‘It's the AI cybersecurity apocalypse for threat actors’: Five ways CISOs can use ‘dark AI’ to their own advantage - IT Pro
Cybersecurity risks are escalating with a 34% increase in vulnerability exploitation last year, but CISOs can leverage 'dark AI' to gain advantage over threat actors, according to Gartner analyst Leigh McMullen.
Cybersecurity risks are escalating with a 34% increase in vulnerability exploitation last year, according to Verizon's data breach investigation report. Gartner predicts vulnerability discovery will "skyrocket" in the coming years, creating what some call an 'AI cybersecurity apocalypse' for threat actors.
Speaking at the Gartner IT Symposium/Xpo 2026 in Barcelona, Leigh McMullen, distinguished VP analyst and Gartner fellow, argued that while weaponized AI ('dark AI') presents challenges, it can be more of an advantage than a threat for cybersecurity professionals.
Automation as Business Case
McMullen advises cybersecurity professionals to shift from innovation to automation in their defense strategies, stating "you can't out-innovate a crowd." While AI makes attackers faster, it also makes them weaker by increasing their reliance on AI-assisted attack pathways.
Unlike typical technology investments, cybersecurity automation appreciates in value over time, covering more services and revenue as it scales. This represents an opportunity to comprehensively scale cybersecurity efforts.
Information Sharing Advantage
Cybersecurity professionals discover vulnerabilities before threat actors do, as evidenced by the publication of CAP and CVE lists. McMullen emphasized that sharing insights across industries weakens threat actors: "the more widely exploits are shared, the weaker threat actors become."
As we come together as communities of practice within our different industries, casting aside traditional industry competition, so that in cybersecurity we don't compete with each other… This is how we get stronger.
AI Weaponization Latency
Defensive AI capabilities currently outpace offensive ones, giving cybersecurity professionals a time advantage regardless of whether it measures in minutes, hours, or days. AI is also enabling new approaches like creating digital twins of environments through software reverse engineering.
McMullen illustrated this with music technology examples, where synthesizers have been reverse-engineered by end users. "Imagine if you could do that to your OT devices," he suggested, enabling comprehensive patch testing and full CI/CD implementation.
Defender's Knowledge Advantage
Cybersecurity's primary attack surface remains open source software, which gives defenders an advantage through familiarity with their terrain. "If you know what open source software you have, this gives you a source of advantage," McMullen explained.
He recommended using "dark AI on yourself" through AI-assisted penetration testing and red teaming to identify unknown vulnerabilities that concern boards.
Costs Favor Defenders
Complex AI attack tools require customization for specific environments and targets, limiting their scalability. McMullen noted that while threat actors may steal tokens, larger operations make them easier to detect and interdict.
Ultimately, McMullen concluded that "the AI cybersecurity apocalypse" favors defenders, not threat actors. He emphasized building resilience through recovery rehearsals and demonstrating continuous improvement capabilities to boards, which can mitigate the impact of security breaches and reduce ransomware threats.
Related
