Skip to main content
Logo of Southeast Missouri State University 1873

November 10, 2026

How Can Generative AI Be Used in Cybersecurity?

  • Fearlessly Forward

With the rapid rise in the use of artificial intelligence (AI), business and technology leaders are assessing the role that generative AI (also known as GenAI) can play in cybersecurity.

 Cybersecurity professionals review code on a monitor.

According to the World Economic Forum’s global cybersecurity outlook for 2026, 94 percent of leaders believe AI will drive major changes in cybersecurity.  

AI models are commonly being used to: 

  • Help professionals quickly monitor incidents across systems 
  • Summarize thousands of log entries in easy-to-read formats 
  • Highlight unusual behavior while incidents are ongoing 

On the other side of cybersecurity, AI is quickly becoming a key tool in internet crime. The following statistics provide a glimpse into the impacts from generative AI being used by cybercriminals: 

  • The FBI’s annual internet crime report stated that, in 2025, 22,364 AI scam complaints were made and $893 million in losses were recorded. 
  • IBM reported that there were increasing numbers of data breaches involving AI in 2026, a 56 percent rise from the previous year, and they cost an average of $6 million. 
  • KPMG reported that, in 2026, 83 percent of security leaders said they saw an increase in cyberattacks over a 12-month period. Phishing, denial-of-service and ransomware attacks were the most common types of attacks. 

Understanding how to use generative AI in cybersecurity can help organizations implement safeguards and policies to help address these new challenges. 

What Is Generative AI in Cybersecurity? 

Generative AI learns patterns from large datasets. It uses this knowledge to create new content, such as text, code, and images. Security teams can use generative AI to summarize firewall activity and spot potential threats. Meanwhile, cybercriminals can use it to craft convincing phishing emails (a technique known as spear phishing) that mimic company executives’ real language. 

AI has long been part of cybersecurity, evolving from early systems that relied on rules-based commands to find known threats to the following:  

  • Machine learning that detects subtle patterns  
  • Deep learning that spots malware and analyzes network activity  
  • Generative AI that creates new content and code instead of simply analyzing existing threats 

Different types of generative AI work in different ways. The following types of AI models can be used by organizations to strengthen their cybersecurity, but they also provide cybercriminals with new attack methods: 

  • Generative adversarial networks (GANs): These models use two competing AI systems to produce realistic content: one to generate the content, the other to evaluate whether the content appears “real.” 
  • Transformer models: These models include generative pretrained transformers (GPTs), which can understand and generate language to aid in security log analysis.  

What Cybersecurity Risks Does Generative AI Pose? 

Researchers who study generative AI cybersecurity and resilience rank deepfakes as one of the most pressing ethical concerns. Synthetic media produced by AI, including fake audio and video, can be realistic enough to damage the public’s trust in a person or organization.  

With generative AI, cybercriminals have a tool that not only makes it easier to plan and launch attacks but also lowers the cost of their execution. In the past, successful cyberattacks required skilled professionals to research targets and write malware code. Now, much of that work can be automated. 

Cybercriminals can use generative AI to write phishing emails that mimic the trusted colleagues of their recipients and produce malware that can mutate its code to avoid detection. The following short list of examples provides a glimpse into some of the common cybersecurity risks of generative AI. 

Automated Malware Generation 

Generative AI can make the work of writing malicious code, including for ransomware and trojans, easier for individuals with limited programming skills. Some of this malware is polymorphic, meaning it changes its own code as it spreads, so signature-based tools don’t recognize it. IBM found that deepfake impersonations and AI-assisted malware, such as what was used in the hack of Hugging Face (an open-source machine learning and artificial intelligence platform), made up most of the AI-related breaches included in its 2026 study. 

Evasion Techniques             

Attackers can use generative AI to evade detection. For example, models can produce traffic and inputs that blend in with normal activity, which helps them slip malware and other malicious code past intrusion detection systems and other security controls. Humans no longer need to come up with new ways to bypass detection, they can simply use generative AI to build a model that generates variation after variation until one gets through. 

AI-Driven Phishing and Social Engineering 

Generative AI can write phishing emails and messages that perfectly imitate the tone and formatting of the recipients’ real colleagues or of actual organizations. Attackers can feed a model details pulled from social media or breached databases to personalize each message. This data coupled with generative AI’s powerful ability to write polished, grammatically correct text can be used to remove spelling errors and generic greetings that can reveal that an email is a phishing attempt. 

Deepfakes and Disinformation             

Generative AI can produce realistic fake video and audio. Criminals use these deepfakes for fraud and blackmail, such as in the February 2026 case of an Italian bank chairman duped by a cloned voice that approved a 93 million euro wire transfer. Generative AI tools can also push false information across platforms at volumes and speeds that humans can’t match.  

Adversarial Attacks 

Many security tools now rely on machine learning, but AI can be used to thwart cybersecurity efforts as well. Attackers can use generative AI to craft inputs built to fool those models, such as malicious files adjusted just enough to be classified as safe. Data poisoning works on the same weakness by corrupting the training data that cybersecurity models learn from, leading them to make incorrect judgments. 

Scalable and Automated Attacks             

Cyberattacks take planning, such as reconnaissance to uncover the optimal targets and suggest the most effective type of attack, while the delivery of the attack can take some time to put together. Generative AI can automate these tasks. A single attacker using AI can adjust their tactics when a defense blocks them and run many campaigns at once quickly and with fewer resources than would be needed without AI. 

