The Future of AI & Cybersecurity
No, But It Will Shift Their Focus to More Strategic and Creative Roles
Generative AI is quickly becoming an essential part of everyday security workflows. So, is it a partner or a competitor?
See Also: Real-Time Sanctions and Watchlist Screening: Transforming Compliance into Competitive Advantage
The wide-ranging implementation of gen AI technologies into virtually every aspect of the security stack has, on the whole, helped security teams work more efficiently to mitigate threats. Gen AI is giving security practitioners access to data and an unprecedented way to quickly analyze it, making their work even more impactful than it’s ever been.
At the same time, gen AI has expanded the attack surface – whether through adversaries’ ability to scale production of malicious code, the risks associated with employees’ use of large language models, LLMs, or increasingly sophisticated social engineering campaigns.
How Gen AI Is Helping Security Professionals
So, how does all this affect today’s security professionals? With gen AI on board, security practitioners’ daily scope of work is changing in real time. Let’s look at some of the traditional tasks by role and how gen AI is alleviating burdensome processes for each.
Security Engineers and Architects
Task: Collect and normalize a new data source.
Gen AI helps by: Automating the development of custom data integrations and creating a full-fledged integration package, including mappings and templates.
Task: Create or convert a detection rule.
Gen AI helps by: Creating and converting detection rules, as well as explaining alerts.
Security Analysts
Task: Triage alerts.
Gen AI helps by: Automating triage by correlating related alerts into attack-level findings.
Task: Monitor security alerts.
Gen AI helps by: Automating alert triage by filtering out false positives and prioritizing genuine threats based on severity and potential impact.
Task: Investigate a threat.
Gen AI helps by: Performing key investigation steps such as providing a detailed description of the attack, summarizing hosts and users, displaying related MITRE ATT&CK tactics, and more. Built-in AI assistants can also create step-by-step remediation plans and streamline ad hoc analysis and enrichment by generating preferred program language queries.
Task: Respond to an incident.
Gen AI helps by: Suggesting remediation steps and helping document incidents.
SOC Leaders
Task: Manage team performance.
Gen AI helps by: Tracking and summarizing metrics based on the response time, alert volume per analyst, team fatigue levels and more.
Task: Report metrics and insights to executives.
Gen AI helps by: Aggregating and visualizing security metrics, generating concise summaries, and providing predictive insights to better communicate with stakeholders.
See a detailed breakdown of how AI is changing the cybersecurity landscape.
AI-Driven Security Analytics
With the help of gen AI, security teams can more easily prioritize critical incidents, reduce alert fatigue and accelerate investigations through real-time integrated threat intelligence, automated triage and LLM-enhanced workflows. AI-driven security analytics transform security operations into a more proactive, adaptive and efficient function, helping organizations stay ahead of today’s threat actors – who themselves are also leveraging gen AI – and respond with greater speed and accuracy.
Here are some estimates on how much time security teams can expect to save with AI-driven security analytics.
Today’s AI-Equipped Security Professional
Gen AI is elevating efficiency, productivity and overall defense capabilities, but how could it help you in your role? Take a look at this resume from the perspective of a humble-yet-powerful AI assistant and see why gen AI is the newest team member you need.
Gen AI has been a big win for security teams worldwide. While it’s unlikely to take cybersecurity professionals’ jobs, it is bringing forth a powerful level of automation that up levels practitioners’ traditional day-to-day workload – shifting their role to adopt more strategic focus and creative problem-solving.
By automating many of the time-intensive and mundane tasks that have burned out many security analysts and admins, security teams can now focus on the priorities that truly matter and further strengthen overall security posture.
Watch our Security trends for 2025 webinar to gain further insight into the relationship between practitioner and AI and see how AI can help your team accomplish more.
The release and timing of any features or functionality described in this post remain at Elastic’s sole discretion. Any features or functionality not currently available may not be delivered on time or at all.
In this blog post, we may have used or referred to third-party generative AI tools, which are owned and operated by their respective owners. Elastic does not have any control over the third-party tools and we have no responsibility or liability for their content, operation or use, nor for any loss or damage that may arise from your use of such tools. Please exercise caution when using AI tools with personal, sensitive or confidential information. Any data you submit may be used for AI training or other purposes. There is no guarantee that information you provide will be kept secure or confidential. You should familiarize yourself with the privacy practices and terms of use of any generative AI tools prior to use.
Elastic, Elasticsearch, ESRE, Elasticsearch Relevance Engine and associated marks are trademarks, logos or registered trademarks of Elasticsearch N.V. in the United States and other countries. All other company and product names are trademarks, logos or registered trademarks of their respective owners.