Security teams should use AI to find and fix weaknesses in their own environments before attackers exploit them—not wait for alerts or incidents to expose gaps. That is the central argument of Chaim Mazal’s sponsored contribution to The New Stack, published October 1, 2026. Separate official guidance from the Five Eyes cyber security agencies also urges organizations to strengthen foundational controls and prepare for AI-accelerated threats.
Why security teams need to look beyond alerts
In his sponsored article, Mazal argues that a security program built mainly around responding to alerts, incidents, and vendor patches risks discovering weaknesses too late. He calls for an engineering-led approach: examine systems and workflows proactively, identify weaknesses, and prioritize remediation before an adversary finds them. His framing is pointed: “In this environment, defending attack surfaces won’t cut it. We need to go on the offense.”
This is a recommendation from the sponsored author, not a demonstrated comparison showing that a particular product or technique outperforms another. Its practical implication is to treat security as ongoing work to reduce exposure, rather than a queue of alerts to clear after something has happened.
What official guidance says about AI and cyber risk
A joint statement from Five Eyes cyber security agencies, hosted by the UK National Cyber Security Centre and published June 22, 2026, describes AI as both a risk accelerator and a defensive opportunity. The agencies say AI can increase the speed, scale, and sophistication of threats while also strengthening defensive capabilities. They warn: “Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities.”
The agencies frame cyber risk as a core business risk and a leadership responsibility. Their recommendations focus on controls and resilience, not endorsement of a commercial vendor or platform. The statement does not prescribe Mazal’s “offensive” framing; it independently supports the need to reduce risk and be ready to respond.
Start with foundational security controls
AI-enabled workflows do not replace basic security hygiene. The Five Eyes agencies call on organizations to reduce attack surface, patch faster, address legacy systems, strengthen identity and access management, and prepare for incidents.
- Reduce exposed attack surface: identify systems and services that do not need to be reachable and limit unnecessary exposure.
- Accelerate patching: prioritize timely remediation, including for legacy systems that may be harder to update.
- Strengthen identity and access: review who and what can access systems, and keep permissions appropriately limited.
- Prepare for incidents: plan response and recovery, and ensure leadership has confidence that controls will work during a real event.
These are recommendations from the agencies’ statement; it does not provide a product ranking or a tested implementation recipe.
#1 Best Overall
Use AI agents for bounded security tasks
Mazal recommends giving AI agents a specific task and the context needed to perform it, rather than issuing a broad, vague assignment. In practice, a team might define a particular environment or workflow to inspect, specify what kinds of weaknesses to look for, and ask for findings in a format that supports human review and remediation.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThis is an implementation principle from the sponsored contribution, not evidence that an agent can independently verify or fix every issue. Keep security decisions accountable: people should assess findings, set remediation priorities, and confirm changes through their normal controls.
Choose deployment and model options around risk
Mazal also recommends avoiding workflows that depend on a single model or vendor, and considering air-gapped or self-hosted deployment when data residency or intellectual property protection requires it. These are the author’s recommendations, not requirements in the Five Eyes statement.
Selection should begin with the organization’s constraints: what information a workflow handles, where it may be processed, and whether a given deployment arrangement meets applicable security and data-handling needs. The sources do not establish that one model, provider, or deployment method is universally safer or more effective.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make readiness a leadership concern
The Five Eyes agencies urge leaders to treat cyber risk as a business issue, not a concern reserved for technical teams. That means assigning responsibility for foundational controls and asking whether response plans and safeguards will function under real incident conditions. AI can support defensive work, but it does not remove the need for accountable decisions, sound access controls, patching, and recovery preparation.
Recommended Free Tools
Quick Recap
Best Value
Rank #3
Neither source supplies a suitable named statistic or a tested, ranked set of security products. The useful distinction is between Mazal’s sponsored recommendations for proactive, AI-assisted security engineering and the agencies’ independent guidance on risk reduction and resilience.
Sources
- Chaim Mazal, “In AI security, there’s no room for a defender’s mindset,” The New Stack, sponsored contribution, October 1, 2026.
- UK National Cyber Security Centre, “The AI shift in cyber risk: why leaders must act now,” joint Five Eyes cyber security agencies statement, June 22, 2026.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
