Day 7: AI in cybersecurity: threat detection and response

Most companies are buying AI for cybersecurity for the wrong reason. They want a smarter alarm. What they actually need is a faster decision.

I have sat in enough boardrooms after incidents to know the pattern. Management asks, “Why did the system not detect this?” The security team opens dashboards, points to alerts, and explains that the warning was there. Nobody acted quickly enough.

The problem is often hesitation. I have seen teams drown in alerts while a real attack moved quietly through the network.

AI changes the game, but only if we use it differently.

The real value of AI in cybersecurity is not that it can “see threats.” Good security tools have done that for years. The value is that AI can connect weak signals faster than humans, identify behaviour that does not fit the normal pattern, and help organisations decide what deserves immediate action.

Consider a local bank customer.

At 9:03 a.m., the customer logs into mobile banking from the device they normally use. At 9:17 a.m., the password is reset. At 9:21 a.m., the account is accessed from a new device. At 9:26 a.m., a new beneficiary is added. At 9:29 a.m., a large transfer is initiated.

Each event may look legitimate.

Together, they tell a story.

A traditional system may treat those as separate events. A well-designed AI system asks a better question: “What changed, and why did so many unusual things happen within twenty-six minutes?”

That is where AI becomes useful.

The same logic applies to mobile money. A SIM is replaced. The PIN is reset. The device changes. The customer cashes out through an unfamiliar agent. That sequence should not merely create an alert, it should create friction.

Pause the transaction. Ask for stronger verification. Call the customer.

That is my first rule: stop worshipping detection and build response into the detection process.

We are told to monitor everything. What we actually must do is define the behaviours that could cause loss and automate the first defensive action.

If an employee downloads five thousand customer records at midnight, I do not want a dashboard waiting for Monday morning. I want the account challenged, the session restricted, and the security team contacted immediately.

My second rule is: teach AI what normal looks like.

Security teams spend too much time collecting threat intelligence from outside and too little time understanding normal behaviour inside. What time do finance staff normally log in? How much money does a customer usually transfer? Which systems should a claims officer access? How many records does a branch employee normally download?

Without that baseline, AI becomes another noisy machine.

With it, anomalies become meaningful.

My third rule is this: never allow AI to become the final authority over a high-impact decision.

AI can recommend, rank, detect and correlate. But critical actions still need human accountability.

I learned this lesson years ago with automated fraud rules. A system blocked activity that looked suspicious. Technically, it performed well. Operationally, it irritated legitimate customers because nobody had designed a sensible escalation process.

The workflow was the problem, not technology.

Executives are being told to buy intelligent platforms, however, I would rather see them build intelligent operating routines.

Who receives the alert? Who can freeze the transaction? Who calls the customer? Who preserves the evidence? Who decides whether the regulator must be informed? How quickly must each action happen?

Those questions matter more than the vendor demonstration.

This is where the establishment pushes back. Security teams will say automation creates risk. Compliance teams will ask for more approvals. Operations will worry about customer inconvenience. Vendors will promise another platform.

But attackers do not wait for your committee.

A fraudster using AI can create believable phishing messages in seconds, clone a voice, imitate a senior executive, translate a scam into local language, and target hundreds of people before lunch.

If your response still requires three emails and a meeting, you have already lost the race.

AI should not make cybersecurity more complicated. It should make good judgement faster.

For banks, insurers, telecoms and mobile money operators across East Africa, the winning model will not be “AI everywhere.”

It will be AI at the moments that matter: unusual access, suspicious money movement, abnormal employee behaviour, compromised identities, device changes, and signs that several small events are becoming one large incident.

The board should stop asking, “Do we have AI in cybersecurity?”

Ask instead:“What can we now detect earlier, and what can we stop faster?”

That is the test. Because the future of cyber defence will not belong to the organisation with the most alerts.

It will belong to the one that recognises danger early, makes a decision quickly, and acts before the attacker finishes the transaction.

We remain, IFIS Team.