AI Cyber Attacks Are Increasing: Here's How Security Teams Can Respond

When I began working in the technology sector, cybersecurity was a steady race between attackers and defenders. Today, with the introduction of AI, that race has become a sprint.

Phishing campaigns, social engineering, identifying vulnerabilities and malware are all being accelerated with AI. Traditional security operations have always depended on people reviewing alerts, investigating unusual behaviour and deciding what action to take. I see that model becoming increasingly difficult to maintain when the volume and velocity of activity increase. I have spoken to many experienced security analysts who tell me that there are only so many alerts they can investigate in an hour. An AI-enabled attacker doesn't have the same limitation. They can potentially generate, adapt and repeat activity continuously.

The solution

I don't want this to be a platform to promote Ricoh products and services designed around this challenge; instead, I want to share some of my observations. 

Let's begin by addressing the elephant in the server room. Whenever I discuss AI, the conversation quickly turns to whether artificial intelligence will take cybersecurity jobs. I think that's the wrong question. The better question is: where should cybersecurity experts be spending their time? Do we really want highly experienced people manually working through thousands of repetitive alerts, or do we want them concentrating on the incidents, decisions and risks that genuinely require their judgement?

As AI becomes more capable, I expect security teams' roles to shift increasingly toward directing, validating, and refining automated systems. Take AI fighting AI as an example. The idea is to use machines for what they do best: monitoring huge volumes of activity, identifying patterns, correlating signals, and responding at a speed no security team could realistically achieve. This frees up your team to focus on judgement, context, intelligence and strategic direction.

Imagine thousands or millions of events taking place across identities, endpoints, applications, networks and cloud environments. Instead of expecting an analyst to manually inspect every individual signal, AI-powered systems can help identify the small number of events that require attention and, where appropriate, take action before an incident has time to spread. AI can identify an anomaly while your team comprehends its significance to the organisation. Equally, AI can correlate thousands of signals while your team can apply commercial context. Finally, AI can initiate a response in seconds, while your team decides how that response fits with the organisation's priorities and objectives.

That's why the future isn't autonomous security or human expertise. It must be the augmentation of both. The organisations that become most resilient won't be those that try to automate everything, nor those that rely entirely on people. They'll be the organisations that understand what each does best. Let AI monitor continuously, correlate enormous volumes of information and react at machine speed. Let your team provide the human oversight, judgement, context, intelligence and strategic direction.

This thinking is already shaping the way I see security operations being built. At Ricoh, we're bringing together human oversight, agentic AI, and crowdsourced threat intelligence to help organisations move toward a 24/7/365 security model. That matters because no single technology will solve this challenge on its own.

For me, that's where this gets interesting. AI is becoming part of how security operations work, helping teams monitor continuously, identify what matters and respond faster. At the same time, experienced people remain responsible for the judgement and context that technology can't provide on its own.

Next steps

The security market is moving quickly, so continually evaluating vendors and technologies and bringing together a portfolio that is relevant as both the threats and the defences evolve is crucial. The name of the game is continuous innovation, because threats are evolving faster than ever.

Ricoh has brought together market intelligence and a curated portfolio of technologies to help organisations build security strategies around their specific business needs. We don't have a one-size-fits-all solution, and I'm glad we don't because I can't honestly say that is the best solution. No two organisations have the same digital DNA, and that's why our cybersecurity team takes a discovery-led approach that prioritises your specific business context.

• Learn more about our cyber security solutions by reading our eBook, Delivering digital continuity in an unpredictable world.
• Request a free cyber security discovery session and we’ll identify clear opportunities to strengthen your organisation's resilience.