Five Roles of AI in Cybersecurity: From Attack Accelerator to Prime Target

The article, written by three cybersecurity experts from Rostelecom, Positive Technologies, and FMBA, examines five AI roles in cybersecurity. First, AI accelerates attacks by lowering the cost of social engineering, code generation, and logic formation. Second, a compromised assistant on an infected endpoint can leak data, perform actions, damage reputation, consume resources, or poison context. Third, leakage often stems from excessive permissions, rich context, or weak output checks. Fourth, AI can serve as a shield, sorting events and drafting investigations, but must not make final decisions. Fifth, AI as a direct target is vulnerable to prompt injection, poisoned sources, and insecure output handling, especially when it has agency. The authors argue that system prompts are not security locks; deterministic controls like policy engines, RBAC, and approval steps are essential.