The future of cybersecurity rests on five foundational axioms: “Data is the new oil,” humans cannot operate at machine speed, cyber is inherently a “purple” discipline, zero-trust architecture is non-negotiable, and cybersecurity is a group effort. These principles guide our understanding of the evolving threat landscape and highlight opportunities to identify anomalous and/or malicious activity, find gaps in our security before malicious actors do and leverage AI to develop low-cost, secure operating systems for our partner nations.
The Five Axioms of Cybersecurity
1. ‘Data is the new oil.’ It just needs to be refined.
“Data is the new oil,” coined by Clive Humby in 2006 at an Association of National Advertisers conference and later expanded by Dr. Steven Carter to “Data is the new oil, it just has to be refined,” still holds true, perhaps more so, 20 years later. The economics of technology have been transformed; the cost of storage, memory and compute power has steadily decreased while their capacity has grown exponentially.
This has made it feasible to collect vast amounts of data from every possible source and process it with increasing speed. In cybersecurity, tools like security information and event management and endpoint/extended detection and response are now standard for monitoring network events. We must collect logs and metrics from every device, application and network segment. Each data point, no matter how insignificant it may seem, contributes to a more complete operational picture.
However, raw data is not intelligence. This is where artificial intelligence (AI) becomes the refinery. AI can analyze petabytes of data in real time, identifying subtle patterns and anomalies that would be impossible for a human analyst to spot.
It can correlate events across disparate systems to distinguish between malicious attacks, unauthorized user activity and simple network inefficiencies. By providing AI with read-only application programming interface access to various services, it can act as an orchestrator, pulling in data from multiple streams to create a unified, high-fidelity view of the battlespace.
2. Humans can’t read, act and react at machine speed.
Today’s digital domain is too vast and complex for human-driven defense. The sheer volume of data and the speed at which events unfold have surpassed human cognitive limits. We require AI-integrated tools, not just to automate tasks, but to replicate at machine speed, exceeding the ability of an experienced analyst or team.
An AI can monitor the network’s configuration, detect an anomaly and implement a defensive countermeasure in milliseconds. While traditional algorithms are efficient for known threats, AI introduces the ability to cross-reference massive, unstructured datasets, providing a level of context that is crucial for identifying novel and sophisticated attacks. AI doesn’t just follow rules; it learns and adapts, making it a powerful force multiplier for security teams.
3. Purple is the color of cyber.
For too long, cybersecurity has been separated into “red teams” (offense) and “blue teams” (defense). This creates an adversarial relationship where the ultimate goal—securing the enterprise—can be lost in the lack of communication and coordination between the two.
Malicious actors are already using AI to find and exploit vulnerabilities at an unprecedented speed. Automated penetration testing tools, powered by AI, should be continuously probing our own networks or a digital twin to identify weaknesses before an adversary does. AI should also be running over current network configurations to identify gaps in security because human teams are prone to burnout, forgetfulness, oversaturated work requirements and errors, which inevitably lead to security gaps.
Furthermore, traditional change management, with its deliberative boards, is too slow for the modern threat environment. A more agile approach involves using AI to validate changes in a digital twin of the live network. This allows for continuous patching and updating in a secure, virtualized environment that mirrors the production network, ensuring that security is maintained without disrupting operations. By using the AI-reviewed digital twin, management teams can maintain a human in the loop as the decision-makers for change implementations while reducing the administrative tasks and time necessary to come to a decision, as response times become increasingly more crucial.
4. Zero-trust architecture (ZTA) must be adhered to.
The foundational principle of zero trust is “never trust, always verify.” In a ZTA environment, no user or device is trusted by default, regardless of its location. This architecture can be significantly enhanced by generative intelligence.
AI can monitor network traffic and user behavior, comparing it against established baselines and approved configurations. When it detects an irregularity, or a user accessing a file they’ve never touched before, a device communicating with an unknown server can automatically flag it for review or even block the action in real time. This moves ZTA from a static set of rules to a dynamic, adaptive security model.
5. Cybersecurity is a global team sport.
The security of our own networks is intrinsically linked to the security of our allies and defense industry partners. This is not merely a theoretical concept but a stark reality of our interconnected world. A significant challenge, particularly for smaller nations, is the reliance on low-cost hardware from countries known to embed backdoors and other vulnerabilities in their products. As the role of the traditional software engineer evolves, AI-driven coding and recoding can empower allies to repurpose hardware from potentially untrustworthy sources, turning a vulnerability into a strength.
