Artificial intelligence is rapidly changing cybersecurity. We are using AI to find threats faster, identify patterns humans miss, analyze enormous amounts of information, automate decisions, and increasingly take actions that once required a person. At the same time, our adversaries have access to the same fundamental technology.
And while we race to use AI to protect our organizations, we are simultaneously putting more of the information, decisions, and operations we need to protect inside AI-enabled systems themselves. That creates an unusual security problem. AI is becoming the asset. AI is becoming the defender. And AI is becoming the adversary. Or, put more simply: AI is simultaneously the prize, the defender, and the predator.
Perhaps we need to rethink what AI security really means.
Much of today's discussion about AI and cybersecurity tends to concentrate on one of these relationships at a time.
All are important. But they are not the same problem. They create three distinct cybersecurity challenges: Secure AI with AI against AI. And looking at all three together reveals something that is easy to overlook: The future of cybersecurity may depend as much on changing the environment in which AI operates as it does on making AI itself smarter.
Imagine two of the most secure banks in the world. Massive vaults. Armed guards. Cameras. Biometric access. Layer upon layer of security. Now imagine Bank A needs to transfer $10 million to Bank B … Would you put $10 million in your kid's little red wagon and have a banker pull it down the street?
Of course not. You would use an armored car … Problem solved? … Not quite. An armored car can be followed. Its route can be predicted. The road can be blocked. The vehicle can be disabled, overturned, or attacked. And if all $10 million is inside one vehicle, successfully attacking that vehicle may give the attacker everything. So perhaps the real problem isn't simply how secure the two banks are, or even how strong the armored car is.
Maybe we need to rethink how the money moves between them.
Now replace the “banks” with “AI systems” and replace the “money” with “data” in our analogy. Suddenly the problem looks very different. We can secure an AI model. We can secure its database. We can authenticate its users. We can protect its APIs. We can establish guardrails around its agents. We can harden its cloud environment and endpoints. All of those things matter.
Modern AI risk-management approaches appropriately consider security and resilience throughout the AI lifecycle, and today's AI systems increasingly involve models, applications, services, agents, tools, data sources, and supporting infrastructure. But an operational AI system does not simply sit inside a vault. It communicates.
Users communicate with AI. AI communicates with databases. Agents communicate with tools. Applications communicate through APIs. Edge systems communicate with clouds. AI systems communicate with other AI systems. Every one of those connections carries something valuable. The security of the vault does not automatically protect what's on the road.
Now imagine you have the world's most advanced smoke detector. It doesn't merely detect smoke. It knows exactly where the fire started. It knows what caused it. It calculates how quickly the fire is spreading. It identifies which rooms are threatened. It predicts where the fire will be five minutes from now. Then it announces: "Your house is burning down."
That's extraordinary intelligence. But your house is still burning. The smartest smoke detector in the world doesn't put out the fire. Now imagine the smoke detector can do more than detect.
Something fundamental just happened. The system went from knowing to acting. That distinction matters for cybersecurity. AI is extraordinarily promising for detecting anomalies, correlating events, identifying malicious behavior, finding patterns, predicting threats, and accelerating analysis.But better knowledge of an attack does not, by itself, preserve the mission. A defender ultimately has to do something.
The progression therefore becomes: Sense → Understand → Predict → Decide → Act
And perhaps eventually: Sense → Understand → Predict → Decide → Transform
Securing with AI needs to transform the environment the attacker is trying to exploit. Change a communications path. Isolate a resource. Alter a network relationship. Move traffic away from suspicious infrastructure. Reconfigure defenses. Preserve communications despite a failure or attack.
The important question becomes larger than: How smart can we make the security AI? The differentiator is How effectively can intelligence change the environment it is defending? Maybe we need to rethink what happens after we know.
Now imagine a burglar is watching your house. He doesn't break in. He simply watches.
After watching long enough, the burglar knows something extremely valuable without ever entering your house: he knows your pattern.
Now give the burglar AI. Imagine the burglar can watch thousands or millions of houses simultaneously. He never sleeps. He remembers every observation. He correlates information from different sources. He identifies relationships and patterns a human observer might never recognize.
So you change your routine. You leave at different times. You take different roads. You use different vehicles. That’s better…But a sufficiently capable observer may still find patterns.
So let's change the problem again. Imagine the burglar sees activity throughout the neighborhood, but cannot reliably determine which observations belong to your house. Now suppose people throughout the neighborhood are sending small, locked, similar-looking packages using different routes. The burglar can observe packages moving. But useful identifying information is obscured. He cannot readily determine where every package originated, where it is ultimately going, which packages belong together, or whether several observations collectively represent the same transaction. Let’s give that problem to the burglar's AI. It can still observe. It can still analyze. A sufficiently capable AI may still infer things from those observations. But the quality of the intelligence problem has changed.
Instead of asking: "What pattern does this house follow?" the AI may first have to determine: "Which observations belong to this house?" And then: "Which observations belong together?" This leads to a very different way of thinking about defending against AI.
