Enhancing Cybersecurity with AI: The Imperative for Developing Defensive Agents Now

As summer 2026 approaches, discussions surrounding AI strategy dominate conversations among cybersecurity professionals, regardless of their geographical location or industry. Today, executives must grapple with two pressing questions:

1. Are we effectively building, testing, and scaling defensive agents in anticipation of AI-enabled adversarial actions?
2. Do we possess the necessary breadth of intelligence to react swiftly to threats at machine speed?

Why the Focus on AI Agents?

Timing is a significant factor in cybersecurity. The question arises: Why prioritize investment in defensive agents now? Two key points are essential to understanding this urgency.

First, we must consider the landscape of financially motivated adversaries who are not tied to state resources. While government-backed entities possess unique advantages, independent malicious actors are beginning to harness AI technologies for nefarious purposes. For instance, reports have surfaced about how advanced AI models are used to create malware autonomously, amplifying the threat level. The Five Eyes alliance has issued warnings about the potential misuse of frontier AI models, but so far, we have not seen a full-scale offensive wave from these adversaries. This leads to an intriguing observation: the anticipated threat hasn't fully materialized yet.

Despite their capabilities, frontier models are still encumbered by limitations when it comes to the large-scale deployment required for automated attacks. Adversaries face challenges in using third-party APIs, which heightens the risk of being traced, while simultaneously needing to invest heavily in developing their localized models. Open-source models have generated significant buzz, yet the practical realities of utilizing them for offensive strategies demand considerable resources—both in time and financial investment.

For example, a recent evaluation of tools like LibreChat and Dolphin-llama3:14b on budget-friendly hardware revealed that accomplishing relatively straightforward tasks, such as creating a web shell, is still beyond reach for most. However, this barrier will inevitably diminish over time as advancements continue, ultimately making effective attack agents more achievable for opportunistic actors.

One fascinating area to monitor is quantization. This process allows AI models to function with reduced memory requirements by rounding numbers, thus lowering the resource demands while maintaining a baseline effectiveness for various tasks. As the necessary hardware costs decline, the prospect of broad-scale opportunistic attacks looms closer.

The real challenge for defenders is not the sensationalized frontier models, but rather the ease with which adversaries can implement efficient local models with relatively low-end hardware. Based on recent advancements noted over the past 18 months, we can predict that the next six to twelve months will likely see similar enhancements in open-source model functionality. This evolution will set the stage for rapid threat escalation from adversaries.

Returning to the essential question of how to protect assets and respond effectively with AI agents—now is the moment to build capabilities rather than merely contemplate strategies. Just as we wouldn’t operate self-driving vehicles without confidence in safety measures, defensive AI workflows must undergo rigorous testing to identify and mitigate edge cases.

Forward-thinking Chief Information Security Officers (CISOs) are working to establish an AI control plane, collaborating with various business units to ensure comprehensive insight into AI token utilization, evaluate project ROI, and assess code security. The initiative to develop and test agents fits seamlessly into this broader control-plane framework and is particularly urgent.

CISOs must build trust in these agents amidst strict data availability and security regulations. While human oversight may remain necessary for the foreseeable future, monitoring agent efficacy in controlled environments becomes vital. Iterative processes involving tasks such as patch applications, signature generation, quarantine protocols, and credential revocations need to be mastered over time. Though vendor partnerships can provide essential knowledge, ultimate responsibility for workflows—especially those involving high-stakes decisions—should rest within the organization.

Organizations that delay in developing these agents now risk falling behind as financially motivated adversaries enhance their AI capabilities using open-source resources.

Prioritizing Agent Deployment

The second critical question revolves around strategic deployment: where should these agents be implemented first? The effectiveness of agents is intrinsically linked to the quality and traceability of the data they employ, which must be extensive and comprehensive. There are numerous opportunities for early implementation, with three key areas identified for their potential impact.

1. Continuous Threat Exposure Management (CTEM): Every phase of CTEM can benefit from agent input. AI-driven vulnerability detection is evolving rapidly, yet substantial improvement is needed in the reliability of available patches. The focus should be on K-E-V (Known Exploited Vulnerabilities), as agents can help streamline detection signatures in a landscape filled with irrelevant CVSS scores. Integrating new KEVs with robust asset inventories paves the way for effective agent-driven workflows.

2. Breach and Attack Simulation (BAS): Think about this as ongoing Red Teaming initiatives. Existing controls often fail to perform at the levels advertised, which means adversary AI could easily compromise systems in a matter of minutes. It’s crucial to validate coverage and identify gaps before adversaries launch attacks. The intelligence needed for BAS starts with an understanding of malware tools, tactics, and procedures (TTPs), but familiarity with in-the-wild methodologies is equally critical. Initially, agents can accelerate the coordination of TTPs with BAS efforts; over time, they might automate many BAS functions.

3. Security Operations: This domain is witnessing substantial innovation, particularly among AI start-ups focused on enhancing SIEM alert responses and refining incident investigations. Agents equipped with deep insights about indicators and artifacts can deliver significant advantages in ticket management abilities. However, the challenge lies in calibrating agent autonomy against the potential consequences of their actions. The governance structure must facilitate rapid responses for low-risk tickets while ensuring human oversight for more sensitive interventions.

Adopt Agents Early or Wait?

The development of production-grade security agents may still be underway, but there’s an urgency to invest in research and development now. Organizations need to cultivate resilience as models evolve and quantization accelerates. The time to prepare is before opportunistic attackers can easily implement AI solutions locally.

Combining expertise from vendors with in-house knowledge in security and AI will expedite the learning curve. While human judgment remains invaluable in critical scenarios, agents can handle routine tasks efficiently. Hesitating to invest in building these capabilities could jeopardize an organization’s security standing—start developing agents today.