Security’s existential threat: Pragmatic defence through frontier and zero-day risk

C-Suite Exchange: AI-driven cyber threats are forcing leaders to rethink defense

“I alternate between, hey, look at how much fun we're going to have with AI and then selling all of my worldly possessions and moving to the mountains and living in a cabin off grid.” — James Tucker, Head of CISO, Zscaler.

The cyber threat landscape is evolving faster than many organisations’ ability to defend against it. As frontier AI models increase the speed, scale and sophistication of attacks, security leaders are confronting a difficult reality: established approaches to vulnerability management, patching and operational resilience may no longer be enough.

At a recent C-Suite Exchange, held in partnership with Zscaler, senior technology and security leaders came together to examine what pragmatic cyber defence looks like in an era of persistent zero-day vulnerabilities and AI-enabled threats.

Moderated by Doug Drinkwater, Editorial and Strategy Director at HotTopics, the discussion explored the pressures created by legacy infrastructure, constrained budgets and skills shortages, as well as the challenge of communicating rapidly evolving risks to the board.

Yet one of the most striking aspects of the conversation was the lack of consensus over whether AI represents an entirely new security paradigm at all. While some argued that the industry has entered a fundamentally different era, others saw AI primarily as an accelerator of problems security has been dealing with for decades already.

Revolution or acceleration?

An opening poll at the beginning of the CSE asked the participants whether AI-driven or AI-discovered attacks require a fundamental shift in security operating models. The dominant response sat somewhere in the middle: security processes and internal skill sets need to evolve, but organisations should not necessarily throw out established approaches every time a new technology emerges.

James Tucker, Head of CISO at Zscaler, explained that his own perspective shifted after seeing what AI could accomplish from an offensive security standpoint.

“It really did change my perception of what AI means to both defence, but specifically, right now, offence,” he said, highlighting AI’s capabilities and its ability to “chain together lower-level vulnerabilities to achieve significant results.”

For Tucker, that raises questions about everything from how security teams triage events to “the order and method in which we patch things.”

For some of the other executives in the discussion, however, the implications were less revolutionary. One participant argued that security still comes down to the “fundamentals and playing the fundamentals well,” including patch management, vulnerability management, general risk management and security operations.

One executive offered a pretty memorable analogy for AI’s impact: “It’s not making me a better coder - it’s making me a faster, mediocre coder.” It was argued that the same logic could be applied to attackers. AI may not automatically turn an inexperienced threat actor into an elite hacker, but it is sure to improve their chances of another successful attack.

Identity and data become the new perimeter

The acceleration of AI adoption inside businesses creates another challenge. Unlike previous technological transformations, generative AI requires relatively little specialist knowledge to begin using.

“The pace of adoption is exponentially faster than anything I’ve seen before,” one executive said, pointing out that employees no longer need to learn a programming language to interact with sophisticated technology. They can simply communicate with AI normally, in their native language. That accessibility is helping organisations pursue productivity and efficiency gains, but it is simultaneously expanding the security challenge.

One argument emerging from the discussion was that organisations increasingly need to think beyond the usual traditional network perimeter and instead concentrate on two critical assets: identity and data.

Agentic AI makes this particularly important. A non-human identity may require many of the same controls as a human identity, but organisations could soon be managing many more of them, and they will have to operate at a greater speed as a result. Double the effort. “I need to secure my data primarily,” one executive said.

Tony Ferguson, CISO in Residence at Zscaler, agreed that speed is becoming a defining feature of the new landscape.

“Everything is faster, that’s for sure,” he said. “We’re going to have to automate and we’re going to have to trust, unfortunately. We’re going to have to put our trust into some of these technologies to protect us.”

The basics are back, although they never really left…

For the entire discussion around frontier AI, a recurring theme was surprisingly traditional; organisations still have unfinished cybersecurity homework.

Reducing the attack surface, implementing Zero Trust, strengthening authentication, retiring legacy systems and improving vulnerability management are hardly new recommendations. “You know we keep talking about the basics,” Tucker said. “Everybody knows we need to reduce our attack surface.”

