5 Realities of AI in Modern Cybersecurity

Every vendor in security claims AI changes everything. Ask the engineers actually building these systems and a different story comes up: a context gap. The AI returns a threat analysis that reads well and sounds confident but has little connection to the product. 

That is where a recent conversation with Anders Hallgren and Marcus Graf von Wilamowitz-Moellendorff from SystemWeaver started. The question on the table was simple: what does it actually take to make AI useful in cybersecurity work, beyond the demo? Across an hour of conversation, the answer kept coming back to one word: context. 

“To truly leverage AI you have to look at what AI is good for and what the needed input for AI to actually be valuable is,” Anders said. “Otherwise it feels a bit fake. You will for sure get an answer. That’s not the issue. It’s getting an answer that you can trust.“ 

Here are five things that surfaced during the conversation about where AI in cybersecurity stands today.  

1. AI is only as smart as your meta-model

AI never works with the product directly. It works with however that product has been described, structured, and connected, whether on paper or in whatever system holds that information. If that description is a pile of documents with no shared structure, the AI has nothing to reason with. 

Marcus described the alternatives inside SystemWeaver, where every piece of information carries its role with it: this is a requirement, this is a security goal, this is a section, this is a component. “The data has context,” he said. “At the end, it has context in how it’s connected in the structure, but also through the meta-model behind it, the model describing this item is a requirement, this item is a section, this item is a corresponding security goal, and so on. So when a large language model is requesting data there, it is aware of the context of the data.“ 

That is a different starting point than asking an AI to retrieve and guess at relevance from scattered documents. “SystemWeaver is really predestinated for AI usage just through the data structure,” Marcus said, describing early experiments connecting a language model via MCP. “We started just playing around with MCP, accessing SystemWeaver, and it was naturally finding the information. We didn’t need to give it instructions to go get stuff. It was able to find it and answer.“ 

Marcus framed the broader principle: “It’s not standing alone. It’s standing in the concept of the whole development process at the end, so item definition and so on. If you don’t know that, you have no chance. You need context. What is the architecture around? You need all this stuff packaged at once to be digested by the AI, and typically that’s not one Word document. It’s  distributed across many.“ 

2. The Agile vs. V-model rivalry is mostly a myth

Many teams treat the V-model, the structured, gated process that security and compliance work tends to require, as the enemy of moving fast. Anders pushed back on that directly: “There’s a misconception that the V-model goes against working in an agile fashion. That is not true. It’s fully possible to work agile while delivering to a larger delivery point, a gate or something like that. It’s just a matter of where you do your work and where you deliver it.“ 

The mechanism that makes this work is granular configuration management: versioning at the level of individual requirements rather than entire documents. “Specifically with regards to the configuration management, in SystemWeaver for each requirement you have a version, and so on,” Marcus said. “You can say, yup, that’s ready, this section is ready to be used, and we can implement this feature. So we can be pretty iterative in the V-model at the end. It’s not that you need to define all the stuff down, but you can decide on defined packages and iteration.“ 

That same iteration applies to the security analysis itself, which does not get done once and filed away. “Security analysis lives from being updated continuously,” Marcus said, “not only through the development process, but also later on through the lifetime of the product.“ 

3. We’re heading into a vulnerability tsunami

The third reality is about scale, and it is the part of the conversation that felt the most urgent. New regulation, particularly the Cyber Resilience Act and ENISA requirements, is closing the door on quietly sitting on a known vulnerability. “With the changes now with ENISA and so on, you need to actively publish your vulnerabilities,” Marcus said. “They’re getting public. So you have the challenge that you only have a given time frame where you can keep them securely hidden, but you’re forced with the corresponding CRA regulations to keep them up to date.“ 

At the same time, vulnerability discovery is accelerating, partly because AI is now being used to find them. “Looking on the AI side, you’re getting more and more vulnerabilities reported on your product, through Mythos, through other AI topics, also through field attacks,” Marcus said. He pointed to Linus Torvalds’s recent comments about open-source maintainers struggling to keep up with the volume of incoming bug reports as a preview of what is coming for vulnerability management more broadly: “I think we’ll soon have a similar situation on the vulnerability side. Certain libraries are reporting more and more vulnerabilities, partly because of AI, but also because they’re now required to be reported. Different dependencies are pushing that. If you’re just relying on humans, it’s getting difficult to handle. You need an overview and pre-sorting, and AI can support that.“ 

4. AI’s real job is killing the boring work

Volume is rising while deadlines stay fixed, and that gap is exactly where AI is positioned to help. According to Marcus, a large share of a TARA (Threat Analysis and Risk Assessment) is exactly the kind of work AI is suited to take on. “The investment in a TARA, for example, that’s typically if you’re doing this manually, 50% is probably common work. It’s not very specific, it’s not very expertise loaded, it’s common knowledge. That’s classical stuff AI can support and pre-filter.” 

In practice, that means automatically cross-linking SBOMs to vulnerability databases, mapping out the obvious attack paths and damage scenarios, and pre-filling the parts of an analysis that do not require judgment. “We’ve seen that it’s pretty successful to identify certain damage scenarios, threat scenarios, attack paths that are obvious,” Marcus said. “So you can really release engineers with AI here, where they would typically just do white work at the end, and that’s not really creative, not really fun. They can focus on the topics which are really interesting, which are probably not covered. It’s not putting the human out of the loop but releasing them from boring work.“ 

Anders agreed, and framed it as something closer to a deadline than an opportunity: “It’s super important for all the companies out there to actually start using the technology that is coming now, that is already here, in order to not only say that they use AI and gain the efficiency, but do it for real, in order to simply keep up.“ 

5. “Better than the worst” is a legitimate strategy

The last reality is the one that is easiest to miss if the focus stays purely on the technology: perfect security is not the goal, and it was never realistic. “It’s really about being secure enough,” Marcus said. “It doesn’t need to be perfect at the end, and it depends on the product type.“ 

Marcus illustrated why with an example from outside automotive entirely. A major camera manufacturer introduced a standard for digitally signing images, so that a photo could be trusted as genuinely coming from that camera. The signature itself worked fine. The problem was the system around it: “It was easily attackable by just making double exposures at the end. So it’s not only about the technical parts, it’s really about understanding the system, defining the system, analyzing the system, and how it’s used.“ 

That is the essence of security by design: connecting item definitions to architecture so the whole system has been thought through, not just the individual controls. And the payoff is mostly about avoiding being the easiest target. “More and more connected devices are coming out there,” Anders continued. “You need to be better than the worst, because the worst ones, the ones with the worst security, they will be targeted first, because hackers are usually a bit lazy. It will look bad for the brand to be the hacked car in the newspaper.“ 

The human in the loop 

Put together, these five points describe a shift from manual, disconnected spreadsheets toward something closer to end-to-end traceability, a thread that runs from the first requirement all the way to the line of code that implements it, and back again when a vulnerability shows up. AI is what makes it possible to follow that thread at the speed the threat landscape now demands. The engineers are still the ones deciding what matters. 

As Anders put it, closing out the conversation: “Stay in control. Be efficient.“