Today's cybersecurity industry is understandably racing to build smarter defensive AI to counter increasingly capable offensive AI. That risks creating an endless contest: Attacker AI ↔︎ Defender AI But what if that isn't the only contest worth fighting?
AI's extraordinary power to correlate information still depends on information from which useful relationships can be inferred. So perhaps one defensive strategy is not simply to build an AI smarter than the adversary's AI. Perhaps we can also reduce the completeness, consistency, attribution, persistence, and correlation value of some of the information available to it.
Put much more simply: Maybe we need to rethink what the adversary is able to know.
These three problems initially appear quite different.
But underneath them is a common dependency: Information has to move. AI may be changing cybersecurity, but AI still has to interact with the world.
That suggests a useful abstraction: Information → Intelligence → Communication → Action
Not every AI system will use every element in exactly the same way, and local or autonomous systems can perform substantial computation without continuous external communication. But once AI participates in distributed digital operations, communications become part of both its capability and its attack surface. That means “AI security” cannot start and stop at the AI itself.
There is an obvious problem with writing about AI security in 2026. We have no idea what AI will look like in 2036. Today's large language models and agentic systems may eventually look primitive. Future AI architectures could be radically different. They may be more autonomous, distributed, specialized, embodied, collaborative, or built using computational approaches that are only beginning to emerge. Trying to predict all of that would be foolish, but perhaps accurate prediction isn’t even necessary.
Whatever tomorrow's artificial intelligence looks like, useful digital intelligence will still need some combination of information, computation, communication, and action.
Future adversarial AI may become dramatically better at inference than today's systems. It may extract useful intelligence from observations that appear meaningless to us today.
That possibility actually strengthens an important security principle: As adversaries become better at inference, controlling the quality, completeness, attribution, and correlation value of what they can observe may become more important, not less.
The objective isn't to assume that tomorrow's AI won't figure something out.The objective is to give tomorrow's AI a harder intelligence problem in the first place
Maybe we don't need to predict tomorrow's AI to start building for it.
There is another technological shift occurring at the same time: quantum computing. Quantum computing and artificial intelligence are fundamentally different technologies, and they should not be treated as the same security problem. But they share an important lesson. Security architectures must survive changes in the capabilities of the adversary.
The quantum threat is sufficiently concrete that NIST has standardized post-quantum cryptography and says organizations should begin migrating now. FIPS 203 specifies ML-KEM for establishing shared secret keys and is designed to remain secure against adversaries possessing quantum computers. That creates two different future pressures. AI may dramatically improve the adversary's ability to:
One challenges the intelligence problem. The other challenges the mathematics protecting information. Both point toward the same broader principle: Build security around enduring architectural principles, not assumptions about the limits of today's adversary.
This is where an interesting architectural opportunity appears. Much of today's AI-security discussion understandably occurs around the AI itself: models, prompts, agents, identities, APIs, applications, tools, data, guardrails, and governance. NIST's AI RMF and Generative AI Profile similarly take broad lifecycle approaches to managing AI risk rather than treating AI security as a single technical control. Those protections are necessary. But there is another place from which we can affect the problem: beneath much of the AI interaction, in the communications infrastructure carrying information among systems.
Not every defense has to fight AI at the AI layer.
A communications architecture can potentially change what an adversary can collect, how completely it can collect it, how easily observations can be associated, which infrastructure must remain available, and how communications respond when portions of that infrastructure fail or become untrusted. This is where technologies such as Dispersive provide an interesting proof that the broader concept is implementable.
Dispersive® Stealth Networking does not secure every AI problem. It does not prevent prompt injection, eliminate model poisoning, correct hallucinations, prevent an authorized AI agent from taking an inappropriate action, or protect plaintext already exposed on a compromised application endpoint. Dispersive addresses a different part of the architecture.
Dispersive segments communications, independently protects those segments, protects identifying information within its segment headers, and can distribute protected communications across multiple paths. Its architecture is designed to reduce dependence on any single transport path while making observation of an individual protected path less complete and less useful. That matters to all three parts of our paradox.
And as cryptographic requirements evolve, post-quantum mechanisms can address a different dimension of future risk. NIST's ML-KEM standard provides the key-establishment foundation for quantum-resistant architectures. The point isn't that one technology solves AI security. It doesn't. The point is that the architecture underneath AI can change the security problem presented to AI.
As organizations race to adopt AI, perhaps the most useful questions are not only:
We should also be asking three more fundamental questions:
And behind all three is one final question: Are we building security for the AI we have today, or an architecture capable of adapting to the intelligence we haven't invented yet?
But we do know something about intelligence:
Intelligence needs information,
Information has to move,
and intelligence becomes consequential when it can act.
Perhaps the future of AI security begins by protecting those fundamentals.
Dispersive protects the communications between users, models, agents, tools, and data as a lightweight overlay on the networks you already run. Your existing security stack stays in place.
📞 Schedule a briefing with Dispersive’s architects to assess your exposure and map a deployment path. www.dispersive.io
Header image courtesy of StakeCash from Pixabay..png?width=1150&height=768&name=ai-security-paradox-penrose%20(1).png)
