At 1:30 PM in Google’s Singapore office, Mark Johnston, Director of Google Cloud’s Office of the CISO for Asia Pacific, stood before a room of journalists with a stark admission: defenders are still losing the cybersecurity war. Despite five decades of advancement, attackers still hold the upper hand.
Johnston’s opening slide revealed a sobering fact: 69% of incidents in Japan and Asia Pacific are reported by external entities rather than detected internally. In other words, most organizations cannot even recognize when they’ve been breached.
The “Cybersecurity in the AI Era” roundtable was more than a press briefing — it was an acknowledgment of persistent failure in cybersecurity defenses and an outline of how Google Cloud is betting on AI to change the tide.
A Brief History: 50 Years of Defensive Struggles
Cybersecurity challenges aren’t new. Johnston referenced a pivotal insight from James P. Anderson in 1972, who observed: “Systems that we use really don’t protect themselves.” Despite countless innovations, this remains true.
Key vulnerabilities continue to plague businesses:
- 76% of breaches start with basics like misconfigured systems or compromised credentials.
- Zero-day exploits, such as the recent Microsoft SharePoint vulnerability, show how quickly attackers capitalize on flaws in widely used tools.
- Detection still lags; organizations often rely on outsiders to notify them of breaches.
In short, defenders remain reactive while attackers exploit the smallest cracks in security armor.
The AI Arms Race: Defenders vs Attackers
Kevin Curran, IEEE senior member and cybersecurity professor at Ulster University, calls today’s environment a “high-stakes arms race.”
- For defenders, AI offers real-time anomaly detection, automated analysis, and predictive threat intelligence.
- For attackers, AI accelerates phishing campaigns, automates malware creation, and scans networks faster than human teams could ever respond.
This creates the “Defender’s Dilemma” — the same technology that strengthens defense also supercharges offensive capabilities.
Google Cloud’s strategy, Johnston argues, is to tilt the balance toward defenders through AI-driven vulnerability detection, secure coding, threat intelligence, and autonomous response.
Project Zero’s “Big Sleep”: AI Finds What Humans Miss
Perhaps the most striking evidence of progress is Project Zero’s “Big Sleep” initiative. Using large language models (LLMs), Big Sleep has discovered vulnerabilities in real-world code that human researchers overlooked.
- First milestone: An AI service found a critical flaw in an open-source library.
- Recent results: 47 vulnerabilities detected in August 2025 alone.
This shift demonstrates movement from manual human analysis → semi-autonomous AI-driven discovery, a model Johnston describes as the future of security operations.
Google’s Roadmap: From Manual to Autonomous Security
Google Cloud envisions a four-stage evolution:
- Manual – Human-driven security with minimal automation.
- Assisted – AI supports analysts with insights and detection alerts.
- Semi-Autonomous – AI handles routine tasks and escalates complex cases.
- Autonomous – AI drives the full security lifecycle, acting on behalf of users.
Currently, most organizations operate between stages 2 and 3. The holy grail is stage 4 — fully autonomous security that outpaces human speed without compromising accuracy.
The Automation Paradox: Promise and Peril
Automation is powerful but risky. Johnston admitted that AI systems themselves can be targeted and manipulated. Without strong verification frameworks, attackers could hijack automated defenses.
Curran reinforced this:
“The risk to companies is that security teams will become over-reliant on AI, sidelining human judgment. There must always be a human copilot.”
The paradox is clear: automation reduces human error but introduces new risks of systemic manipulation if trust in AI systems is misplaced.
Model Armor: Guarding Against AI’s Unpredictability
AI’s unpredictability — the tendency to produce irrelevant or inappropriate responses — is another hurdle.
Johnston illustrated: “If you’ve got a retail store, you shouldn’t be having medical advice instead. Sometimes these tools can do that.”
To address this, Google Cloud developed Model Armor:
- Screens AI outputs for personally identifiable information (PII).
- Filters inappropriate or off-brand responses.
- Adds “health checks” to ensure AI-generated outputs remain contextually relevant.
This safeguard ensures that AI-powered systems remain aligned with organizational needs and compliance requirements.
Shadow AI: The Hidden Risk in Organizations
A growing concern is the spread of shadow AI — unauthorized tools adopted by employees without IT approval.
- Many firms are discovering hundreds of unapproved AI apps on their networks.
- These tools create blind spots in security, as sensitive data may flow into unmanaged systems.
Google Cloud addresses this with sensitive data protection technologies that scan across multiple cloud providers and on-premises systems.
The Budget Dilemma: Doing More with Less
CISOs in Asia Pacific face an impossible paradox: increasing attack volumes + stagnant budgets.
- “We’re seeing more noise,” Johnston said. “Not always sophisticated, but more attacks mean more overhead — and that costs money.”
- Hiring 10 more analysts isn’t feasible for most organizations.
- Companies need AI partners that scale without inflating headcount.
This tension underscores why AI-powered automation is becoming a necessity, not a luxury in cybersecurity.
Scrutiny and Skepticism: Are Defenders Really Winning?
When asked whether defenders are turning the tide, Johnston’s answer was cautious:
- No novel AI-driven attacks yet — attackers are scaling existing methods.
- 50% faster incident report writing with AI tools, but accuracy remains a concern.
The benefits are real but uneven. While AI helps defenders move faster, fundamental weaknesses in configuration, training, and oversight still hamper progress.
Preparing for Tomorrow: Post-Quantum Security
Looking beyond current threats, Google Cloud is already preparing for the quantum computing era, which could break today’s encryption methods.
Johnston revealed:
- Google has already deployed post-quantum cryptography between its data centers.
- These safeguards are now operational at scale by default.
This forward-looking stance positions Google Cloud as a leader in anticipating future threats, not just reacting to current ones.
Expert Outlook: Cautious Optimism
Kevin Curran’s closing words capture the reality of AI in cybersecurity:
“Cyberattacks are a matter of ‘when,’ not ‘if.’ AI accelerates the opportunities available to attackers. Organizations must adopt comprehensive, proactive policies if they want to stay ahead.”
The verdict? AI is both the sword and shield in this battle. Success depends not on deploying the most advanced algorithms but on balanced implementation, human oversight, and resilient strategies.
Conclusion: Balancing Innovation with Prudence
The AI security wars represent the defining challenge of this digital era. Google Cloud is pushing forward with initiatives like Project Zero’s Big Sleep, Model Armor, and post-quantum cryptography, offering defenders powerful tools to fight back.
But victory is far from guaranteed. Over-reliance, unpredictable AI behavior, and budget constraints remind us that technology alone cannot solve cybersecurity.
True resilience will come from a hybrid model of AI-powered automation + human expertise, underpinned by strong governance, investment, and adaptability.
The AI revolution in cybersecurity is already here. The question is not whether AI will define the future of defense — it’s whether companies can adopt it wisely, cautiously, and comprehensively enough to withstand tomorrow’s threats.
