How AI Models Are Reshaping Cybersecurity — And Why We're Not Ready

I've spent the better part of a decade building security tooling and responding to incidents across fintech and healthcare. In the last eighteen months, the threat landscape shifted faster than anything I've seen since the ransomware explosion of 2017. The catalyst this time isn't a novel exploit technique or a zero-day in some ubiquitous library. It's AI. Not the hand-wavy "AI will change everything" kind of rhetoric. I'm talking about concrete, measurable changes in how attacks are constructed, how defenses are automated, and how the asymmetry between attacker and defender is being rewritten. The Offensive Side: What Changed Phishing at Scale, Without the Tells The traditional phishing email had signals: broken grammar, generic salutations, mismatched sender domains. Security awareness training worked because humans could learn these patterns. Large language models broke that assumption. We're now seeing spear-phishing campaigns where the attacker feeds a target's LinkedIn profile, recent conference talks, and published papers into a model, then generates contextually perfect emails — referencing real projects, using appropriate jargon, even mimicking the writing style of a known colleague. The cost per attempt dropped from hours of manual OSINT to seconds of API calls. In one engagement last year, our red team used a fine-tuned model to generate pretexting scripts for vishing calls. The success rate against employees who had passed phishing simulations was 3x higher than our traditional approach. That number should concern anyone running a security awareness program. Vulnerability Discovery and Exploit Generation Static analysis tools have used pattern matching for decades. What's different now is that transformer-based models can reason about code semantics in ways that syntactic tools cannot. Feed a model a diff from a security patch, and it can often infer the vulnerability that was fixed — then generate a proof-of-concept for the unpatched version. This isn't