Why AI-Powered Cybersecurity Requires More Than AI-Powered Detection

As artificial intelligence makes cyberattacks faster, more personalised and harder to identify, organisations must look beyond automated threat detection to prevention, identity protection and incident response.

Artificial intelligence is changing the economics of cybersecurity for both attackers and defenders. While businesses are deploying AI to identify suspicious activity and respond to threats, cybercriminals are using the same technology to make phishing, impersonation and social engineering more convincing and easier to scale. The result is an increasingly complex security environment in which detecting an attack does not necessarily mean an organisation can stop it.

The challenge is reflected in the SANS Institute’s 2026 AI in Cybersecurity report, published in July. Based on responses from 536 security practitioners and 57 senior security leaders, the study found that 78% of organisations were already facing confirmed or suspected AI-enabled attacks. At the same time, 63% of respondents reported significant shortcomings in AI threat detection and response, up from 45% in 2025. Although 78% reported actively using AI in cybersecurity, only 27% considered their deployments mature production implementations.

These findings point to a widening gap between adopting AI security tools and building the capabilities needed to manage evolving threats. As attackers become more sophisticated, organisations need a strategy that extends beyond identifying malicious activity to preventing unauthorised access, containing breaches and protecting digital identities.

AI Is Making Familiar Attacks More Convincing

AI is not necessarily creating entirely new categories of cybercrime. Instead, it is making established techniques more effective, personalised and scalable. Generative AI can help attackers produce convincing phishing messages, impersonate individuals through synthetic audio and video, and automate parts of their operations.

The risks are increasingly visible in business environments. A September 2026 Gartner survey of 297 cybersecurity leaders found that 41% had experienced at least one social engineering incident involving a deepfake during an employee audio call in the preceding 12 months. Another 36% reported an incident involving a deepfake during a video call. Email phishing, spear-phishing or business email compromise had affected 79% of respondents.

For businesses, the implications extend beyond employees clicking malicious links. A convincing impersonation can influence payment approvals, account recovery requests and access to sensitive information. Traditional security awareness training, which often teaches employees to identify suspicious messages, may be insufficient when fraudulent communications appear to come from trusted colleagues or senior executives.

Gartner has consequently emphasised stronger identity controls and independent verification procedures for high-risk requests. The focus must shift from simply recognising suspicious content to ensuring that consequential actions are properly authenticated.

The Gap Between Detection and Containment

One of the biggest weaknesses in detection-led cybersecurity is the assumption that identifying a threat automatically limits its impact. In practice, security teams may recognise suspicious activity without being able to revoke compromised credentials, isolate affected systems or prevent attackers from moving through an organisation’s infrastructure.

The SANS Institute’s 2026 State of Identity Threat Detection and Response report illustrates this problem. While 85% of surveyed organisations had deployed identity threat detection tools, 55% still experienced an identity-related breach in the preceding 12 months. Although 68% could detect identity attacks within 24 hours, only 55% could contain them within the same period.

The nature of identity attacks also complicates conventional defences. Credential phishing accounted for 35% of reported identity attacks, while compromised browsers, multi-factor authentication fatigue and session-token hijacking represented other significant methods.

Once attackers obtain legitimate credentials or hijack an authenticated session, their activity can resemble that of an authorised user. Detection systems therefore need to work alongside access restrictions, continuous identity verification and rapid response mechanisms.

Why Cybersecurity Needs a Layered Approach

An effective security strategy must connect several capabilities rather than rely on a single detection platform. Organisations need to reduce their exposure to attacks, monitor activity across their environments and establish clear procedures for responding when preventive controls fail.

This includes maintaining updated systems, limiting unnecessary access, securing devices and applications, and protecting credentials. AI-assisted monitoring can help security teams identify unusual behaviour and prioritise alerts, but its findings must lead to timely action. Compromised sessions may need to be revoked, affected devices isolated and access privileges restricted before an incident spreads.

The approach is particularly important as businesses introduce AI agents and automated systems that require access to internal applications and data. These systems can create additional vulnerabilities if they operate with excessive permissions or lack adequate oversight.

India’s national cybersecurity response has also acknowledged the emerging risks. In an April 2026 advisory on frontier AI-driven cyber threats, CERT-In urged organisations to strengthen monitoring, reduce internet-exposed attack surfaces and review unusual patterns of access and automated activity. The guidance reinforces the importance of established security controls even as AI capabilities evolve.

Identity Protection Becomes Central to Digital Security

The need for layered protection is particularly relevant across Asia-Pacific, where rapid adoption of mobile banking, cloud computing and digital financial services has expanded the number of connected users and systems.

INTERPOL’s 2025/2026 Asia and South Pacific Cyberthreat Assessment, released in June 2026, found that more than half of the countries surveyed reported cybercrime accounting for over 30% of recorded crime. The region experienced more than 135,000 ransomware-related attacks in 2024, while phishing remained among its most widespread and financially damaging cybercrime methods.

Against this backdrop, cybersecurity is increasingly about protecting identities and access across interconnected environments, rather than securing individual devices alone.

“The biggest shift in cybersecurity is the rise of AI-powered attacks that make phishing, identity theft, and digital impersonation increasingly difficult to detect. As people rely more on mobile devices and cloud services, a single malicious link or compromised credential can put personal and business data at risk,” said Gokul Landge, Chief Business Analyst at Xproguard, while conversing with AsiaTechDaily.

Xproguard is an India-based cybersecurity company focused on mobile security and digital privacy. Its consumer security portfolio includes solutions for firewall protection, app locking, anti-theft, VPN, password management and secure photo storage. He added that organisations need to rethink security as a broader trust and data-protection challenge.

“At Xproguard, we believe cybersecurity is no longer just about protecting devices. It is about protecting digital identities, data privacy, network protection, and trust. Our focus is on proactive, layered security that helps users prevent threats rather than react only after an attack occurs,” Landge said.

Xproguard’s focus on mobile security reflects one part of this broader shift, with its consumer portfolio spanning firewall protection, application locking, anti-theft features, password management, VPN and photo vault services. However, the wider challenge for the industry is ensuring that protection extends across the accounts, applications, networks and services that users depend on.

AI will remain an important component of cybersecurity, helping organisations analyse threats, prioritise risks and improve response times. But the effectiveness of these systems depends on the controls and processes surrounding them.

As AI lowers the barriers to more convincing attacks, businesses cannot measure security maturity simply by the number of threats their tools identify. They must also assess whether they can prevent unauthorised access, contain incidents quickly and recover without significant disruption.

The next phase of cybersecurity will therefore depend less on detection alone and more on how effectively organisations connect prevention, identity protection, response and recovery. In an environment where both attackers and defenders use AI, resilience will be determined not just by how quickly a threat is recognised, but by what an organisation can do before that threat causes damage.

Quick Takeaways

• AI is making phishing, deepfake impersonation and identity theft more convincing, increasing cybersecurity risks for businesses.
• Widespread adoption of AI security tools has not eliminated vulnerabilities, with many organisations still struggling to contain identity-related attacks.
• Detecting suspicious activity is not enough. Effective cybersecurity requires prevention, identity protection, access controls and rapid incident response.
• As mobile and cloud adoption expands across Asia-Pacific, protecting digital identities and connected systems is becoming as important as securing individual devices.
• Xproguard’s Gokul Landge argues that organisations must move towards proactive, layered security rather than relying primarily on reactive threat detection.