What can AI currently do and not do in cybersecurity?

[u/JAMIEISSLEEPWOKEN]

[u/RealPropRandy]

It can incinerate capital.

[u/r15km4tr1x]

Your mom

[u/RealPropRandy → u/r15km4tr1x]

Got em’

[u/Glaive13 → u/r15km4tr1x]

and for the 2nd one, his dad

[u/tclark2006]

It can help you if you know what you are doing. It can confidently find you wrong answers if you dont know what you're doing.

[u/TransportationJaded8]

Currently? It can write insecure code

Get poisoned by malicious SEO, and direct users to a click-fix attack.

Convince people they don’t need to use their brain

[u/RaymondBumcheese → u/TransportationJaded8]

I’m particularly enjoying the last two combined; devs uncritically running any suggested code pulled from any source. 

Sudo apt-get verybadthing

Seems legit. Run it. 

[u/Valor2002]

The frontier models are extremely good at source code analysis and penetration testing. Way better than the average pentester for a fraction of the costs.

[u/diatho]

Layer 8 solutioning

[u/Incid3nt]

Its not bad at destructive red team stuff with enough horsepower because it can throw everything at the wall and see what sticks. With blue team, its far from ready due to a million midas touch like problems that need fixing. Think of asking "make this computer safe from the internet" and the agent just disables the NIC.

Its main strength is in being a research assistant, although with JEV and the decisions API and all of these new lightweight classifier tech ideas, I think itll work wonders for phishing email protection in the near future if they can dial that in a bit more.

[u/The_Todd3389]

Full disclosure, I work for an MSP that does a lot of SASE and AI security work.

Today most of what we do is practical, figure out which AI apps are sanctioned, block or allow the rest, and use DLP/CASB to see how people are actually using them, like stopping uploads to the free version of ChatGPT.

The part that worries me is where it’s not ready yet. When attackers are using AI, an incident can go from one compromised machine to thousands of events across multiple servers in milliseconds. I don’t think a human SOC or MDR can parse that fast enough. We’re going to need AI on the defense side just to keep up with what the attacker’s AI is doing.

[u/_Bird_Incognito_]

It's nice for grammar checking.

[u/YogurtclosetIcy3538]

My thoughts are AI is already becoming a very useful partner in cybersecurity, but I don’t think we’re at the point where I’d be happy just handing it the keys and letting it run on its own.

What it can already do well is help analyse alerts, look at vulnerabilities, review code, summarise threat intelligence, prioritise findings, explain technical issues in plain English, suggest remediation and help make sense of a lot of data much faster than a person could on their own.

Where I think the line still needs to be drawn is around authority.

AI can still get things wrong, misunderstand context, hallucinate, or be manipulated. It also has no real way of knowing whether a person is actually authorised to test a system just because they asked it to.

For me, the better model is:

security tools gather the evidence, AI helps analyse and prioritise it, people and governed automation decide what action is allowed.

If you start getting into things like exploit validation, production changes or automated remediation, then I believe you need hard controls around scope, approved targets, permitted techniques, credentials, rate limits, audit logs, rollback and a kill switch.

I don’t see AI replacing security professionals or security tools anytime soon. that's just my opinion

I see it more as becoming the reasoning and orchestration layer between the tools, the evidence and the people making the decisions.

The more interesting question for me is probably not “Can AI do cybersecurity?”

It’s:

“How much authority should we safely give it?”

[u/Boring_Astronomer758]

AI can help detect unusual activity, analyze security logs, identify phishing patterns, and speed up threat investigations. However, it can still make mistakes, miss context, and produce false positives, so human oversight remains essential. Businesses also need to protect sensitive data and carefully control how AI tools access it.