Cyber security has entered a new category: Why AI-era threats require a defence system, not more tools

Cyber Insight CEO Deon Smal highlights the shift towards AI-native cyber security, where connected security controls, agentic AI, global threat intelligence and human expertise work together to help organisations detect, investigate and respond to cyber threats faster and with greater context.

---

As artificial intelligence reshapes the speed and sophistication of cyber attacks, organisations are being forced to rethink a long-standing approach to cyber security: adding another tool every time a new threat emerges.

Cyber Insight says the next phase of cyber security will be defined not by how many security products an organisation owns, but by how effectively its security environment can share intelligence, co-ordinate decisions and respond as one.

This shift is reflected in the introduction of the Sophos AI-Native Cybersecurity Defense System, an open cyber security architecture designed to bring security products, services, data sources, AI and human expertise together within a connected defence.

At the same time, Sophos Central is evolving into Sophos Fusion, providing the management environment through which customers and partners experience this broader defence system.

“Cyber security has spent years becoming more specialised, but in the process many organisations have also become more fragmented,” says Deon Smal, CEO of Cyber Insight. “Endpoint, identity, e-mail, firewalls, cloud and network security may all be protecting different parts of the business, but attackers do not operate within those boundaries. They move across them.”

The challenge facing modern security teams is increasingly one of speed and co-ordination.

An attacker gaining access through a compromised identity, for example, may rapidly move between applications, endpoints, cloud services and network resources. In a fragmented environment, each security tool may identify part of that activity independently, leaving security teams responsible for manually correlating alerts and determining whether they form part of a larger attack.

AI-enabled attacks have the potential to compress that timeline even further.

Sophos' AI-Native Cybersecurity Defense System is designed around a different model. Endpoint, firewall, e-mail, cloud, network, identity and other security control points contribute telemetry into a shared security context. More than 500 third-party integrations can also contribute data, allowing organisations to build on existing technology investments rather than treating cyber security as an all-or-nothing replacement exercise.

At the centre of the architecture is Synchronized Security, which enables information identified by one security control to inform co-ordinated action elsewhere in the environment.

“Detecting something suspicious is only the beginning,” says Smal. “The real value is what happens next. If an identity system identifies a compromised account, the endpoint, firewall, network and other relevant controls should not have to wait for someone to manually connect the dots before the organisation starts responding.”

The traditional security operations centre has typically relied on a sequential process.

An alert is generated. An analyst reviews it. Additional information is gathered. The analyst determines whether the activity is malicious and then decides what action should be taken.

Experienced human judgment remains essential, but the challenge is the time involved.

Modern attacks may move across multiple systems while analysts are still trying to understand the first suspicious event. As attackers increasingly use automation and AI, relying on manual investigation at every stage risks creating a widening speed gap between attack and response.

Cyber Insight believes this is where the role of AI within security operations becomes particularly important.

“The objective is not to remove the analyst,” says Smal. “It is to remove unnecessary delay. Machines are extremely good at processing large volumes of information, identifying relationships and performing repetitive investigative work quickly. Human analysts remain essential where context, judgment and accountability are required.”

One of the significant developments within the Sophos AI-Native Cybersecurity Defense System is the use of agentic AI.

Rather than simply presenting analysts with additional information, agentic AI can perform elements of detection, investigation and response within boundaries established and calibrated by security specialists.

This allows security activity to progress at machine speed while maintaining human oversight.

AI can help correlate signals, investigate suspicious behaviour and initiate defined response actions, while analysts remain responsible for complex decisions, escalation and outcomes.

Sophos says intelligence is continually strengthened across more than 625 000 organisations worldwide, allowing detection and response capabilities to benefit from threats observed across a much broader defended environment.

For Cyber Insight, this represents an evolution in how human expertise and technology should work together.

“The discussion should not be framed as AI replacing security analysts,” Smal explains. “The better question is how we use AI to perform the work machines can do at a speed humans cannot, while allowing experienced analysts to concentrate on decisions where context, judgment and accountability matter.”

This shift is also reflected in the evolution of Sophos Managed Detection and Response (MDR) and Sophos XDR Powered by Secureworks.

Sophos MDR has been expanded with capabilities including agentic threat hunting and additional integrations, while Sophos XDR incorporates enhanced AI-assisted workflows and capabilities from Secureworks. 

The broader goal is to combine security telemetry, automated investigation, threat intelligence and human-led oversight within a more co-ordinated response model.

For organisations using managed security services, this can also help address another challenge: access to specialist cyber security skills.

Building and maintaining a fully staffed, round-the-clock internal security operations centre requires significant expertise, technology and operational capacity.

At the same time, cyber attacks do not operate according to business hours.

Cyber Insight combines Sophos' global capabilities with its local security operations centre, providing South African organisations with access to international threat intelligence alongside locally based security expertise.

“Technology can identify activity at enormous speed, but understanding the organisation you are protecting still matters,” says Smal. “That is where the combination of global intelligence, AI-driven capability and local human expertise becomes particularly valuable.”

Cyber Insight cautions that faster response should not simply mean automating every security decision.

Blocking an identity, isolating an endpoint or disrupting a connection can be critical during an attack, but security actions can also affect legitimate business operations.

This means organisations need clearly defined boundaries around what should happen automatically and where human intervention is required.

AI can handle scale.

Automation can execute established actions.

Human experts remain responsible for setting those boundaries and applying judgment when technical actions could have wider business implications.

“The strongest security operations model is not the one with the most automation,” says Smal. “It is the one that understands what should be automated, what requires human judgment and how the two work together when an incident is unfolding.”

The move towards connected defence is particularly relevant in the South African market, where many organisations face a combination of growing cyber risk, constrained security resources and increasingly complex IT environments.

Adding more products can create additional licence costs, dashboards, alerts and administrative requirements without necessarily improving the organisation's ability to respond.

At the same time, organisations increasingly require continuous monitoring and rapid response without necessarily having the resources to build those capabilities entirely in-house.

This makes integration, automation, managed detection and access to specialist expertise increasingly important.

“Security complexity ultimately becomes a business problem,” says Smal. “A company can invest heavily in cyber security and still carry unnecessary risk if its technologies, people and processes are operating in isolation.”

Cyber Insight's approach combines local cyber security expertise and managed security capabilities with Sophos' global technology and threat intelligence, helping organisations assess how existing security investments can be integrated into a broader and more responsive defence strategy.

The objective is not simply to deploy more security.

It is to create an environment capable of protecting, detecting, investigating and responding as one connected system.

As cyber attacks become faster and more automated, organisations will increasingly need to measure not only whether they can detect a threat, but how much time passes between the first sign of an attack and meaningful action being taken.

“The future of cyber security is not human versus AI,” concludes Smal. “It is about combining machine-speed detection and response with experienced human judgment, within a security environment that operates as one rather than as a collection of disconnected tools.”

Local experts. Global intelligence. Trusted protection.