms built from the ground up for AI—with data architecture, workflows, and interfaces designed for human-AI collaboration rather than bolt-on AI features.
Continuous AI Model Evolution
Models that continuously adapt to emerging threats, trained on real-time data with automated validation. Moving from periodic retraining to continuous learning.
Defensive AI vs. Adversarial AI
The arms race will intensify. Defenders will need AI that can adapt as fast as adversaries—or faster.
Conclusion: Beyond the Hype
AI in cybersecurity is real. It's delivering value. But it's also drowning in hype that makes rational evaluation nearly impossible.
The organizations winning with AI are those that approach it with skepticism and discipline. They understand what AI is—and what it isn't. They invest in areas with proven ROI: false positive reduction, behavioral analytics, investigation assistance. They build for human-AI collaboration, not replacement. And they never stop asking the hard questions.
The AI hype cycle will eventually settle. The vendors with genuine capability will survive. The rest will rebrand to the next buzzword. But for security leaders, the task remains the same: separate signal from noise, invest where value is proven, and build defenses that work in the real world.