AI glossary · Basic · AI security · Agents
Security AI
Security AI is technology that uses AI to detect and respond faster to security threats such as hacking attempts, malware and unusual access. It sometimes also refers to the trend of attackers using AI to automate attacks.
About this term
- Level
- Basic · Technical terms you often meet in AI news
- Category
- Security & safety
- Fields
- AI security, Agents
- Added
- 2026-10-09
How it works
Company networks and computers constantly accumulate logs such as access records, emails and programs that were run. Security AI learns what normal activity looks like and flags behavior that deviates from it as an anomaly. For tasks with labeled examples, such as classifying phishing emails or identifying malware, classification models are used. Recently, LLMs have also taken on assistant roles such as summarizing alerts, finding and grouping related logs, and drafting response procedures. Some systems are designed so that AI agents can even carry out actions like locking an account within a defined scope.
Why it matters
Security staff receive a huge number of alerts every day, most of them harmless, which makes it easy to miss real threats. If AI prioritizes them, people can focus on the important incidents. At the same time, attackers are also using AI to write convincing phishing text and automate vulnerability discovery, so defenders increasingly need to match that speed. That is why security AI is described as a field growing on both the attack and defense sides.
AI for attack vs. AI for defense
AI used for attackAttacker side
- Generate convincing phishing text
- Automate vulnerability discovery
- Craft inputs to evade detection
AI used for defenseSecurity team side
- Detect unusual activity
- Alert prioritization · summaries
- Automated actions within a defined scope
공통 Both sides use AI to increase speed and scale
Things to know
AI detectors produce both false positives, which flag normal behavior as attacks, and false negatives, which miss real attacks. There are also techniques such as adversarial examples, in which attackers deliberately craft inputs to evade detection. Keep in mind that LLM-based security tools can themselves become targets of new attacks such as prompt injection. For this reason, a common recommendation is to keep permissions for automated actions narrow and have a person confirm important decisions.
Example
This site featured a report titled "'AI hacking' incident targeting financial firms: customer data leaked at Yegaram and Welcome Savings Banks, no further damage confirmed at other member firms." News like this is read as an example showing that AI can also be used as an attack tool. On the other side, security monitoring products used by financial firms' and companies' security teams highlight features that use AI to detect unusual access and summarize alerts for the staff in charge.