1. From Detection To Prediction​

Traditional AI flagged anomalies only after something unusual occurred, generating alerts for humans to interpret and act upon, if required. That was quite useful, but at best, defenders could identify and thwart so-called “zero-day” attacks.

Unlike older AI systems, generative AI can compare signals from across logs, failed access attempts and other reconnaissance activity to historical attack patterns, and then infer attacker intent with an accuracy as high as 85%. That alone represents a huge leap in defensive capabilities.

However, the real linchpin here is that the AI can also predict the next steps the attacker is likely to take based on analysis far too sublime for any human to do in real time. This enables defenders to anticipate attacks and take preventive action before a zero-day exploit or breach occurs.

2. From Static To Contextual Identity ​

Older AI systems assumed identity was static: user + device + credentials = trust. When an unknown identity appeared in an IP or MAC table, it was flagged and blocked. ​

But when a legitimate user logs in from an open or unfamiliar network like a nearby cafe, that user’s identity and credentials need to be obfuscated to reduce risk. And that can easily throw gum in the works when a security system must decide who is friend and who is foe. In the previous AI paradigm, largely trained on static signatures and predefined rules, when normal behavior shifted even slightly, the system could flag the users it was meant to protect. This causes inconvenience to locked-out users and reduces productivity for organizations.

Generative AI can interpret complex contextual signals holistically. It knows that the cafe login IP address deviates from baseline, but also understands that logging in from a cafe at lunchtime is consistent with a particular user’s prior patterns. It also understands that an unusual login address combined with other anomalous activity might still signal a compromised credential.

Whether or not the generative AI flags the incident, it isn’t done. It can also produce short-lived, context-specific credentials that provide just enough identity proof for the immediate transaction without exposing long-lived keys or passwords. Analogous to mechanisms like keyless encryption, this approach enables secure, ephemeral authentication—“just-in-time.” In a world where AI agents will require secure, privileged access to do their jobs, context-aware identity management will be an increasingly vital part of future identity security architectures.

3. From Syntactic To Semantic Understanding

Traditional security often required humans to manually identify sensitive data in some fashion. At best, it could use syntactic rules and labels—“Only encrypt data in this folder” or “that file type,” for instance. However, this approach was prone to failure due to that most common cybersecurity vulnerability—human error. Whenever someone misclassified or misplaced data, or when new formats appeared that were not accounted for by existing rules, sensitive information could be exposed.

Generative AI can reason in ways that older AI systems could not, semantically recognizing passports, identity cards, faces, login credentials, encryption keys or other sensitive content across text, images, audio and logs. Wherever it may find such data—even when misplaced or mislabeled—this can automatically trigger encryption or other forms of access restriction. This eliminates one of cybersecurity’s most persistent vulnerabilities, without adding any management burden.

4. From Pretty Good To Immaculate Bug Discovery

A 2023 report revealed that 3 out of every 4 applications has at least one security bug, and 1 in 5 have a flaw of high severity. These vulnerabilities evade detection because applications can contain millions of lines of code, with thousands of interdependencies—too much for human analysts to review. Legacy security tools are great at pattern matching, applying static analysis rules and looking for known vulnerability signatures, but they struggle with complex logic flaws and predicting how components will interact under real world conditions.

Generative AI can review massive volumes of code quickly, and apply its powers of reasoning, plus knowledge acquired from millions of other cases, to quickly recognize faulty logic patterns, rare edge cases and an infinite number of hypothetical execution paths. Using this approach, Anthropic’s Claude discovered more than 100 bugs in the code of internet browser Firefox, 14 of which were considered high severity. To put that into perspective, Claude found more vulnerabilities in a single application, in under two weeks, than are typically discovered in a two-month period—across all applications, worldwide.

But even that does not hold a candle to Anthropic's latest Mythos model, which the company declined to make fully public in April 2026 for fear that it would expose zero-day vulnerabilities "in every major operating system and every major web browser" on Earth.

For decades, cybersecurity has been a reactive game—detect, respond, patch, repeat—and pray! Generative AI has radically transformed that equation with tools that can reason about threats, anticipate attacks, make highly intelligent, context-dependent decisions and secure systems proactively and at scale, rather than scrambling to do damage control after things go wrong.

While many have feared that generative AI would empower attackers and make the world less safe, perhaps generative AI is actually the technology breakthrough that gets cybersecurity off the back foot, and finally gives defenders the upper hand.​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?