{"id":8718,"date":"2026-07-13T07:00:00","date_gmt":"2026-07-13T07:00:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=8718"},"modified":"2026-07-13T07:00:00","modified_gmt":"2026-07-13T07:00:00","slug":"can-ai-narrow-cybersecuritys-class-divide","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=8718","title":{"rendered":"Can AI narrow cybersecurity\u2019s class divide?"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

At Amazon Web Services (AWS), artificial intelligence is already compressing security work that once took months into minutes.<\/p>\n

In the old world, human red teams would find vulnerabilities, write reports, refine those reports, and eventually hand them to defenders, who would then begin building detections or fixes, Steve Schmidt<\/a>, chief security officer at AWS, tells CSO. That process could take \u201ctwo, four, six, eight, 10 months,\u201d Schmidt says.<\/p>\n

\u201cNow with proper application of AI, we can have the detections built for the problems the red team finds in 15 minutes-ish,\u201d he says. \u201cI think the outside is about four hours.\u201d<\/p>\n

That kind of workflow offers a glimpse of what AI could make possible for the most sophisticated security organizations: AI agents testing systems, other agents generating defenses, and human security engineers validating results and refining the feedback loop.<\/p>\n

But it also raises a more uncomfortable question for the rest of the cybersecurity industry: What happens to organizations that cannot build anything close to that?<\/p>\n

The concern has become significant enough that the Trump administration recently directed<\/a> agencies to expand access to AI-enabled cybersecurity capabilities for resource-constrained organizations, including rural hospitals, community banks, and local utilities.<\/p>\n

The order reflects a growing fear that AI could deepen a divide that has existed in cybersecurity for years: the divide between organizations with money, expertise, and engineering depth, and those struggling to keep pace with basic security demands.<\/p>\n

Yet security leaders and practitioners suggest the impact of AI will be more complicated than a simple widening gap. Some experts say AI is merely adding a new layer to a long-standing security poverty problem. Others argue AI could democratize capabilities once reserved for elite organizations. Still others see today\u2019s divide as real, but potentially temporary, as models become cheaper, more open, and easier to run.<\/p>\n

The class divide was already here<\/h2>\n

For Matt Warner<\/a>, co-founder and CTO of Blumira, the premise that AI is creating a cybersecurity class divide misses a key point: The divide already exists.<\/p>\n

\u201cI would go even a step further and say that there has been a class divide for the last 10 to 15 years,\u201d Warner tells CSO.<\/p>\n

What AI changes, he argues, is not necessarily the existence of the divide but how stark it becomes. Larger organizations have money, people, and time to experiment with AI. Smaller organizations often do not.<\/p>\n

\u201cThe big differences that we\u2019re seeing, especially from where we sit in the world, is the difference is getting starker in having the resources to leverage AI and the time to leverage AI more than anything else,\u201d Warner says.<\/p>\n

That distinction matters because many smaller organizations are already overwhelmed. Warner pointed to resource-constrained local governments and small or midmarket organizations that are still far behind large enterprises in basic IT and security maturity.<\/p>\n

\u201cI can find you a county in Michigan with two IT people for 2,000 employees,\u201d Warner says. \u201cThose people don\u2019t have time to leverage AI and even learn how to use AI because they\u2019re mostly just trying to put out fires.\u201d<\/p>\n

That problem is not unique to AI. Smaller organizations have long struggled to patch systems, prioritize vulnerabilities, monitor environments, and respond to incidents with limited staff. AI may help eventually, but only if those organizations have enough capacity to adopt it.<\/p>\n

Wendy Nather\u2019s framework gets an AI layer<\/h2>\n

Anton Chuvakin<\/a>, security advisor in the office of the CISO for Google Cloud, sees the AI divide as part of a much older problem.<\/p>\n

\u201cI feel like it sends me back to when Wendy Nather<\/a> invented the security poverty line,\u201d Chuvakin tells CSO, referring to Nather\u2019s 2011 concept<\/a> describing organizations that lack the money, expertise, capability, or influence to implement effective security.<\/p>\n

Chuvakin is skeptical that AI fundamentally changes that model. \u201cI don\u2019t think AI necessarily breaks that model,\u201d he says. \u201cI think it just adds another dimension.\u201d<\/p>\n

