The Future of Cybersecurity: Is Artificial Intelligence a Friend or Foe?

Abstract

In June 2025, one of the largest data leaks ever recorded exposed roughly 16 billion login credentials, drawn from platforms including Apple, Google, Facebook and Telegram and compiled largely through infostealer malware. Defences once treated as reliable barriers are increasingly outpaced by faster, more adaptive attacks. Against this backdrop, one question sits at the centre of the field: what is the future of cybersecurity, and more specifically, is artificial intelligence a friend or a foe? This paper argues that AI is genuinely double-edged, yet that its responsible integration is now essential rather than optional. On the defensive side, AI improves the accuracy and speed of protection by helping security teams find patterns and detect anomalies across very large datasets. On the offensive side, criminals are adopting the same tools, which erodes part of that advantage, while the storage and handling of personal data by AI systems raise ethical questions on which public opinion remains divided. Through a structured review of real incidents, cybersecurity domains and current industry evidence, this paper examines both sides and sets out a framework for responsible adoption.

1. Introduction

1.1 What is cybersecurity?

The scale of everyday cyber risk is difficult to overstate. Microsoft alone reports that its customers face more than 600 million cyberattacks every day, from both independent cybercriminals and nation-state actors. A cyberattack is an intentional effort to steal, expose, alter, disable or destroy data, applications or other digital assets through unauthorised access. The financial consequences are severe: according to IBM, a single data breach cost organisations an average of 4.88 million dollars in 2024, with the most damaging incidents running far higher.

As digital transformation accelerates, individuals and businesses place growing trust in computer networks to store and manage sensitive information. The protection of computer systems, networks, programs and devices, known collectively as cybersecurity, has therefore become a vital discipline within computer science and information technology. As attacks grow more numerous, sophisticated and varied, defensive measures must evolve continually to keep pace.

1.2 Key areas for improvement

Despite steady advances, the frequency and cost of cybercrime have continued to climb, which suggests that traditional methods are reaching their limits. Statista's market forecasts illustrate the trajectory. The estimated annual global cost of cybercrime rises year on year:

• 2018: 0.86 trillion dollars
• 2019: 1.16 trillion dollars
• 2020: 2.95 trillion dollars
• 2021: 5.49 trillion dollars
• 2022: 7.08 trillion dollars
• 2023: 8.15 trillion dollars
• 2024: 9.22 trillion dollars
• 2025: 10.29 trillion dollars
• 2026: 11.36 trillion dollars
• 2027: 12.43 trillion dollars
• 2028: 13.82 trillion dollars

The 2025 estimate of 10.29 trillion dollars is broadly consistent with the widely cited Cybersecurity Ventures projection of around 10.5 trillion dollars for the same year. Several factors drive this rise:

• AI-driven threats: attackers use AI to automate and scale their operations.
• Growing cloud and IoT complexity: the expansion of cloud services and connected devices has created a larger, more complex attack surface.
• Supply-chain vulnerabilities: weaknesses in third-party vendors, software and hardware create indirect entry points for attackers.
• Sophisticated, multi-faceted attacks: modern campaigns are harder to detect with conventional tools.

Traditional, rule-based automation often struggles against adaptive adversaries, which is why the integration of AI into cybersecurity has accelerated. Industry data reflects this shift: according to the sector research summarised by JumpCloud, 67% of organisations now use AI as part of their cybersecurity strategy, 31% of them extensively, AI improves threat detection by around 60%, and AI-driven tools have blocked phishing at a 92% rate compared with 60% for legacy systems.

But is that the whole story? Has AI adoption benefited cybersecurity enough to justify its risks, including biased outputs, opaque decision-making, adversarial manipulation and malicious use by attackers?

1.3 Objectives

This paper sets out to examine, in turn:

• the benefits and necessity of AI within specific cybersecurity domains;
• the objections, risks and limitations of using AI for cybersecurity tasks;
• the ethical considerations of AI accessing and protecting user data;
• a framework for the responsible integration of AI in cybersecurity.

2. The dual aspects of AI in cybersecurity: two case studies

Case study 1: the Bad Rabbit ransomware, a lack of AI integration

In 2017, a ransomware strain known as Bad Rabbit, a suspected variant of Petya, spread across parts of Russia, Ukraine and Eastern Europe. Disguised as an Adobe Flash Player update and distributed through compromised websites, it encrypted victims' files, locked them out of their systems and demanded a ransom for release, as documented by Proofpoint.

Bad Rabbit's success owed much to weak security infrastructure among its targets, in particular the absence of intelligent, automated defences. The incident illustrates a core weakness of traditional, non-AI security: without intelligent automation, it is very hard to monitor, detect and block novel threats in real time. Attacks that rely on social engineering, the psychological manipulation of people into taking harmful actions, and on evolving malware strains, can often bypass static, rule-based defences designed by humans.

