AI's dual role in cybersecurity: faster defenses and faster exploits

The cybersecurity sector faces a paradox: the same advanced AI systems that help defenders identify weaknesses in code and infrastructure are equally available to threat actors. Recent events underscore this reality.

Security researchers deployed OpenAI Group PBC's GPT-5.6 Sol to examine PHP's codebase and uncovered serious vulnerabilities in the language that underpins approximately 70% of websites globally. However, attackers moved swiftly. Amazon.com Inc. reported that malicious actors began exploiting PHP weaknesses just four days before security patches became available, with Cloudflare Inc. tracking millions of subsequent attack attempts.

The incident reflects a broader shift in enterprise security strategy. At Dell Technologies World in Las Vegas this year, industry leaders emphasized that data protection and cyber resilience must serve as core infrastructure layers for enterprise AI systems. According to theCUBE Research's Krista Case, "This is part of a broader market conversation that ties cyber recovery capabilities to resilience, AI governance, data integrity, and operational trust, in a world where enterprise AI systems are only as reliable as the data pipelines, runtime controls, and recovery processes supporting them."

Coping with AI impact on cybersecurity

The cybersecurity community increasingly recognizes that AI models have expanded the surface area for exploitation. Microsoft Corp. documented 1,453 new vulnerabilities in October alone, reflecting the accelerating pace of threat discovery.

Steve Kenniston, senior cybersecurity evangelist for portfolio marketing at Dell, explained the multifaceted challenge: "AI changes the whole game. There's the model inferencing. There's the model training data. There are systems where people can do things like prompt injection. There's identity management that needs to be thought about."

Dell participates in Anthropic PBC's Project Glasswing, which provides vetted organizations access to advanced AI capabilities for securing critical infrastructure. The initiative focuses on software systems supporting essential services where successful attacks could prove catastrophic.

The proliferation of AI agents has intensified focus on identity and access management. Reduced barriers to entry for threat actors have fundamentally altered the security landscape. John Scimone, president and chief security officer of Dell, observed that "the least sophisticated attack tomorrow is more sophisticated than the world will have ever seen a year ago."

Importance of data resilience

Unlike natural disasters with advance warning systems, cyberattacks often arrive without indication. This reality has elevated the importance of recovery capabilities and resilience planning.

Joseph D'Angelo, Director of Product Management at InfoScale, emphasized the necessity of preparation: "There's no prediction here. So, the only way to protect yourself is to ensure that you have what we like to call a defensible recovery posture. And that is understanding the state of your applications, understanding the state of your data, and being able to recover those in a way that is not encumbered or in any way compromised by an attack."

Enterprise AI systems depend entirely on data quality. Storage providers like Infinidat are developing security solutions that protect operational continuity as AI accelerates cyber risk complexity. These approaches combine immutable snapshots, threat detection, and recovery mechanisms to identify uncompromised recovery points.

Infinidat Chief Marketing Officer Eric Herzog stressed the centrality of data protection: "It's all about the data. The core is the data, which is why you need next-generation data protection on your primary storage, which is what AI would use. You need next-generation data protection on your backup, as well."

Preparing for the quantum threat

Post-quantum cryptography represents an emerging priority for long-term security strategy. Transitioning from classical encryption to quantum-resistant algorithms is essential for organizations preparing for future threats.

Current readiness levels appear inadequate. A DigiCert Inc. study released earlier this year found that merely 7% of surveyed organizations have implemented quantum-safe or hybrid cryptography across the majority of their digital certificates. As AI agents increase data's strategic value and facilitate its autonomous distribution, the quantum threat poses escalating risk.

Dell's global CTO and chief AI officer John Roese explained the compounding danger: "Quantum computing will break the encryption and digital signatures protecting data today, while agentic AI raises the stakes by increasing the value of data and autonomously shares it across teams and organizations."

AI research has illuminated the quantum threat's scope. An Anthropic PBC report from late July documented how researchers using Claude Mythos Preview identified enhanced methods for attacking cryptographic systems, including a successful compromise of HAWK, one of nine candidates in the National Institute of Standards and Technology's post-quantum digital signature algorithm selection process.

Garrison Buss, chief technology officer and co-founder of QuSecure Inc., highlighted the accelerating timeline: "CISA, NSA, and NIST have warned since 2023 that adversaries could be collecting encrypted data now and holding it until they can decrypt it. What the AI results change is the other side of that clock – an attacker no longer needs a quantum computer to make meaningful progress; they only need classical compute and a few days."

Security in the infrastructure layer

Organizations entering 2026 must balance rapid AI deployment with urgent threat mitigation. This requires infrastructure-level security addressing risks from agentic AI, quantum computing, and sophisticated models in adversarial hands.

theCUBE Research's Christophe Bertrand articulated this necessity: "There is no AI without a secure infrastructure, and that means data that is also recoverable, that is secure, and is of course compliant. Cyber resiliency risk is not just on the data, what you have to go through every day, it's also starting to appear in the actual AI infrastructure itself. Don't make backup and recovery an afterthought, because it's going to hurt your wallet."

Building resilient systems requires grappling with AI control itself. Publicized incidents involving autonomous agents targeting Hugging Face and the United Nations demonstrate the security complexities of autonomous systems. The industry may need unconventional approaches to cybersecurity fundamentals.

theCUBE Research's Dave Vellante reframed the security model: "We used to draw the stack, and security was a layer. It's not a layer anymore. It has to be something that's orthogonal. I think that the attackers are always going to have an advantage. You know the old saying, they only have to be right once. And there's always going to be seams."