Strategies for Addressing Generative AI Cybersecurity Risks 

Security professionals are seeing the benefits of using generative AI in cybersecurity work. 

  • According to a 2026 Darktrace survey, 96 percent of those surveyed agreed that AI can make their cybersecurity efforts work substantially faster and more efficiently.  
  • In a 2026 survey of more than 1,500 security leaders, respondents reported that generative AI played a role in 77 percent of their security technology stacks. 

While many organizations see how generative AI can be used in cybersecurity, not every organization is moving fast to adopt it for this purpose.  

  • IBM found that organizations using AI and automation in security operations cut their data breach costs by nearly $2 million on average — yet 1 in 4 organizations had not adopted those tools. 

So, how can organizations use generative AI effectively to make an impact on their cybersecurity? Consider these strategies. 

Protecting Generative AI Models            

The best defense against AI-assisted attacks is AI itself. Organizations can build and deploy generative models that help with cybersecurity, but often these tools need protection themselves.  

One method to prepare for an AI attack on an AI model is through adversarial training. This strategy exposes a model to manipulated inputs during development, enabling the model to learn how to resist them. Organizations can also use encryption and anonymization to protect sensitive data processed by the model. 

Creating Policy on AI Usage          

Organizations need to set clear policies on how generative AI should be used in their cybersecurity work. Gartner predicts that more than 40 percent of AI-related data breaches will arise from improper use of generative AI across national borders by 2027. Having policies in place and following those policies can help organizations reduce the risk of cross-border misuse.  

For example, organizations can establish data governance frameworks that cover AI-processed data and form committees to oversee how AI is deployed. A resource for organizations needing guidance on what to include in their policies includes the National Institute of Standards and Technology’s cybersecurity framework, which gives organizations a structure to build on. 

Conducting Continuous Monitoring             

According to the World Economic Forum’s global cybersecurity outlook for 2026, more organizations now assess the security of their AI tools before deploying them — 64 percent in 2026, up from 37 percent in 2025. But with attackers constantly adjusting their methods, generative AI models that pass a review when they are launched can still be manipulated later.  

Ongoing monitoring means regularly reviewing AI models after they launch. This is commonly conducted by “red teams,” which are groups within organizations that simulate cyberattacks and probe models to identify their weaknesses. The purpose of periodic audits is to confirm that the models still behave as intended. 

Using Generative AI in Cybersecurity 

The capabilities that make generative AI useful to attackers can also help cybersecurity professionals. For example, a generative AI model can work through more data than an analyst team could ever review by hand, and can refine the process of addressing threats.  

Generative AI can also produce awareness materials tailored to an organization and run simulated phishing campaigns, so employees can practice spotting the types of attacks they are most likely to face. 

The following are additional examples of how organizations are using generative AI in cybersecurity.  

Threat and Anomaly Detection 

Generative models such as GANs can be trained to recognize normal network activity and identify any aberrations in that activity. This capability can help cybersecurity professionals detect threats with no known signature, including zero-day exploits, which are cyberattacks that target unpatched security flaws in software, hardware, or firmware before a vendor can find it or fix it. In Darktrace’s 2026 survey, 72 percent of security professionals agreed that AI excels at detecting anomalies through pattern recognition. 

Federal agencies rely on AI for the same work. The Cybersecurity and Infrastructure Security Agency published uses of AI in the government’s cybersecurity work that described threat hunters who receive terabytes of sensor data each day. Those analysts use anomaly detection to examine activity across information technology and operational technology networks, including industrial control systems.  

Incident Response             

When incidents occur, large language models can read the relevant alerts and logs and summarize what happened within minutes. An AI incident response architecture can propose containment steps for analysts to approve and, where the organization’s policy allows it, carry out routine responses on its own. Afterward, forensic teams can use the same model to trace how the attackers breached the system and what they touched. This critical information can help the organization prevent repeat attacks.  

Predictive Analysis 

Generative AI can be used to help security teams find serious vulnerabilities in an organization’s systems faster. It can look at historical attack data, current threat intelligence and known vulnerabilities, and use AI predictive analysis to spot newly disclosed vulnerabilities within their organization’s systems. This allows the security team to prioritize patching the vulnerability before cybercriminals can take advantage of it. It can also be used to look at suspicious emails and detect the linguistic hallmarks of phishing, enabling the team to identify and block threats before they reach users.  

Resources: Generative AI Use in Cybersecurity 

For those interested in learning more about how generative AI can be used in cybersecurity, the following resources explore its applications, emerging threats and strategies for managing security risks.  

Develop the Skills to Address Emerging Cybersecurity Threats 

As generative AI changes cybersecurity, organizations need professionals who understand both its benefits and risks. Skilled professionals to fill roles such as information security analyst are in high demand, with positions projected to increase 21 percent between 2025 and 2035, according to the U.S. Bureau of Labor Statistics.  

Individuals pursuing a career in cybersecurity have the opportunity to detect threats, investigate incidents, protect networks and develop strategies to help their organization defend against increasingly sophisticated attacks. People who enjoy analyzing data and spotting patterns may be attracted to threat detection and security analysis. Those who are interested in the design of security systems may be more drawn to cybersecurity engineering. People who like to solve problems may prefer penetration testing or incident response work. 

Across these roles, professionals in cybersecurity need to keep up with new technologies and be regularly refining their skills as the field continues to evolve.