When AI is the attacker and the protectorThreat actors are using advanced AI techniques to carry out attacks, while defenders are also using AI agents to plan defence, detect incidents and recover after them.LIZ DOUGLASS and ALEX MORKOSTraditional security controls remain essentialGift this article5 min read14 hours ago.Updated 2 hours agoCyber threats are evolving as advances in AI reshape both the market and the criminal economy. Australian organisations are already familiar with the growing risk of cyber attacks, but the next phase is different because adversarial AI is accelerating threats such as social engineering, deepfakes, synthetic identities, misinformation and data poisoning.Over the past few years, organisations in Australia and around the world have made real progress in cyber security, with stronger executive backing, increased investment and rising confidence in breach response. Yet confidence and readiness are not the same thing. Deloitte’s Global Future of Cyber Survey found that 85 per cent of organisations feel prepared for breaches, while 70 per cent have taken enough cyber security actions to demonstrate a high level of readiness. That gap should not be read as failure. It’s should be read as a warning that strategy, investment and intent now need to be translated more consistently into operating discipline.Liz Douglass is Partner and Cyber Lead at Deloitte AustraliaThe defining feature of this moment is that AI is both the attacker and the protector. Threat actors are using advanced AI techniques to carry out attacks, while defenders are also using AI agents to plan defence, detect incidents and recover after them. In practice, that means organisations are fighting both sides of the same technology. The challenge is speed. Businesses are moving faster, software development is moving faster, and new vulnerabilities are being created faster. Cyber teams once had the relative luxury of working to vendor patching cycles, but now they need to move as fast as the business does. Threat actors are moving too. The barrier to entry is lower because an AI agent can help build an attack and discover the latest vulnerabilities. This does not mean leaders should panic. It means they should get practical. There are three key things organisations should focus on.Know what you need to protectEvery organisation should revisit its “crown jewels” and ask whether it knows where its key assets are. The point is simple. A physical bank a century ago knew where its safe was. Today’s equivalent may be customer data, intellectual property, operational systems or digital credentials, but manyorganisations still struggle to see their tech environment clearly. Tools can now scour networks and test what a bad actor would see when scanning the environment. That won’t solve everything, but it can bring visibility to risks that are otherwise hidden risks.Understand defenceHistorically, defence was static with layered controls and technologies making it inflexible against AI attacks. AI-enabled threats are now evolving at unprecedented speed, so effective defence now requires both strong foundations and rapid response capabilities.Traditional security controls remain essential. They act as the invisible guardrails that constrain and govern AI agents, reducing the risk of unintended behaviour. This is particularly important given recent guidance from the Australian Signals Directorate that prompt-based controls alone should not be considered a reliable security mechanism*.(* As noted in https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/agentic-ai-harnesses)Alex Morkos is a Cyber Partner at Deloitte AustraliaBut this is not only a technology question. Systems and processes should come first, and technology is more costly when organisational maturity is low. It also means returning to cyber hygiene. Poor configurations, former employees with active accounts and inconsistent access controls are the kinds of issues that can create unnecessary exposure. Organisations need to move fast but with control.Detect and recoverIf an organisation cannot detect an incident, it is not ready to recover from one. Where protection cannot be improved quickly because of cost, complexity or time, detection capability should be enhanced so the organisation at least knows when something is happening and can respond faster. Recovery must also be tested, not assumed. Boards and executive teams should run cyber fire drills that simulate an AI bot taking data or threatening to disrupt the network. IT teams should test failover and backup restoration in the same way fire alarms are tested. But these three things alone are not enough. The harder change is organisational. Businesses need to examine whether their structure is ready for the speed of AI threats. Cyber cannot sit in one corner while technology, operations and the executive team move elsewhere. There will need to be a closer blending of cyber and IT teams because organisations cannot move at speed if responsibility is passed from one group to another, and IT teams know their systems best when recovery is required. AI may automate routine tasks, but that does not mean people disappear. It means roles change, with greater emphasis on anticipating risks and acting ahead of time.The organisations that will be most resilient are not necessarily those that spend the most. They will be the ones that know what matters, understand how it is defended, can detect and recover when something goes wrong, and are willing to reshape themselves for the pace of the threat. In today’s world of AI-driven attacks, turning confidence into operational readiness may be the most effective path to sustainable cyber security success.Liz Douglass is partner and cyber lead at Deloitte Australia. Alex Morkos is a cyber partner at Deloitte Australia.Disclaimer     This article contains general information only, and none of Deloitte Touche Tohmatsu Limited (“DTTL”), its global network of member firms or their related entities (collectively, the “Deloitte organisation”) is, by means of this communication, rendering professional advice or services. Before making any decision or taking any action that may affect your finances or your business, you should consult a qualified professional adviser. No representations, warranties or undertakings (express or implied) are given as to the accuracy or completeness of the information in this communication, and none of DTTL, its member firms, related entities, employees or agents shall be liable or responsible for any loss or damage whatsoever arising directly or indirectly in connection with any person relying on this communication.About Deloitte  Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited (“DTTL”), its global network of member firms, and their related entities (collectively, the “Deloitte organisation”). DTTL (also referred to as “Deloitte Global”) and each of its member firms and related entities are legally separate and independent entities, which cannot obligate or bind each other in respect of third parties. DTTL and each DTTL member firm and related entity is liable only for its own acts and omissions, and not those of each other. DTTL does not provide services to clients. Please see www.deloitte.com/about to learn more.The Australian partnership of Deloitte Touche Tohmatsu is a member of Deloitte Asia Pacific Limited and the Deloitte organisation. For more information, please visit our web site at https://www2.deloitte.com/au/en.html.Deloitte Asia Pacific Limited is a company limited by guarantee and a member firm of DTTL. Members of Deloitte Asia Pacific Limited and their related entities, each of which are separate and independent legal entities, provide services from more than 100 cities across the region, including Auckland, Bangkok, Beijing, Bengaluru, Hanoi, Hong Kong, Jakarta, Kuala Lumpur, Manila, Melbourne, Mumbai, New Delhi, Osaka, Seoul, Shanghai, Singapore, Sydney, Taipei and Tokyo. Liability limited by a scheme approved under Professional Standards Legislation.© 2026 Deloitte Touche Tohmatsu.  More CoverageWhy the biggest AI challenge for insurance is not inside the enterpriseMax Murray25 years of Tech Fast 50: plotting the course of nation’s digital transformationJOSHUA TANCHELThe CEO’s new imperative: enable a human-led, AI-powered workforceDoug BeaudoinRead related topics:Artificial Intelligence