You’ve called AI a “double agent” in cybersecurity. What do you mean by that?
The way I see it, AI isn’t just a tool, it’s a participant in the system. On one end, it’s amplifying the defender’s reach: automating detection, shrinking response time and surfacing anomalies that would take humans days to find. But on the other end, the same architectures, the same models, are being used to craft deception at scale.
Both sides, red and blue, are training on the same data and building on the same cloud platforms. That’s what makes this moment so different from any previous security shift. We’re not looking at asymmetric warfare anymore; we’re looking at mirrored capabilities. The new battleground is no longer the firewall, it’s the feedback loop.
Let’s start with the positive. How is AI strengthening security?
Historically, cybersecurity was built on a simple premise: define the bad, detect it and block it. That logic worked until attackers became faster than your rules could adapt.
AI breaks that loop. It shifts defense from reactive pattern-matching to behavioural modelling. Instead of waiting for a known signature, AI learns what ‘normal’ looks like across millions of identity, network and application events, and then flags whatever deviates.
That means defense now operates in continuous time. It’s less about preventing a known threat and more about detecting a subtle drift. Be it a login from the wrong device, or a transaction just outside a customer’s usual range. You could call it the move from rules to rhythm.
But AI isn’t magic. It decays unless it’s retrained. So, our challenge has moved from what to detect to how fast we can teach the system to evolve.
And yet, attackers seem to be keeping pace. How are they adapting?
Attackers have learned one of the oldest truths in tech; user trust is the easiest layer to exploit. Generative AI makes that exploitation effortless.
Phishing, for instance, used to fail because humans could spot broken grammar and fake urgency. Now, attackers use large language models to write like your colleague, mimic tone and even conduct live chats that feel legitimate.
So, the paradigm shifts again. The new mantra is: trust nothing, authenticate everything. Every message, every request, every system call must be verified, not assumed. That’s where identity and context become more important than content.
What used to be a ‘human problem’ or gullibility, has now become a system design problem. If humans are fallible, then the system has to compensate.
Financial fraud has always been a major issue in fintech. How is AI changing the game there?
Fraud detection is one of the clearest examples of AI as leverage. The system ingests thousands of behavioural and contextual signals such as device fingerprints, IP reputation, transaction timing, velocity, spending context and builds a dynamic profile of how legitimate users behave.
That allows us to spot fraud before it completes, not after. But the catch is: the same intelligence is available to the attacker. They can now simulate ‘normal’ behaviour, forge transaction histories, and even fake voices on customer service calls.
So the game isn’t about building perfect detection, it’s about making fraud unprofitable. When you raise the cost of deception and lower the return, the economics start favouring the defender.
At Deriv, we measure this constantly, false positive rates, manual review effort, fraud losses versus volume. In this model, AI isn’t a silver bullet; it’s an amplifier of decision efficiency.
You’ve described this as an “arms race”. Can you elaborate?
Every defensive breakthrough creates its own countermeasure. You train a model to detect anomalies; attackers train theirs to generate normal-looking ones. You harden authentication; they automate the appearance of legitimacy.
What’s emerging is AI-on-AI warfare, where systems are learning to detect and deceive each other in real time. It’s no longer theoretical; it’s happening in the open, at scale.
Defenders now have to red-team not just their own models, but the AI systems built on top of machine-learning and large-language-model foundations, whether developed internally or onboarded from vendors. Each layer adds capability, but also opacity. Every dependency can drift, decay or be exploited.
Security models now behave like live software. They need versioning. They need rollback plans. They need telemetry that tracks detection quality as closely as uptime. Drift is failure. Delay is a breach.
This is the new frontier. Machine-speed adversaries demand machine-speed governance.
For fintechs, balancing innovation and resilience is tough. How do you manage that trade-off?
Speed and security have always been at odds, but that tension is productive and forces discipline. The worst mistake is assuming security slows innovation. In reality, when done right, it enables innovation by making risk predictable.
The principle is simple: security must live in the design, not in the audit. AI features need the same threat-modeling rigour we’d give to payment systems where we classify the model’s risk, limit its data exposure, and build human oversight for high-impact decisions.
We still rely on traditional guardrails such as MFA (Multi-Factor Authentication), zero-trust, adaptive authentication, but AI lets us scale them intelligently. In short, resilience isn’t about resisting change; it’s about making sure every change is survivable.
Despite all this technology, you’ve said humans remain the weakest link. Why?
Because trust exists outside the stack. You can secure systems; you can’t fully secure psychology. Attackers know that. They don’t need to break your encryption if they can convince someone to share the key.
AI amplifies this risk by lowering the cost of persuasion. Deepfake calls, fake executive emails and cloned chat identities all exploit the same flaw of human instinct to trust authority and urgency.
So the fix isn’t purely technical; it’s cultural. Training, simulation and awareness not as one-off events, but as continuous reinforcement loops. Technology can protect systems. Only education can protect judgment.
Looking ahead, where do you see the AI-cybersecurity battle heading?
The line between offense and defense will keep blurring. Attackers will personalise at scale; defenders will atomise detection down to the micro-signal.
But the future isn’t hopeless, it’s adaptive. The winners will be the ones who treat AI systems as living entities that need oversight, governance and tuning. That’s why frameworks like the NIST AI RMF or ISO/IEC 42001 matter as they turn chaos into structure.
Ultimately, cybersecurity has always been about one thing: trust. AI just changed how that trust is earned and defended. It’s no longer a matter of walls and locks; it’s about feedback loops, governance, and speed. AI raised the stakes, however, leadership decides the outcome.