Security teams have been “arguing until we’re blue in the face” for many of these improvements for years, he added. The current focus on AI could therefore provide CISOs with an opportunity to secure investment for foundational projects that have historically struggled to gain board approval.

Moderator Doug Drinkwater questions whether security leaders should capitalise on the heightened attention surrounding AI to accelerate modernisation. He pointed to technology leaders who have successfully positioned existing infrastructure and data projects within the context of AI, helping them attract renewed board attention and investment.

Is cash becoming part of the attack surface?

Perhaps the most provocative question of the CSE came from Tucker: could the economics of AI themselves become a security vulnerability?

AI capability scales partly according to access to compute, infrastructure, models and data. If an attacker can invest significantly more in offensive AI capabilities than an organisation can spend defending itself, Tucker questioned whether financial resources effectively become another dimension of the attack surface.

“If we assume equal models and the bad guy is spending a million dollars on their offensive model, and we as defenders are spending half of that on our defensive model, does that mean cash is an attack surface?” he asked.

Now apply that idea to supply chains. “If any of that is true, then the next 12 months are going to be: let me go find all of your third parties and attack them because they will spend less than you on security,” Tucker added.

Other executives agreed that this behaviour already exists. Attackers do not necessarily need to compromise a well defended global enterprise directly. Instead, they can identify smaller suppliers holding valuable information or privileged connections but operating with significantly fewer security resources.

Third and fourth-party risk moves up the agenda

That concern pushed third and fourth-party risk towards the centre of the conversation.

Organisations may have significant visibility over their own IT environments, controls and data practices. The picture becomes less clear once information moves through an increasingly interconnected ecosystem of suppliers, platforms, partners and more.

“The first thing we have to do is get a handle on that data, classify it and categorise it,” one risk leader argued, and the challenge is not new. Supply chain vulnerabilities have been exploited for years. What AI changes is the ability to discover connections and vulnerabilities at speed, potentially paving an easier path for attackers that requires less effort on their part.

Ferguson similarly warned that attackers do not always need to target the largest organisation directly. “You don’t need to go after the big corporate,” he said. “Just go after the third-party that’s not protected.”

At the same time, the rapid increase in AI agents adds another layer to this dimension. As organisations give autonomous systems greater access and more responsibility, Ferguson argued that security teams need to consider both how external attackers are using AI, and also how their own agents are controlled.

“We always have to think about how we secure our agents and how we secure all this,” he said.

We need to start favouring visibility over velocity

So, where indeed should organisations begin?

Despite the debate over whether AI represents a revolution or an acceleration, the closing discussion returned to the topic of visibility.

The participants argued that organisations need to understand what assets they have, where their data sits, which identities can reach it, where AI is already being used, and what their external attack surface looks like.

“If you don’t know what you’ve got, you don’t know the rest,” Ferguson said.

That visibility needs to extend to shadow AI, non-human identities and third parties as much as conventional infrastructure. Only then can security teams access where controls need to change and give boards the big picture of their exposure.

The ultimate lesson from the session was that AI is putting extraordinary pressure on weaknesses organisations already understand while introducing capabilities whose longer-term consequences remain difficult to predict. As attackers become faster, identities multiply and digital supply chains grow more interconnected, the margin for neglecting the basics gets much smaller.

For CIOs and CISOs, the task now is to combine those fundamentals with the speed, visibility, and automation demanded by a rapidly changing threat landscape.

The threats discussed in this session are already visible at scale. The ThreatLabz 2026 AI Security Report analyses nearly one trillion AI/ML transactions to reveal how enterprise AI adoption is reshaping the threat landscape, and what security leaders can do about it. 

Trust and Transformation

Created in partnership with Zscaler, Trust and Transformation brings senior financial services leaders together to strengthen resilience, enable secure innovation and accelerate transformation through zero trust. Explore secure transformation through dedicated conversations, events and experiences: