AI didn’t introduce fundamentally new cyberattacks, it removed the economic and operational constraints that made our existing security models workable. As a result, many controls that appear to be functioning are now failing silently, not because the technology is broken, but because the assumptions behind it no longer hold.-
This talk is a practitioner-focused deconstruction of how AI has changed real-world attack dynamics and why alert-driven SOCs, MFA-centric identity strategies, and human-dependent response workflows are increasingly misaligned with today’s threat reality.
Drawing from observed patterns across large and medium enterprise environments throughout Cybereco members' managed security operations, and incident response cases, the session separates hype from hard lessons learned since the AI inflection point.
Attendees will walk through:
1. Which common security operating assumptions quietly stopped being true in 2024–2025
2. Why identity has become the primary attack plane even in well-instrumented environments
3. How AI has shifted attackers from “skill-limited” to “volume-unbounded”
4. Which legacy controls still work surprisingly well when implemented rigorously
5. A practical, tooling-agnostic “fix these first” playbook for teams operating with finite people and budget
The focus is deliberately non-vendor and non-theoretical. This session is designed for intermediate practitioners like SOC analysts, security engineers, architects, and defenders. This is for those who need to make practical decisions about what to stop doing, what to double down on, and how to redesign their defensive posture for an AI-accelerated threat landscape.
Attendees should expect clear models, concrete examples, and actionable guidance they can apply immediately in operational environments.