Cybersecurity has always been shaped by unequal access to top talent, tools, and services, Chuvakin argues. Large organizations could afford better SIEM deployments, advanced DLP programs, threat hunters, application security experts, and incident response retainers. Smaller organizations often could not.<\/p>\n

AI may become another scarce resource, but Chuvakin cautions against overstating the role of model cost alone. In his view, the bigger structural issue may be talent<\/a> rather than tokens.<\/p>\n

\u201cPrices for people won\u2019t drop, but prices for LLMs may drop,\u201d he believes.<\/p>\n

That means the organizations with the greatest advantage may not simply be those that can afford the most expensive models. They may be the ones that can afford the people who know how to use them \u2014 and, as the frontier-access debate below suggests, that talent gap may prove more durable than any gap in model access itself.<\/p>\n

AI creates new costs \u2014 and new uncertainties<\/h2>\n

Nather herself, now senior research initiatives director at 1Password, sees AI affecting every dimension of the security poverty line: money, expertise, capability, and influence.<\/p>\n

The financial challenges are not limited to whether an organization can pay for an AI tool. In some cases, organizations that cannot afford enterprise licensing may end up making tradeoffs around privacy.<\/p>\n

\u201cIf an organization can\u2019t afford an enterprise license for the models they\u2019re using, then they can\u2019t keep their data private,\u201d Nather tells CSO. \u201cSo, they have to give up privacy because they can\u2019t afford privacy.\u201d<\/p>\n

That\u2019s a new twist on an old dimension of the poverty line: It\u2019s not just that under-resourced organizations lack a capability, but that the capability they can afford comes bundled with a risk wealthier organizations don\u2019t have to accept.<\/p>\n

Token-based pricing adds another problem: unpredictability<\/a>. \u201cAt this point, nobody knows how much they\u2019re going to burn in tokens at any given time,\u201d she says.<\/p>\n

That makes budgeting difficult for organizations that cannot absorb surprise costs. Nather also warns that usage-based pricing is controlled by providers and can change over time, leaving customers with limited leverage<\/a>.<\/p>\n

\u201cThe charging practice is in the hands of the providers, and they can change it at any time,\u201d she says.<\/p>\n

For organizations already operating below the security poverty line, that uncertainty could make AI adoption harder, even if the technology itself becomes more capable.<\/p>\n

Access to frontier models may be a temporary divide<\/h2>\n

Dave Baggett<\/a>, SVP\/GM of the security suite at Kaseya, agrees there is security class divide dynamic playing out today, particularly around access to frontier models.<\/p>\n

\u201cThere\u2019s definitely a haves and have-nots issue around Mythos specifically because most people don\u2019t have it,\u201d Baggett tells CSO. But he doesn\u2019t think the divide will have a long-term impact. Open-weight models, quantization, mixture-of-experts architectures, and increasingly powerful commodity hardware, he argues, are closing the gap faster than most people expect.<\/p>\n

While not every organization will build a frontier model, he says, more organizations may be able to run capable models locally or use cheaper systems that approximate what today\u2019s elite models can do<\/a>.<\/p>\n

\u201cWhat it says for finding vulnerabilities is at that point, open-source people can run this stuff,\u201d Baggett says. \u201cThen you\u2019re back to having a symmetrical opportunity where the defenders who are writing the open source can run the same tools the attackers would and have them fix the issues.\u201d<\/p>\n

His bottom line is that the divide may be real but short-lived. \u201cRight now, there certainly is a have, have-not schism, but it may not be there for long,\u201d Baggett says \u2014 a view Chuvakin shares, though he frames it in terms of the model market rather than open source specifically.<\/p>\n

\u201cI don\u2019t think it\u2019s the lowering prices example, but it\u2019s more like you\u2019re a top-tier model maker, I\u2019m a second-tier model maker. My model in a year would do what your model did a year ago,\u201d Chuvakin says.<\/p>\n

The real advantage is operational depth<\/h2>\n

Schmidt\u2019s description of AI use at AWS points to another kind of divide: not access to AI, but the ability to operationalize it.<\/p>\n

AWS uses multiple models for different tasks, Schmidt says. One model may discover vulnerabilities, while other models validate results or help build defenses. Humans remain accountable for evaluating what the systems produce.<\/p>\n

