From reactive defence to predictive, AI-driven security

Why the old security model is under strain

Cloud computing, IoT, mobile working and bring-your-own-device policies have made organisations more agile, but every new connection is also a new entry point. Modern enterprises run on interconnected estates that blend cloud services, third-party providers and on-premises systems, while holding ever larger volumes of customer data, financial records and intellectual property.

The threats have matured in step. Phishing is now personalised with AI to slip past spam filters, ransomware disrupts hospitals and public institutions, advanced persistent threats sit undetected inside networks for long periods, zero-day exploits target flaws no one has yet patched, and botnet-driven DDoS attacks take services offline. Against this backdrop, most organisations face five structural pressures.

• Sophistication: attackers use AI to mimic genuine user behaviour and evade standard controls.
• Resource constraints: underfunded security functions, with SMEs the most exposed.
• Skills gap: too few professionals who can deploy modern tools and handle complex incidents.
• Regulatory compliance: regimes such as GDPR and CCPA demand strict data controls and breach reporting.
• Legacy systems: outdated technology that lacks modern security features and is costly to keep patched.

From signatures to self-learning defence

AI's role in security has evolved in clear stages. Early expert systems and signature-based antivirus worked well against known threats but were easily bypassed by anything new. Machine learning entered the field in the early 2000s, and by the early 2010s endpoint tools were analysing file attributes, network traffic and behaviour rather than simply matching signatures.

Behavioural analytics followed, with user and entity behaviour analytics (UEBA) learning what “normal” looks like so that deviations stand out. Deep learning then allowed systems to mine unstructured data such as logs, emails and transaction records for hidden attacks, and security operations centres (SOCs) began using AI to filter false positives, orchestrate responses and hunt proactively for threats. The direction of travel is unmistakable: from reactive, rule-bound defence to adaptive, predictive protection.

What AI changes in day-to-day security

The book identifies a set of capabilities that, together, change how security teams work.

Financial services illustrate the value well. Banks are prime targets because of the data they hold, and machine learning models that compare live transactions against established customer patterns help institutions such as JPMorgan Chase flag suspicious activity, reduce losses and protect customer trust.

• Real-time detection: analysing large data volumes as events happen, not after the damage is done.
• Behavioural analysis: building a “pattern of life” for each user and device to expose insider threats and compromised accounts.
• Proactive endpoint protection: assessing files before they execute, without waiting for signature updates.
• Automated response: isolating devices, blocking suspicious IP addresses and alerting administrators through adaptive playbooks.
• Predictive analytics and threat hunting: learning from past incidents to anticipate likely attacks.
• SOC efficiency: filtering noise and prioritising real incidents so analysts can focus on complex, strategic work.

The limits leaders must manage

AI is not a self-sufficient fix. Models are only as good as their data: incomplete or biased training sets lead to missed threats, and a model trained mostly on English-language phishing, or on corporate networks in developed economies, may miss attacks that look different. Over-sensitive models create false positives and alert fatigue, deep learning can be a “black box” that regulators and boards struggle to accept, and capable systems demand investment, infrastructure and scarce skills.

Attackers use AI too, crafting adversarial inputs to fool detection models and deploying deepfakes and AI-driven phishing to manipulate staff. AI also lacks business context; as the book puts it, “unusual doesn’t always mean threat”. The answer is a hybrid model: continuous tuning, adversarial training, explainable AI, privacy-preserving techniques such as federated learning, managed security services where in-house capacity is thin, and human analysts who supply the judgement machines cannot.

Why it matters now

The book's conclusion is direct: moving from reactive measures to proactive and predictive security is essential, and embracing AI is “no longer an option but a necessity” for organisations protecting valuable assets. Looking ahead, it points to real-time threat intelligence sharing across industries, the potential pairing of AI with quantum computing, and adaptive systems that keep learning as threats evolve. The pages in this section explore how to put that into practice.