Why AI Is Forcing Cybersecurity to Rethink Control, Data, and Talent

AI is moving faster than the systems, teams, and governance structures most organizations have built around it. For CIOs, CISOs, and technology leaders, the challenge is no longer whether AI will affect the business. It is how quickly it will reshape security, operations, and the way companies define value.

That pressure is creating a strange mix of excitement and anxiety. The opportunity is real, but so are the risks: rapid model improvement, rising cyber complexity, and the growing gap between what AI can do and what organizations are ready to control.

The pace of AI is outstripping traditional planning

Tim Freestone described the current moment as a blend of daily anxiety and real opportunity. His point was not just that AI is changing quickly, but that the pace of change itself is now a strategic risk. In his view, the last few years have compressed what used to unfold over much longer cycles.

That matters because cybersecurity and infrastructure teams are already stretched thin. Even before generative AI, security organizations struggled to keep up with staffing, tooling, and the constant expansion of attack surfaces. AI has intensified that pressure by making both the threat and the response more dynamic.

One of the more sobering ideas in the discussion was that even if the biggest AI labs slow down, the broader ecosystem will not truly pause. Development, adoption, and experimentation will continue. That means security leaders cannot wait for the market to settle. They need to design for motion.

Freestone also suggested that the conversation around a “pause” in AI development reflects more than one thing at once: technical limits, energy and compute constraints, safety concerns, and, yes, business incentives. For leaders, the practical takeaway is simple: treat the exponential curve seriously, regardless of the headlines.

Cybersecurity has to meet AI with AI

One of the clearest themes in the conversation was that old cybersecurity models are not enough. The traditional posture — firewalls, web application firewalls, cloud security controls, and human-driven review — offered a sense of control. AI has changed that. The scale and speed of change now require new systems.

Freestone argued that organizations need to meet the threat of AI with AI. That does not mean replacing security teams. It means giving them tools that can keep pace with machine-speed attacks, machine-generated content, and the rapid adaptation of adversaries using AI themselves.

This is especially important because so much of cybersecurity is still human-centric. Social engineering remains one of the most effective attack methods, and AI makes those attacks more convincing. It can generate content, mimic tone, and adapt faster than a person can manually respond.

The broader implication is that security teams need to rethink control. Instead of trying to manage AI first at the tool level or the agent level, Freestone made the case for starting with data. If organizations can understand where data lives, who can access it, and what those access paths look like, they can begin to control what AI agents can do. In other words, control the data and you control the agents.

The future belongs to AI-augmented experts

The talent question was just as important as the technology question. Freestone pushed back on the idea that the answer is simply “hire more people.” In his view, quantity rarely solves complex operational problems. Skill sets do.

He described a new archetype emerging across cybersecurity and IT: the person who understands the domain deeply and can also engineer AI-enabled workflows. That combination is more valuable than either pure domain expertise without AI fluency or AI skill without business context.

That aligns with a useful distinction for leadership teams. Many organizations already have subject matter experts who are under-leveraged because they are not using AI well. Others have people who are strong with AI but weak on the underlying business or security discipline. The goal is not to choose one group over the other, but to build teams where expertise and AI capability reinforce each other.

There was also a warning here for executives. Mandates like “use AI” or KPIs that simply count AI usage can create activity without value. A better approach is to define a specific digital input and output, measure the cost of that process, and then apply AI to improve it. Start small, prove the gain, and expand from there.

That same discipline applies to cybersecurity. The organizations that will benefit most are not the ones chasing token counts or broad mandates. They are the ones grounding AI in controls, outcomes, and domain expertise.

If you want a practical view of how AI, cybersecurity, and operational control are colliding right now, the full conversation is worth your time.