Artificial intelligence is changing the economics of cybersecurity. For attackers, increasingly capable models can help identify vulnerabilities, write code and exploit weaknesses at a speed that would previously have required considerably more expertise and resources. For companies, the same technology promises to accelerate detection, patching and incident response.
This double-edged transformation was at the heart of the discussion on AI and digital resilience at the Bloomberg Luxembourg Investment Summit, bringing together Pascal Bouvier, Managing Partner and Co-Founder of Middlegame Ventures; Frederiek Van Holle, Chief Technology and Operations Officer at Indosuez – DPAM; and 
The cost of attacking is collapsing
For Pascal Steichen, one of the most immediate changes is speed. AI models can scan software and identify vulnerabilities much faster than before, particularly when dealing with open-source software, where the underlying code is publicly available. That matters because companies have traditionally needed considerable time to address known vulnerabilities. Pascal Steichen pointed out that the average time required to fix them can reach around 250 days.
If attackers can now discover and exploit those vulnerabilities much faster, defenders need to accelerate too. “The security risks are there a long time. If now this is accelerating, we really have to look into accelerating the defence,” he said. AI could therefore become part of the answer, combining automated capabilities with human cybersecurity expertise.
Pascal Bouvier highlighted another fundamental shift: the economics of cybercrime. “One of the best defences against cybersecurity breaches was not cybersecurity – it was the cost of it,” he said. AI is reducing that barrier.
People who previously lacked the technical expertise required to carry out sophisticated attacks can increasingly access tools capable of assisting them. The underlying cryptographic systems themselves may remain robust, Bouvier argued, but the people holding keys and interacting with those systems become more exposed. “The cost of attacking has collapsed,” he said.
AI agents create another layer of risk
The next challenge is already emerging inside companies. Businesses are beginning to move beyond chatbots towards AI agents capable not simply of generating answers, but of accessing tools, interacting with systems and completing tasks. That autonomy creates a different security problem. An AI agent given an objective can choose how to achieve it. Because its behaviour is probabilistic rather than fully deterministic, companies cannot assume that every action will follow exactly the path anticipated by its designers.
Pascal Steichen warned that agents do not possess human values or empathy. They receive an objective and seek to achieve it, potentially choosing routes that humans would not consider acceptable. That makes the challenge broader than traditional cybersecurity. Companies will increasingly need to think not only about protecting themselves against external attackers, but also about governing the behaviour of AI systems operating within their own organisations.
Not every process is ready for agents
That uncertainty explains why financial institutions remain cautious about deploying agents in critical processes. Frederiek Van Holle stressed that the probabilistic nature of AI models needs to be understood as a risk characteristic rather than something that can simply be eliminated through better engineering. For now, the most effective applications tend to involve highly structured tasks where the desired outcome can be clearly defined.
Coding is a particularly strong example because programming languages provide a highly structured environment. Repetitive tasks with measurable outcomes are similarly well suited to automation. Cybersecurity patching could therefore become a natural use case.
An agent could identify that a patch is available and apply it continuously and much faster than relying exclusively on human cybersecurity specialists. Humans would not necessarily disappear from the process. Their role would move upwards: deciding priorities, supervising agents and intervening where judgement is required.
The security operations centre will change
This evolution could fundamentally reshape companies' Security Operations Centres, or SOCs. Today, security teams spend significant amounts of time monitoring systems, analysing alerts and trying to identify abnormal behaviour. AI can automate part of that work. Pascal Steichen expects machines increasingly to process the large volumes of technical information generated by cybersecurity systems, leaving humans to concentrate on higher-level decisions.
That could also help address a longstanding problem: the gap between technical cybersecurity teams and the businesses they protect. A technically serious vulnerability is not necessarily a critical business risk if the affected system does not support an essential service. Conversely, a relatively narrow technical incident can be extremely important if it affects a critical business process.
AI could help security teams process technical information more rapidly while allowing human specialists to spend more time assessing its business significance. “The technical teams and the business teams need to get even closer,” Pascal Steichen said.
Cybersecurity may need a broader definition
AI agents could ultimately force companies to reconsider what cybersecurity itself covers. Traditional security has largely focused on protecting systems from external threats. But organisations will increasingly operate their own internal agents, deploy agents for customers and interact with agents controlled by third parties.
Those systems will need identities, permissions and access to corporate resources. Companies will therefore have to know not only who has access to a system, but increasingly which agent does, what that agent is authorised to do and what it actually does once access has been granted. Observability will consequently become essential.
Organisations will need infrastructure capable of tracking an agent throughout a workflow, in much the same way that traditional systems use logging – but in an environment where the workflow itself can evolve dynamically. Security will therefore increasingly overlap with AI governance, identity management and operational risk.
No single AI model will solve cybersecurity
The panel was also sceptical that one universal cybersecurity model would emerge. Cybersecurity covers too many different activities and skills for a single specialised AI system to handle every aspect effectively, Pascal Steichen argued. Instead, the future is more likely to involve several specialised models working together: some focused on software vulnerabilities, others on detection, monitoring or other security functions.
That reinforces the need for governance. As AI becomes more capable, the challenge will not simply be deploying increasingly powerful models. Companies will have to decide where automation is appropriate, how agents should be supervised and where humans must remain in control. One year from now, Pascal Steichen said he would not be surprised if cybersecurity challenges had continued to increase.
A more positive surprise would be seeing financial institutions successfully deploy agents while keeping their security risks under control. AI is therefore creating an unusual race: attackers can move faster and more cheaply, but defenders are gaining the same technological advantage. The question for companies is which side can learn to use it faster.
