AI vs. AI: 6 Ways Enterprises Use AI to Stop Cyberattacks

Why is AI becoming essential for cybersecurity? Because every day, in fact every second, malicious actors are using artificial intelligence to widen the scope and speed of their attack methods.

For one thing, as Adam Meyers, senior vice president at CrowdStrike, told VentureBeat in a recent interview, “The adversary is getting 10 to 14 minutes faster every year. As their breakout times shrink, defenders have to react even faster — detecting, investigating and stopping threats before they spread. This is the game of speed.”

Meanwhile, Gartner wrote in its recent study, Emerging Tech Impact Radar: Preemptive Cybersecurity, that “[m]alicious actors are exploiting generative AI to launch attacks at machine speed. Organizations can no longer afford to wait for a breach to be detected before taking action. It has become crucial to anticipate potential attacks and prioritize preemptive mitigation measures with predictive analysis.”

And for its part, Darktrace’s latest threat report reflects the new, ruthless mindset of cyberattackers willing to do whatever it takes to gain the speed and stealth they need to breach an enterprise, exfiltrating data, funds, and identities even before security teams know they’ve been hit. Their weaponization of AI extends beyond deepfakes into phishing email blasts that resemble legitimate marketing campaigns in scale and scope.

One of the most noteworthy findings from Darktrace’s research is the growing threat of weaponized AI and malware-as-a-service (MaaS). According to Darktrace’s recent research, MaaS now constitutes 57% of all cyberattacks, signaling a significant acceleration toward automated cybercrime.

AI is meeting cybersecurity’s need for speed

Breakout times are plummeting. That’s a sure sign that attackers are moving faster and fine-tuning new techniques that perimeter-based legacy systems and platforms can’t catch. Microsoft’s Vasu Jakkal quantified this acceleration vividly in a recent VentureBeat interview: “Three years ago, we were seeing 567 password-related attacks per second. Today, that number has skyrocketed to 7,000 per second.”

Few understand this challenge better than Katherine Mowen, SVP of information security at Rate Companies (formerly Guaranteed Rate), one of the largest retail mortgage lenders in the U.S. With billions of dollars in transactions flowing through its systems daily, Rate Companies is a prime target for AI-driven cyberattacks, from credential theft to sophisticated identity-based fraud.

As Mowen explained in a recent VentureBeat interview, “Because of the nature of our business, we face some of the most advanced and persistent cyber threats out there. We saw others in the mortgage industry getting breached, so we needed to ensure it didn’t happen to us. I think what we’re doing right now is fighting AI with AI.”

Rate Companies’ strategy to attain greater cyber resilience is anchored in AI threat modeling, zero-trust security, and automated response, which offers valuable lessons for security leaders across industries.

“Cyber attackers now leverage AI-driven malware that can morph in seconds. If your defenses aren’t just as adaptive, you’re already behind,” CrowdStrike CEO George Kurtz told VentureBeat. The Rate Companies’ Mowen, for example, is battling adversarial AI with a series of working defensive AI strategies.

Fighting AI with AI: what’s working

VentureBeat sat down with a group of CISOs, who requested anonymity, to better understand their playbooks for fighting AI with AI. Here are six lessons learned from that session:

Improving threat detection with self-learning AI is paying off. Adversarial AI is at the center of an increasingly large number of breaches today. One quick takeaway from all this activity is that signature-based detection is struggling, at best, to keep up with attackers’ latest tradecraft.

Cyberattackers aren’t stopping at exploiting identities and their many vulnerabilities. They’re progressing to using living-off-the-land (LOTL) techniques and weaponizing AI to bypass static defenses. Security teams are forced to shift from reactive to proactive defense.

DarkTrace’s report explains why. The company detected suspicious activity on Palo Alto firewall devices 17 days before a zero-day exploit was disclosed. That’s just one of many examples of the rising number of AI-assisted attacks on critical infrastructure, which the report provides data on. Nathaniel Jones, VP of threat research at Darktrace, observed that “detecting threats after an intrusion is no longer enough. Self-learning AI pinpoints subtle signals humans overlook, enabling proactive defense.”

Consider automating phishing defenses with AI-driven threat detection. Phishing attacks are soaring, with over 30 million malicious emails detected by Darktrace in the last year alone. The majority, or 70%, are bypassing traditional email security by leveraging AI-generated lures that are indistinguishable from legitimate communications. Phishing and business email compromise (BEC) are two areas in which cybersecurity teams are relying on AI to help identify and stop breaches.    

“Leveraging AI is the best defense against AI-powered attacks,” said Deepen Desai, chief security officer at Zscaler. The Rate Companies’ Mowen emphasized the need for proactive identity security: “With attackers constantly refining their tactics, we needed a solution that could adapt in real time and give us deeper visibility into potential threats.”

AI-driven incident response: Are you fast enough to contain the threat? Every second counts in any intrusion or breach. With breakout times plummeting, there’s no time to waste. Perimeter-based systems often have outdated code that hasn’t been patched in years. That all fuels false alarms. Meanwhile, attackers who are perfecting weaponized AI are getting beyond firewalls and into critical systems in a matter of seconds.

Mowen suggests that CISOs follow the Rate Companies’ 1-10-60 SOC model, which looks to detect an intrusion in one minute, triage it in 10, and contain it within 60. She advises making this the benchmark for security operations. As Mowen warns, “Your attack surface isn’t just infrastructure — it’s also time. How long do you have to respond?” Organizations that fail to accelerate containment risk prolonged breaches and higher damages. She recommends that CISOs measure AI’s impact on incident response by tracking mean time to detect (MTTD), mean time to respond (MTTR), and false-positive reduction. The faster threats are contained, the less damage they can inflict.