The GenAI Security Paradox — Intelligence vs. Determinism

Across 9 presentations and 3 panels, AI appeared repeatedly in two directions:

• AI for Security: using GenAI for threat detection, triage, investigation, and summarisation.
• Security for AI: governing AI systems and defending against risks such as prompt injection, data leakage, and unauthorised agent actions.

My main takeaway from the summit was that the cybersecurity industry is still actively exploring how AI should fit into security. Vendors are presenting different frameworks and strategies, but there does not yet seem to be one established approach for autonomous AI-driven security.

My Reflection: Probability vs. Predictability

One concern I kept thinking about afterwards is the gap between probabilistic GenAI behaviour and the predictability expected from critical security controls.

This is my own interpretation rather than something directly stated at the summit.

I saw a similar example from a Meta employee discussing MetaMate, Meta's internal GenAI tool for information search and summarisation. Important results still need to be verified because GenAI output may be incorrect.

This reinforced my view:

GenAI can reduce friction without becoming the source of truth.

AI can help surface patterns, summarise information, and accelerate investigation, while validation, permissions, auditability, and final decisions remain outside the model.

Conclusion

If your team is still trying to define the "right" AI security strategy, the industry is still figuring it out too.

For now, my view is:

AI is becoming a powerful security accelerator, but reliability comes from the system around the model, not from trusting the model itself.