Cybersecurity and Artificial Intelligence: Attackers and Defenders Using the Same Tools, Measured Gains on Both Sides, and a New Surface to Defend

Purpose. Cybersecurity is a contest between attackers and defenders, and both sides are adopting AI. This article asks where AI stands in cybersecurity in 2026, who it is helping more so far, and where the field may be by about 2035. Design and methods. A review combining the share of the cybersecurity research literature that involves AI (OpenAlex, 2010–2025), a randomised trial of AI-generated spear phishing, vendor-run randomised trials of an AI assistant for security analysts, a public challenge on automated vulnerability discovery and patching, a documented deepfake fraud, an industry survey of breaches, Eurostat's data on AI use for ICT security, and the EU rules. Claims taken from the literature were checked against the sources cited. The scenarios are judgements built on this evidence. Findings. Cybersecurity has the highest AI share of the 20 industries: 46.1% of its works in 2025 mentioned AI, up from 16.8% in 2018, although the increase of 2.8 times is the smallest because the field started high, and language-model works rose from 46 to 2,160. The evidence on offence is concrete: in a randomised experiment with 101 participants, fully AI-automated spear-phishing emails were clicked at the same rate as emails written by human experts (54% against 54%, and 12% for a control message), and a fraud in Hong Kong in which an employee was persuaded by a deepfake video call to transfer about US$25.6 million has been documented. The evidence on defence is also concrete but mostly vendor-produced: randomised trials run by Microsoft found that its AI assistant improved the speed and accuracy of both novice and professional analysts, a language model detected 97.25% of 381 phishing and legitimate emails without false positives in one study, and in a public challenge the seven finalist systems found 54 planted software vulnerabilities and patched 43. Across the EU economy only 3.9% of enterprises used AI for ICT security in 2025, against 19.5% in the software sector and under 3% in retail, logistics and construction. An industry survey linked extensive security AI and automation to breaches that cost about US$1.9 million less, but it is correlational. We expect AI-assisted triage and automated social engineering to be routine on both sides by 2028, defensive agents and automated patching to mature in 2029–2032, and the balance between attackers and defenders to remain the open question. Originality. The article sets randomised and field evidence on attack and defence side by side, is explicit that most defensive evidence is produced by vendors, and uses economy-wide adoption data to show how uneven defensive use of AI is.