Picture Oprah’s famous giveaway moment: “YOU get a car! YOU get a car! EVERYBODY GETS A CAR!”
Now picture me, after following recent developments in cybersecurity, shouting instead:
“YOU get defensive AI! YOU get defensive AI! EVERYBODY GETS DEFENSIVE AI!”
I know. Less fun than getting a new car. But considerably more important if you own a business.
And I mean it.
I’m becoming convinced that AI-powered cybersecurity defenses are going to be non-negotiable throughout the technology stack, not just another feature vendors can charge extra for or brag about in their marketing.
The reason is pretty straightforward: AI is changing how quickly and effectively vulnerabilities can be discovered. That’s fantastic when the people finding them are trying to fix them. It’s considerably less fantastic when they’re trying to exploit them.
You don’t need to understand the technical details of the latest software vulnerability. But you do need to know whether the companies responsible for protecting your business understand them.
If you outsource your IT or cybersecurity, here are three questions worth asking your provider:
You don’t need a technical lecture in response. You need to know someone competent is paying attention, making informed decisions, and taking responsibility.
And if your provider doesn’t have good answers yet, that’s a conversation worth having.
Now, here’s what’s happening in cybersecurity that makes me think these questions are becoming increasingly important.
In October 2026, researchers disclosed critical vulnerabilities in PHP, a programming language used by an enormous number of websites and web applications.
The research, known as PHP2Shell, demonstrated how weaknesses in this widely deployed software could potentially allow attackers to execute malicious code on affected systems.
And no, this wasn’t simply a WordPress problem. PHP is used throughout the web, including in applications and frameworks that businesses depend on every day.
What makes this particularly interesting is how the vulnerabilities were discovered. Advanced AI-assisted security research played a role in identifying serious weaknesses in software that has been around for decades. Researchers involved in OpenAI’s Patch the Planet initiative and independent researchers at Wiz contributed discoveries and coordinated with PHP’s maintainers and other security organizations to help get protections in place.
The important point isn’t that AI magically discovered something humans couldn’t. It’s that AI is becoming a powerful tool for accelerating work that has traditionally required substantial time and specialized expertise.
That’s a good thing when it’s being used by security researchers who responsibly disclose vulnerabilities and work with vendors to fix them. But those capabilities don’t belong exclusively to the good guys.
The same advances that make AI useful for defensive security research can also make it easier for attackers to investigate software, identify weaknesses, and develop ways to exploit them. And as these capabilities improve, the advantage of having a large team of highly skilled researchers may begin to shrink.
That changes the economics of cybersecurity.
I’ve spent years working in technology and operations, including managed IT services, and I’m now involved in building a cybersecurity company. So I pay close attention to how technology vendors and service providers are responding to AI.
And some of the announcements leave me wondering whether we’re having the right conversation.
I don’t mean another shiny new feature in your endpoint protection that says, “Look what I can do! We can tell you which AI tools your employees are using!” Like that’s something new and fancy to brag about. If you remember Stuart from MADtv, you know exactly how I’m hearing some of these announcements in my head.
Now, understanding which AI tools employees are using isn’t worthless. Businesses absolutely need visibility into where sensitive information is going and what new risks employees might be introducing. But that’s a fairly small piece of a much bigger problem.
We’re watching AI-assisted research expose serious weaknesses in foundational software. We’re seeing increasingly sophisticated opportunities for attackers to automate portions of their work. And we’re facing a future in which the speed of discovering and exploiting vulnerabilities could exceed what many organizations can manage using traditional processes alone.
Against that backdrop, telling me your security software can identify who used ChatGPT is not particularly impressive. I want to know what you’re doing about the threats themselves.
When I say everybody gets defensive AI, I mean it needs to become part of how the systems we rely on are built, tested, operated, monitored, and protected.
Software developers need better ways to identify vulnerable code and dependencies before attackers exploit them. Cloud and infrastructure providers need to recognize suspicious activity, insecure configurations, and emerging attack paths. Identity systems need to detect behavior that doesn’t fit established patterns, even when an attacker has valid credentials.
Endpoint protection, email security, network monitoring, and security operations all need to evolve. Vulnerability management needs to become better at identifying which weaknesses actually create meaningful exposure, rather than simply producing longer lists of findings.
And these capabilities need to work together. A dozen products with disconnected AI features don’t automatically add up to an effective defensive system. Information has to move between them. Threats have to be evaluated in context. Responses need to be coordinated, with appropriate controls and human oversight.
That’s why I’m increasingly interested in what technology vendors are doing to strengthen the defensive capabilities of their own products. Are they using advanced techniques to look for weaknesses before someone else finds them? Are they testing their defenses against evolving attack methods? Can they demonstrate how their systems detect and respond to emerging threats? And when a serious vulnerability is discovered, can they move quickly enough to help protect the businesses depending on them?
Those questions are considerably more important to me than whether they’ve added an AI button to their dashboard.
What interests me about Patch the Planet isn’t just the discovery of serious vulnerabilities. It’s the larger problem the initiative is trying to address.