Case study 2: the Arup deepfake, adversarial exploitation of AI

In 2024, the British engineering firm Arup lost the equivalent of about 25.6 million dollars, or 200 million Hong Kong dollars, in a sophisticated deepfake fraud. An employee in Arup's Hong Kong office was drawn into a video conference in which AI-generated audio and video convincingly impersonated the company's chief financial officer and other colleagues, and was persuaded to authorise 15 transfers to the fraudsters, as reported by Fortune.

The case shows how far deepfake technology has advanced, and how powerful it becomes when combined with social engineering. More deeply, it highlights one of AI's most serious downsides in this field: adversarial exploitation. As defenders adopt AI, so do attackers, producing an arms race in which the same technology is used both to prevent and to perpetrate attacks.

3. The benefits of artificial intelligence in cybersecurity

Confidence in AI among practitioners is high. In the research summarised by JumpCloud, 80% of cybersecurity professionals believe AI is beneficial to security, against 20% who are chiefly worried about the risks, and 85% of IT stakeholders argue that the only effective way to counter AI-generated threats is with AI-driven defences. Before examining specific benefits, it helps to set out the main domains in which AI is making an impact.

3.1 Key cybersecurity domains

Network security protects communication infrastructure and every device on an internal or external network. Common threats include malware and phishing, online scams that use fraudulent communications to impersonate legitimate sources. Core measures include:

• Firewall: a system that monitors and controls incoming and outgoing traffic against predefined rules, forming a barrier between a trusted internal network and an untrusted external one.
• Intrusion Prevention System (IPS): an advanced firewall offering real-time detection and prevention, inspecting traffic content and actively blocking malicious flows.
• Virtual Private Network (VPN): a secure, encrypted tunnel across a public network that masks details such as a user's IP address.

Cloud security is the set of procedures and technologies that protect cloud computing systems from internal and external threats. Key measures include:

• Identity and Access Management (IAM): tools that manage and protect digital identities and permissions, so that only authorised individuals reach specific resources at appropriate times.
• Zero-trust models: rather than trusting connections inside a perimeter, these enforce strict verification of identity and authority for every connection, regardless of location.

Internet of Things (IoT) security protects interconnected devices and the often vulnerable networks they use. Because many IoT devices lack built-in protection, external measures are critical. A key strategy is:

• Network segmentation: dividing a network into smaller, isolated sub-networks using internal firewalls, access control lists and virtual local area networks, which contains breaches and improves overall security.

3.2 How AI enhances network security

AI's chief contribution to network security is its ability to analyse enormous volumes of data and surface subtle patterns and correlations that a human analyst could not. AI-powered network detection and response can therefore identify novel attacks without relying on predefined signatures, and its speed at deep packet inspection, the analysis of packet content rather than headers alone, is beyond human capability.

Large language models such as GPT-5 are being used to flag suspicious behaviour in real time by recognising subtle anomalies in user activity. For anomaly detection, deep belief networks and autoencoders are used in intrusion detection systems because they can identify new attacks without labelled training data. Specific integrations include:

• AI-powered firewalls: next-generation firewalls now use supervised and deep learning, including convolutional neural networks, to identify unknown threats and prevent zero-day attacks, which exploit vulnerabilities before a patch exists.
• AI in intrusion prevention: supervised models have performed strongly in controlled studies. In peer-reviewed intrusion-detection research, algorithms such as K-nearest neighbours and random forests have reported accuracy close to 99.9% in classifying attacks, while unsupervised methods such as K-means detected novel attacks with high accuracy.
• AI-integrated VPNs: AI has helped modern VPNs reach connection-security accuracy above 90%, while AI-based routing improves both speed and security by directing users to the most secure and efficient servers.

3.3 How AI enhances cloud and IoT security

Gartner predicted that through 2025, 99% of cloud security failures would be the customer's fault, largely because of misconfigurations. With the overwhelming majority of organisations now using the cloud, preventing these failures is critical. AI, and generative AI in particular, strengthens cloud security by improving threat detection, automating management and streamlining the deployment of controls that match company policy.

• AI in IAM: AI has enabled more efficient approval requests, better anomaly detection and automated application onboarding, while modern protocols such as OAuth 2.0 further secure connections between systems.
• AI-integrated zero trust: AI strengthens zero-trust models by analysing user behaviour to make real-time access decisions, enabling just-in-time and just-enough-access, which grant temporary, minimal permissions to reduce risk.

A similar pattern holds in IoT security, where AI reduces the need for human intervention, lowers cost and improves efficiency. AI-powered IoT tools can tailor security to user behaviour and are central to advanced network segmentation.

3.4 Traditional versus AI-enhanced cybersecurity

The contrast between conventional and AI-enhanced approaches, adapted from Palo Alto Networks, is clear across several criteria:

• Threat detection speed: traditional methods are often manual and reactive; AI-enhanced defences work in real time to near real time.
• Data analysis volume: human capacity limits traditional analysis, whereas AI processes very large datasets continuously.
• Incident response time: manual containment is slower; AI enables automated, orchestrated response.
• Human effort: traditional work demands extensive manual investigation; AI automates routine tasks and flags the critical alerts.
• Predictive capability: traditional tools rely on known signatures; AI anticipates emerging threats and attack patterns.
• Vulnerability prioritisation: traditional scoring is often generic; AI prioritises by context, exploitability and asset criticality.

