AI Security: The Defensive Mindset Is No Longer Enough

Traditional cybersecurity is based on reacting: waiting for an alarm to go off, reviewing logs, or suffering an incident to know where to invest. But the emergence of generative artificial intelligence is changing the rules of the game. According to a recent warning from the Five Eyes intelligence alliance, frontier AI models are about to exceed industry expectations and will transform both offensive and defensive capabilities. Attackers have already demonstrated that they can bypass safeguards, and the barrier to entry for launching sophisticated attacks will be drastically reduced.

In this scenario, merely defending the attack surface is insufficient. The recommendation is clear: adopt an attacker's mindset. This does not mean launching cyberattacks, but thinking like an adversary to anticipate their moves. The best defense is a good offense, and in the context of AI, this implies using the same technologies to continuously scan our own environment for vulnerabilities before criminals do.

The origin of the defensive mindset

Many security officers (CISOs) come from regulatory compliance or IT areas, which shapes a reactive vision: waiting for monitoring or an incident to reveal where to act. In contrast, those with an engineering profile tend to develop an attacker's mindset, proactively seeking holes throughout the program. This approach is what is needed now, especially in SMBs where resources are limited and every breach can be critical.

Curiosity is the foundation: understanding how systems are configured, why they were configured that way, and what could go wrong. It's not just about patching, but constantly investigating. Teams with an attacker's mindset build scalable solutions that automate the detection, classification, and remediation of risks, aligned with concrete business objectives.

How to adopt an attacker's mindset in your SMB

It is not necessary to restructure the entire IT department overnight. These are the practical steps recommended by the industry:

• Model and deployment neutrality: do not tie your security strategy to a single AI provider. The best models today may not be in six months. Also, consider deployment options in isolated or self-hosted environments if data residency or intellectual property protection require it.
• Defined scope: when implementing AI agents, assign them concrete and well-defined tasks. An agent with a vague problem quickly loses effectiveness; one with a clear objective and adequate context performs better.
• Purposeful automation: each security team should support automated agents that identify risks, classify them, remediate, and report, aligned with a specific business outcome. For example, in application security, agents that manage end-to-end tasks in the development cycle.

If your security program is in an early phase, you don't need a completely new stack. Start by defining the deterministic outcome you want in each area and work backward with the tools you already have. The key is to avoid paralysis by analysis: the bar for attackers is lowering while the bar for defenders is rising.

The role of AI in proactive defense

AI not only empowers attackers; it also offers defenders unprecedented capabilities. You can use language models to analyze large volumes of data for anomalies, predict attack vectors, or simulate adversarial scenarios. The idea is to move from a reactive posture to a proactive one, where security is integrated into the development lifecycle and daily operations.

At ForgeNEX we have seen how the implementation of intelligent agents can transform the security of an SMB. For example, in our article on Graph RAG we explored how relationships between data can reveal hidden threats. Also, in the case of secure VPN and firewall configuration, we verified that a solid perimeter defense is still necessary, but must be complemented with active vigilance.

The conclusion is that we cannot afford to wait for an incident to occur or for the vendor to release a patch. The reinvention of adversaries is constant, and our security must be up to the task. Adopting an attacker's mindset, supported by intelligent automation and technological neutrality, is the way to not fall behind.

Source: The New Stack. Analysis and adaptation: ForgeNEX.