The Director General of MI5 recently described the world as having entered a new era of national security, one requiring a new response. His annual threat update placed artificial intelligence within a broader resilience challenge involving critical infrastructure, businesses, communities and technology.
The message is relevant well beyond national security agencies. The operating environment is changing for every organization responsible for protecting people, services, data and trust.
Artificial intelligence is already changing the economics of cyber conflict. Adversaries can use it to accelerate reconnaissance, discover vulnerabilities, generate convincing content and coordinate complex activity. Defensive teams, however, remain constrained by fragmented environments, disconnected tools, human attention and decision latency.
This is the intelligence asymmetry.
Attackers are beginning to scale with intelligence and computation. Defense still too often scales with people.
The next challenge is not simply better AI
The market is responding quickly. Security vendors are adding copilots and agentic features. Data and telemetry providers are moving into detection and response. Intelligence providers are embedding AI into research and analysis workflows.
This convergence is important. It shows that the market understands the significance of AI in cybersecurity. But it also creates a risk: treating autonomous defense as a feature rather than as a new operating model.
A model can summarize an investigation without understanding the environment in which it takes place. It can execute a workflow without knowing whether the action is appropriate. It can produce an answer without being grounded in the evidence that matters most to the organization.
The strategic question is therefore not simply:
Which AI model should we use?
It is:
What infrastructure will allow AI systems to understand threats, act responsibly and improve through experience?
That infrastructure must connect security knowledge, data, context, reasoning, action and governance.
From intelligence to defensive capability
Sekoia’s vision is to build the infrastructure for defensive intelligence.
This means connecting the knowledge of security and threat intelligence teams with the scale, speed and consistency of AI agents. It means operating across the heterogeneous environments that organizations already have, rather than assuming that every security technology will be replaced. It means giving organizations flexibility over data, deployment and authority.
Most importantly, it means creating a system that can learn.
When elements are connected, operational experience can become reusable defensive expertise. Human corrections can improve future investigations. Outcomes can inform detections, defensive skills, evaluations and specialized models. The system becomes more capable over time, rather than simply repeating the same workflows faster.
This is the difference between automation and learning.
Why Frost’s recognition matters
This week, Frost & Sullivan recognized Sekoia as an Innovator in its Frost Radar™: AI SOC. As a founder, I am proud of this recognition. It reflects the customers who believed in Sekoia early and the team that has turned our original conviction into working capabilities.
For security leaders, the significance goes beyond the analyst category.
It points to a strategic choice: what matters in the move toward autonomous defense is not simply which model an organization uses. It is whether the surrounding system can connect the right intelligence and context, operate across the existing environment and improve through experience, while remaining governed by the people responsible for security.
The recognition provides an external reference point for organizations evaluating how to move from experimentation to execution.
The next breakthrough in cybersecurity will not simply be autonomous defense. It will be defense that continuously improves itself, while remaining open, explainable and governed by the people responsible for protecting organizations and society.
That is the intelligence asymmetry Sekoia is working to close.
Curious how Frost & Sullivan reached its verdict? The full Frost Radar™: AI SOC report walks through the whole assessment. Read it here.
.webp)
