Beware the Slasher: AI Could Kill Off Cybersecurity Pros’ Skills

Nathan Hamiel outlines potential SecOps horror in the AI midst, as core technical capabilities go the way of reading an atlas or remembering phone numbers.

Black Hat India — Bengaluru — The use of AI as a tool to enhance cybersecurity operations is emerging as a double-edged knife for security professionals. While it can make them more capable, it could also spell the demise of the very skills they need to use it effectively.

That’s the concern of Nathan Hamiel, senior director of research at Kudelski Security, who has made a case for how evolving technology can erode technical skills since well before the generative AI boom. Now, that concern is getting much louder.

Speaking to Dark Reading recently, he says he began noticing the problem around 2005 and 2006, when he encountered cybersecurity professionals who lacked a firm grasp of the fundamentals of their work. At that time, he warned about the dangers of relying too heavily on various types of technical tools, declaring to cybersecurity professionals that “your tools are killing you,” and warning that practitioners are moving away from being “hands-on” operators who investigate problems directly, and toward “hands-off” monitors who oversee results presented through tools, interfaces, and dashboards.

It’s a shift that’s being exacerbated now by AI-driven automation, he says, and organizations need to move quickly to optimize the use of AI without the expense of cybersecurity skill-building.

AI Tools Can Simplify Things Too Much

While automation can simplify complex tasks and allow professionals to accomplish more, it can also distance them from the underlying problems they are trying to solve. Without a solid understanding of the fundamentals, practitioners may struggle to recognize when a tool produces an incorrect result or when its findings require further investigation, Hamiel says.

“We need to keep these skills and not let them degrade because those skills are important to making the tools work in the best way possible,” he tells Dark Reading from this week’s Black Hat India conference, where he’s giving a keynote entitled “The Death of Skills and the Persistence of Problems.”

“What AI adds to somebody with knowledge and experience is some additional capabilities,” Hamiel elaborates. “A domain expert wielding AI is going to be able to gain benefits from using that tool that a novice with no domain experience isn’t going to be able to get.”

This distinction is becoming increasingly important as AI becomes more deeply integrated into cybersecurity workflows. It also raises questions about how the industry will develop its next generation of experts if automation removes some of the hands-on tasks that junior professionals traditionally learn.

AI Hype vs. Cybersecurity Reality

The current discussion around AI often falls into extremes, Hamiel says. Some predict that the technology can go a long way toward solving major problems facing not only cybersecurity but also humanity, while others warn that it will bring the industry — and some even the world — to an end.

“You have the doomers,” he says, “and you have people who say this is a big nothingburger. The truth is somewhere in the middle.”

For Hamiel, understanding AI’s impact requires separating what the technology can demonstrate in a controlled environment from what it can reliably accomplish in the real world. Impressive capabilities do not necessarily translate into the wholesale replacement of jobs or the disappearance of entire industries, he says.

The same distinction applies to cybersecurity, Hamiel says. Although AI can help identify vulnerabilities, generate code and support security investigations, those capabilities do not mean that the complex problems facing security teams have suddenly become easy to solve.

In fact, some recent incidents described as “rogue” AI activity — such as OpenAI models autonomously hacking the Hugging Face framework, among others — may reveal a more familiar and persistent cybersecurity problem: organizations failing to address basic security weaknesses.

“If you read some of the incident reports, these are organizations that weren’t exercising basic security hygiene,” Hamiel says.

In these cases, he argues, the weaknesses were already there, waiting to be discovered. “This wasn’t just low-hanging fruit; this was fruit lying on the ground where anybody who looked for it would have found it,” he says.

Rather than signaling an impending cybersecurity apocalypse, such incidents could prompt what Hamiel calls a “cybersecurity correction.”

“It’s not that there is this huge apocalypse happening; it’s that many people weren’t doing the right thing for a very long time,” he explains.

In other words, AI may make it easier to discover and exploit existing weaknesses, exposing the consequences of inadequate security practices. The challenge for organizations is not simply to adopt new tools but to address the underlying problems those tools bring to light.

The Shift From Operators to Monitors

Indeed, the potential erosion of technical skills is not a problem that began with generative AI. Hamiel sees it as part of a longer trend in which technology increasingly mediates the relationship between professionals and the problems they are responsible for solving.

Hamiel’s concern reflects what is often called the irony of automation: As systems take on more responsibility, the humans overseeing them can lose opportunities to practice the skills needed when those systems fail.

The consequences could extend beyond the skills of today’s practitioners to the way the cybersecurity industry develops future experts, he says, especially in how lower-level work that AI can eliminate helps helping junior professionals learn.

Tasks that might appear repetitive or straightforward can provide essential experience, allowing new practitioners to understand how systems work before progressing to more complex investigations. “If you automate that, there isn’t room for them to learn,” Hamiel warns.

This creates a potential long-term problem for employers. AI may allow teams to complete certain tasks more efficiently today, but organizations still need experienced professionals who can investigate unfamiliar problems, evaluate automated findings, and respond when systems behave unexpectedly.

Using AI Without Losing Expertise

For cybersecurity pros to use generative AI effectively, then, it’s simply a matter of applying it to tasks where it offers meaningful benefits while remaining aware of the skills that might be weakened if pros rely too much on these tools to do their jobs effectively.

“The goal here is to maximize the benefits and minimize the drawbacks,” Hamiel says, something that is true for the use of any technology. “That’s the framing that should be placed around this,” he says.

Thus, the only way that organizations can adopt AI without losing essential cybersecurity expertise is to “apply them to the right types of activities,” he says.

For cybersecurity pros, this means using generative AI for tasks such as threat hunting and threat intelligence, where preliminary analysis can help professionals work through information more efficiently, Hamiel notes. AI-powered penetration-testing tools are another area of promising development, extending beyond traditional vulnerability scanning to perform more complex tasks, he says.

Ultimately, the question is not whether AI will change cybersecurity, Hamiel says. That genie is most certainly already out of that bottle. Ultimately, the real challenge is ensuring that the industry does not become so dependent on increasingly capable tools that it loses the human expertise required to use them effectively, he says.

“Skills and expertise make your AI use more effective,” Hamiel concludes. “If you have two professionals, and both use AI, the one with more knowledge of the task is going to make better use of the AI.”