This advantage is now visible in headline industry data. In its 2025 Cost of a Data Breach report, IBM found that the global average breach cost fell to 4.44 million dollars, down from 4.88 million dollars, the first decline in five years, and that organisations contained breaches in a mean of 241 days, the lowest in nine years. IBM attributes much of this improvement to faster, AI-assisted detection and containment, which supports the argument that AI, used well, materially strengthens defence.

4. The risks and challenges of AI in cybersecurity

4.1 AI-powered attacks: the offensive and defensive arms race

As organisations expand their defensive use of AI, criminals adopt the same tools for offence. Generative and deep learning models have made attacks more effective and scalable, capable of overwhelming both human analysts and defending systems. Attackers have also developed ways to undermine defensive AI. By implanting false or biased data into a model's training set, a technique known as data poisoning, they can corrupt its learning so that it misclassifies real attacks as legitimate traffic, a false negative, or flags benign activity as malicious, a false positive. And as the Arup case shows, convincing deepfakes and AI-driven phishing have transformed social engineering, a major source of public unease and a key reason some hesitate to embrace AI fully.

4.2 Ethical concerns: the fear of bias

AI models draw their power from the data on which they are trained. Where that data carries historical bias, intended or not, the model learns and repeats it. This can raise false positives that unfairly target certain groups, or false negatives that overlook threats common to underrepresented ones. The black-box nature of some models, such as GPT-5, compounds the problem: proprietary design and algorithmic complexity make it hard, even for developers, to explain a given decision, so biases and errors can go unnoticed and uncorrected.

4.3 Are we becoming too reliant?

Because many models are not fully transparent, human oversight remains essential. Over-reliance on automation can erode critical thinking among security teams; in a survey by N-able, 58.1% of respondents reported increasing reliance on AI for decision-making. This matters because supervised models often struggle with entirely novel attacks, and because a substantial share of the alerts produced by typical models are false positives that still require human validation. The shift has also widened a skills gap, with too few professionals able to build, deploy and manage complex models. Goldman Sachs has estimated that the current wave of AI could expose the equivalent of 300 million full-time jobs worldwide to some form of automation, and an (ISC)² workforce study reported layoffs in a notable share of cybersecurity departments, which points to a gradual shift from human analysts towards AI-driven systems.

4.4 Data privacy

Perhaps the strongest objection to AI in cybersecurity is data privacy. To work well, these models must train on large quantities of personal and sensitive data, including network traffic, user behaviour and threat intelligence. That forces organisations to protect the very systems meant to protect them, a paradox of having to secure the security measures themselves.

5. The final verdict: a path towards responsible integration

Several conclusions follow from this review. AI in cybersecurity is genuinely double-edged, yet its integration is no longer optional; it has become essential to modern defence. Criminals will keep using AI whatever defenders do, which makes adoption imperative rather than discretionary. The task, therefore, is responsible integration: mitigating the harms while maximising the benefits. Four principles frame a way forward.

• Continuous security and maintenance: the whole model pipeline, from data collection to deployment, must be monitored and secured against tampering, and models must be updated regularly to stay effective as threats evolve.
• A hybrid AI approach: combining different models, for example supervised and unsupervised learning, creates multiple checkpoints for detection and draws on the strengths of each.
• Data integrity and privacy: training data must be audited to prevent overfitting and bias, and should exclude private user data unless strictly necessary and anonymised, with privacy-preserving techniques such as federated learning prioritised.
• Human in the loop: human oversight must remain central, validating AI decisions, handling complex edge cases and preserving skilled employment for those who manage and interpret these systems.

6. Conclusion

Artificial intelligence plays a complex role in cybersecurity, carrying both profound benefits and significant risks. Its place in modern defence is set to grow, so the priority is to understand it from both sides. The latest evidence is encouraging: where AI is deployed well, it is already shortening the time to detect and contain breaches and beginning to reverse years of rising costs. By committing to responsible integration, one that emphasises security, fairness, privacy and human oversight, we can harness AI's potential and, in doing so, help shape a safer digital future for all. On the question this paper set out to answer, AI is neither purely friend nor purely foe: it is a powerful instrument whose value depends on how responsibly we choose to wield it.

Sources

1. Cybernews, 16 billion credentials exposed in a record data leak, 2025.
2. CBS News, 16 billion login credentials leaked online, June 2025.
3. Microsoft Digital Defense Report, 600 million cyberattacks per day, 2024.
4. IBM, Cost of a Data Breach Report 2025.
5. Statista, estimated annual cost of cybercrime worldwide, 2018 to 2028.
6. JumpCloud, how effective is AI for cybersecurity teams.
7. Palo Alto Networks, AI risks and benefits in cybersecurity.
8. Proofpoint, Bad Rabbit ransomware threat reference.
9. Fortune, Arup revealed as victim of a 25 million dollar deepfake scam, 2024.
10. ScienceDirect, machine learning approaches for intrusion detection.