Home » News » The cybersecurity industry must adapt as AI changes threats, services and buyer expectations
Posted by Catherine Jones on 21 October 2026
The cybersecurity industry must adapt as AI changes threats, services and buyer expectations
New CREST white paper examines how cybersecurity providers, buyers, regulators and standards bodies can prepare for an AI-enabled future.
Artificial intelligence is advancing at a pace that risks outstripping the cybersecurity market’s ability to adapt.
Organisations are rapidly embedding AI across software development, business operations and customer-facing systems. But malicious actors are using the same technologies to increase the speed and scale of cyber attacks. Cybersecurity providers must respond on both fronts, adapting their own services while helping clients manage an increasingly complex threat environment.
Meanwhile, AI continues to evolve.
CREST’s new white paper, Beyond keeping pace: Adaptation in the age of AI, examines the immediate implications of these changes for cybersecurity providers, buyers, regulators and standards bodies. It also looks further ahead, drawing on the UK Government Office for Science’s AI scenarios for 2030 to consider how several plausible futures could affect the industry.
The precise direction AI will take remains uncertain, but its impact is already clear. Cybersecurity services and professionals will remain essential, but roles and services will need to adapt to keep up with the speed of change.
Cybersecurity providers face rising demand
AI is increasing demand for cybersecurity services as organisations seek help to adopt the technology securely. To meet this need, many providers are using AI to scale up activities – accelerating analysis and automating routine work.
These developments feed into one another. Buyers need to feel confident in the safety and capability of the AI they adopt, while providers need to demonstrate transparency, strong governance and appropriate human oversight.
At the same time, attackers are moving faster, adding to the volume and urgency of work providers face. AI is accelerating offensive activities such as vulnerability discovery and social engineering, which gives organisations less time to assess risk, respond to threats and contain attacks.
This puts greater pressure on providers to combine speed of response with judgement. AI can accelerate analysis, but experienced practitioners are still needed to interpret the findings and determine what action to take.
“We’re at a point where standing still presents the greater risk. AI is creating new security challenges at the same time as it changes how our industry responds to them. Providers have an opportunity to build better, faster services, but they’ll also be judged on the decisions they make now about their use of AI.
“What gives me confidence is that the industry has adapted to major technological change before. The difference this time is the speed of change. We need to make sure our ability to assure quality and build trust develops just as quickly.”
Nick Benson, Chief Executive Officer, CREST
Preparing for what comes next
No one can predict exactly how AI will develop by 2030. But there are plenty of ways the industry can prepare for whichever future emerges. Drawing on the UK Government Office for Science’s AI scenarios for 2030, we found common pressures across several possible futures. AI could become more capable and deeply embedded, and new technologies could further expand the attack surface. Cybersecurity providers will need to rapidly adapt their services, expertise and commercial models in response.
“AI will become part of normal cybersecurity delivery remarkably quickly. As its use grows, buyers will need better ways to judge the quality of AI-enabled services and understand what they’re buying.
“The real test for providers will be how effectively they use AI and how reliably they validate its outputs. That still requires experienced practitioners who can assess the results and make sound decisions about what happens next.”
Sebastian Madden, Chief Product Officer at CREST
Defining what good looks like
As AI becomes commonplace across cybersecurity services, what separates providers will be how well they use and manage it. Buyers will expect evidence of safe integration, rigorous validation and expert oversight. AI capability may open the door, but trust will determine who wins the work.
CREST is already adapting its standards and assurance programmes to support this need. Our industry-backed AI Charter and nine AI Principles establish shared expectations for responsible AI use, while our standards increasingly address both the use of AI in cybersecurity delivery and the security testing of AI systems.
As AI continues to evolve, the cybersecurity industry must ensure its standards, skills and assurance mechanisms evolve just as quickly.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
