AI can accelerate cybersecurity but humans must retain the final decision

Artificial intelligence is transforming cybersecurity. It can process vast amounts of data, connect signals across systems and identify suspicious activity in seconds, tasks that would take human analysts far longer.

But as AI moves from identifying threats to taking action, a critical question emerges: what happens when the machine gets the decision wrong?

Recommended For You

Flight disruptions, infrastructure damage in Riyadh amid Houthi attacks

Barsha 1, Karama: Full list of Dubai areas where shared housing is allowed

Iran-backed Houthis claim fresh attack on Riyadh airport; no Saudi confirmation

Dubai's Global Village announces ticket prices ahead of October 14 opening

Nana Patekar spoke about death just 4 days before his passing: Here's what he said

 

For Zheng Li, Co-founder, Group Vice-President of Abu Dhabi based Global AI firm, Ansen Technology, the answer begins by clearly separating AI assistance from human authority.

“AI can accelerate an investigation, connect evidence and recommend a response, but people must remain responsible for consequential decisions,” Li said.

“The objective is not to remove security professionals from the process. It is to give them better information and more time to make the right decision.”

That distinction becomes increasingly important as enterprises move from generative AI to agentic AI, systems capable of accessing information, interacting with enterprise tools and initiating workflows.

An AI agent can be properly authenticated, operate within its permissions and still make the wrong decision.

“The next major AI-security incident may involve an authorised agent making the wrong decision with the right credentials,” Li said.

“In the agentic AI era, organizations must also ask: should this AI be allowed to take this particular action?”

The new cybersecurity perimeter

Traditional cybersecurity has focused heavily on preventing unauthorised access. With agentic AI, organisations must also control authorised actions.

That means knowing which AI systems are operating, what data they can access, which tools they can use and what permissions they have.

Not every AI action requires human approval. Summarising an alert or identifying patterns can be automated. But blocking a critical service, changing a security policy or restricting access carries a different level of risk.

“Not every AI action carries the same level of risk,” Li said. “The controls should reflect the potential consequences.”

For organisations deploying AI at scale, human oversight therefore needs to be built into the architecture from the outset.

Ansen’s approach emphasises sovereign deployment, customer-specific intelligence, human control and auditable outcomes. Its AI-security solutions can operate in customer-controlled, private, on-premises or air-gapped environments, while high-risk actions remain subject to defined controls and approval.

That accountability matters. Following an incident, organisations need to know what an AI system saw, what it recommended, what evidence informed that recommendation and who authorised the final action.

“Speed without accountability creates a different kind of risk,” Li said.

AI should reduce pressure, not remove judgment

Cybersecurity teams already face overwhelming alert volumes and a shortage of experienced professionals. AI can relieve some of that pressure by handling repetitive analysis and bringing the most important incidents to analysts’ attention.

But automation should not mean surrendering judgment.

“Human control does not mean a person must manually perform every step,” Li said. “It means people define the policies, establish the boundaries and remain accountable for high-risk decisions. AI handles volume and speed. Humans provide judgment.”

The same principle applies to securing AI itself. Organizations cannot govern systems they cannot see. They need visibility into the AI applications and agents operating across their environments, including those introduced without formal approval.

They must also understand how data moves through these systems, restrict access to sensitive tools and information, and maintain records of important AI interactions.

“Organisations cannot govern AI they cannot see,” Li said.

Sovereign AI needs sovereign security

The issue is particularly relevant to the UAE, where AI adoption, digital government and critical infrastructure are advancing rapidly.

For Li, sovereignty cannot stop at where data is stored or where a model is hosted. It must extend to how AI behaves, what it can access and which decisions it is permitted to make.

“Sovereign AI is not complete without Sovereign Security,” he said. “An organisation does not have full control over its AI if it cannot see what the system is doing, restrict its access or intervene before it takes a high-risk action.”

The goal is not to slow AI down. It is to make its acceleration sustainable.

The organisations that benefit most from AI will not necessarily be those that give it the greatest freedom. They will be those that know where to draw the line,  allowing machines to handle speed and scale while keeping people firmly responsible for the decisions that matter most.