As AI makes vulnerability discovery faster, the rest of the cybersecurity ecosystem has to keep up. Researchers still need to validate what they’ve found. Software maintainers need to develop fixes. Infrastructure and security providers may need to prepare protections. Organizations need to understand their exposure and deploy updates.
Finding vulnerabilities faster doesn’t accomplish much if we can’t fix them faster, too. The PHP2Shell response involved coordination among researchers, software maintainers, and security providers before public disclosure. That’s the kind of cooperation we’ll need more of as the pace of discovery accelerates.
But consider what happens once an advisory reaches an ordinary business. A growing home care agency, construction company, professional services firm, or other service business probably doesn’t employ a team of security researchers. It may have an outsourced IT provider, a website company, several cloud software vendors, and a cybersecurity product or two.
Someone still has to connect the dots. Which systems are affected? Who is responsible for updating them? Does the organization need to take immediate action? Have the fixes actually been applied? And has anyone explained the business risk to leadership?
That’s where the quality of your technology partners becomes especially important. A business owner shouldn’t have to discover a major security development from a podcast a week later and wonder whether anyone responsible for their systems knows about it.
I don’t expect every MSP or cybersecurity provider to develop its own AI vulnerability research platform. That would be unrealistic.
I do expect providers to understand how the threat landscape is changing, stay informed about significant developments, and challenge their technology vendors to demonstrate meaningful defensive capabilities. That includes asking harder questions of vendors throughout the stack, not just accepting whatever new AI functionality appears in a product announcement.
It also means developing the ability to turn emerging information into useful decisions for clients. When a major vulnerability is disclosed, a provider should be able to determine whether its clients are potentially exposed, identify the relevant systems and vendors, recommend appropriate action, and verify remediation.
If a threat doesn’t apply, that’s useful information too. Tell the client why. And when something is still uncertain, explain what’s known, what’s being investigated, and when an updated assessment can be expected.
This is where AI can help security professionals become dramatically more effective. It can accelerate research, assist with analyzing large amounts of technical information, correlate signals across systems, and help prioritize work. But the value isn’t in producing a faster summary of a security advisory. The value is in reaching a sound conclusion and doing something useful with it.
That still requires expertise, judgment, communication, and accountability.
I don’t believe AI eliminates the need for strong security fundamentals. Patch management, secure configurations, access controls, backups, monitoring, and experienced professionals aren’t going anywhere. If anything, they’re becoming more important.
But I do believe that as AI makes cyberattacks faster, more sophisticated, and easier to scale, AI-powered defenses will become increasingly necessary. And I think we should stop treating that as something exceptional.
Over time, I expect businesses will evaluate defensive AI capabilities the same way they evaluate other essential security requirements. Not as an exciting add-on, but as part of what competent technology providers are expected to deliver.
The vendors that understand this will invest in meaningful defenses throughout their products and services. The providers that understand it will learn how to evaluate those capabilities, integrate them, and translate emerging threats into timely action for their clients. The rest may continue announcing that their software can identify which AI chatbot an employee opened.
Meanwhile, the threat landscape isn’t waiting.
Three: How are you keeping up with threats discovered using AI, and are you proactively evaluating emerging risks or mostly waiting for vendor alerts? What AI-powered defensive capabilities are actually protecting our business, meaning detecting vulnerabilities, identifying suspicious activity and responding to threats rather than just monitoring which AI tools employees use? And how will you know if we’re affected by a major new vulnerability, and what will you do about it? You should expect an assessment of your exposure, a recommendation, timely action and confirmation that the issue was addressed.
No. PHP2Shell is research disclosed in October 2026 showing how weaknesses in PHP, a programming language used throughout the web, could potentially allow attackers to execute malicious code on affected systems. PHP is used in applications and frameworks that businesses depend on every day, not just WordPress. AI-assisted security research played a role in finding the vulnerabilities, and researchers coordinated with PHP’s maintainers and other security organizations before public disclosure.
No. Patch management, secure configurations, access controls, backups, monitoring and experienced professionals aren’t going anywhere, and they’re becoming more important. But as AI makes cyberattacks faster, more sophisticated and easier to scale, AI-powered defenses will become increasingly necessary, and businesses should come to expect them as part of what competent technology providers deliver rather than as an exciting add-on.
So yes, everybody gets defensive AI. At least, everybody who intends to keep up.
Further reading: OpenAI: Coordinated disclosure of critical vulnerabilities · Calif Research: PHP2Shell technical analysis · Wiz: PHP2Shell research · Patch the Planet
Related: The Surge in Suspicious Emails Is Just the Tip of the Iceberg looks at how agentic AI is changing the speed, scale and sophistication of cybercrime.
Adapted from my Practical AI for Business newsletter on Substack.
If your IT or cybersecurity provider doesn’t have good answers yet, that’s a conversation worth having. For managed IT and cybersecurity support, our sister company, Signal Point Cyber Co, handles infrastructure, security, and ongoing IT support for North Texas service businesses.