\u201cBecause we believe really strongly in human accountability for the use of AI from end to end, we still have humans take a look at what the systems come up with to determine whether they are reasonable and appropriate,\u201d he says.<\/p>\n

That workflow requires more than a model. It requires corporate data, secure infrastructure, feedback loops, security engineers, data scientists, and AI specialists who can work together.<\/p>\n

Schmidt also pushes back on the idea that running AI locally on powerful consumer hardware is a substitute for production-grade security infrastructure. \u201cOften the value of the model is also dependent on its proximity to data so that the model can ingest, use, and reason about data,\u201d he says. \u201cAs a security person, I do not want that to be on your laptop.\u201d<\/p>\n

Experimentation on a laptop is useful, Schmidt says, but it is not the same as a secure production environment.<\/p>\n

\u201cI want the data to be somewhere safe that I can control, that I can see, that I can reason about, not sitting on your laptop,\u201d he says. \u201cExperimentation in there, awesome. That\u2019s great. But it is not a production infrastructure component.\u201d<\/p>\n

That distinction may define the emerging AI security gap. Many organizations may be able to access AI tools. Far fewer may be able to safely integrate them into real security workflows.<\/p>\n

The democratization argument<\/h2>\n

Phil Venables<\/a>, a partner at Ballistic Ventures and former CISO of Google Cloud, takes the most optimistic view.<\/p>\n

Asked whether AI is widening the gap between well-resourced and under-resourced security organizations, Venables tells CSO, \u201cNo, I actually think it\u2019s the exact opposite.\u201d<\/p>\n

The reason, he argues, is that AI packages expertise and automation in ways that can be delivered broadly. \u201cOne of the fantastic things about AI, and we\u2019re already starting to see this, is [that it\u2019s] a great democratizer of capabilities,\u201d he says. \u201cAI packages up expertise and automation capabilities at a level beyond what prior waves of technology have done, and it makes it available at scale into organizations that have not previously been able to afford these things.\u201d<\/p>\n

He points to red teaming<\/a> as an example. Nearly every organization would like a world-class red team, but few can afford one.<\/p>\n

\u201cPretty much every organization on the planet would love to have a world-class red team to constantly test their security to find and fix things before attackers do,\u201d Venables says. \u201cBut very few organizations have ever been able to afford to build a high-end red team.\u201d<\/p>\n

AI agents, he argues, could make that kind of capability available more economically. The same pattern could apply to insider threat; third-party risk; software security; governance, risk and compliance; and security operations.<\/p>\n

\u201cSo even the smallest and resource-constrained organizations can now have access to a higher-end capability,\u201d he maintains.<\/p>\n

Venables does see a danger zone, however: under-resourced security teams inside organizations with aggressive AI ambitions. Those teams may struggle to keep up<\/a> as the rest of the business adopts AI rapidly. But for many small and midsize organizations, he believes AI could improve access to security capabilities they never had before.<\/p>\n

A divide over AI \u2014 or over readiness?<\/h2>\n

For elite organizations, AI is already becoming a force multiplier. Security teams with deep engineering talent, mature data infrastructure, and strong governance can use AI to accelerate testing, detection engineering, vulnerability discovery, and risk management.<\/p>\n

For smaller organizations, the picture is less clear. AI may eventually package scarce expertise into affordable services. Open models may reduce dependence on expensive frontier systems. But organizations below the security poverty line still face familiar constraints: too few people, too little time, limited expertise, unpredictable costs, and weak leverage over vendors.<\/p>\n

The emerging divide may therefore be less about who has access to AI and more about who can turn AI into durable security outcomes.<\/p>\n

That makes the question facing cybersecurity more complicated than whether AI will create haves and have-nots. The industry already had them.<\/p>\n

The real question is whether AI becomes another technology that rewards the organizations already best positioned to use it \u2014 or the first major security advance in years that helps those below the poverty line finally catch up.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

At Amazon Web Services (AWS), artificial intelligence is already compressing security work that once took months into minutes. In the old world, human red teams would find vulnerabilities, write reports, refine those reports, and eventually hand them to defenders, who would then begin building detections or fixes, Steve Schmidt, chief security officer at AWS, tells […]<\/p>\n","protected":false},"author":0,"featured_media":8719,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-8718","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8718"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8718"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/8718\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/8719"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8718"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8718"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8718"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}