Application Security in the time of AI: How security can evolve by riding the GenAI wave

AI has leveled the playing field

It’s 2025, and we are way past the point of asking whether AI has applications in security. 

As of today, AI can simulate a wide range of attack scenarios, detect unknown vulnerabilities, and secure applications at scale. However, AI can also widen the attack surface by creating exploits and bypassing security—the classic double-edged sword conundrum. 

‘What we’re witnessing today is not just an evolution of tools due to the adoption of AI—it is a transformation of the entire security landscape. That means your organization needs to fundamentally rethink its approach to security in the age of AI.

The most pressing question is: Which side of the security battlefield uses AI better, the attackers or the defenders?

In the words of Cornelius Fudge – ‘The other side can do (use) magic (AI) too!’

Generative AI: An opportunity in disguise for cybersecurity 

Security has always been a cat-and-mouse game. Attackers try to stay 10 steps ahead of security teams in exploiting vulnerabilities and devising new attacks. But generative AI has brought a quantum leap in this equation. Imagine competing with an opponent who is not only stronger, faster, and more intelligent – but is also constantly learning and evolving. That is the reality for enterprise security teams contending with AI-driven threats!

The statistics paint a grim picture. According to a Verizon report, AI-driven attacks saw a 40% surge in 2024. These attacks are successful because traditional security measures simply cannot keep pace with this new generation of AI-driven attacks.

So, is generative AI the endgame for security as we know it? 

After having been at the forefront of building enterprise-grade security solutions for the past decade, I can safely say that it is not all doom and gloom for the defenders, because the AI capabilities being weaponized by attackers can also empower your security teams.

Far from writing its obituary, this is an incredible opportunity for cybersecurity to evolve by using AI as a stepping stone.

The new paradigm: AI as shield and sword

Generative AI can simultaneously be your best ally and your worst nemesis. 

How so? Attackers can now use AI to identify vulnerabilities, launch attacks, and bypass traditional defenses faster than before as:

• AI can do a deep vulnerability analysis of your applications and find security flaws in just hours (compared to days or weeks for manual security testing teams);
• AI can write code to create malware that can exploit the vulnerabilities it finds (hackers can use Generative AI to create an endless number of new malware in almost no time)
• AI can even preempt and bypass your security measures!
  

Is AI-powered defense the best offense?

AI is a double-edged sword. It cuts both ways.

According to Gartner, 60% of organizations now incorporate AI into their DevSecOps practices for continuous security monitoring. And the results are substantial and exciting. 

With generative AI, security teams can:

1. Build stronger defenses (AI-powered tools can catch 40% more vulnerabilities during early development)
2. Predict threats before attackers can exploit them (compared to traditional methods, AI-powered tools can cut vulnerability detection times by 50%), and
   
3. Automate routine tasks
   

An AI-powered ‘shift-left’ security approach can detect and mitigate security issues before they enter production – more accurately and efficiently than ever before.

The promise and peril of AI in application security

Let’s get into the weeds of it. Without a doubt, AI presents exciting opportunities to transform application security:

• Enhanced threat detection: An AI-powered tool can analyze mountains of security information – network traffic, user behavior, threat intelligence feeds, etc.- to identify security anomalies that humans might miss in a fraction of the time compared to before. 
  Instead of deploying human resources to address the problem, your security team can use AI to accurately identify sophisticated attack patterns that would evade traditional rule-based systems.
  

• Predictive analysis: AI-powered security algorithms can analyze historical data, identify patterns in attack behavior, and predict where attackers are likely to strike next. This allows your security teams to strengthen their defenses proactively and patch vulnerabilities before attackers can exploit them.
  That means your security response can go from merely reacting to known vulnerabilities to anticipating emerging threats.
  

• Automation of routine security tasks: Consider how many hours your security team spends weekly on log analysis, vulnerability scanning, malware detection, and other related tasks. This work is not only time-consuming but also tedious and prone to errors.
  However, you can now automate the grunt work using AI and free up your security experts to focus on strategic, big-picture stuff. They can devote their time and resources to complex security challenges like threat hunting and incident response that require creative problem-solving.
  

But, of course, it’s not entirely a rosy picture. It’s a package deal, so here’s a word of caution about the security challenges that come with the promising benefits:

• The increased attack surface created by AI systems themselves introduces new vulnerabilities. False positives and negatives remain persistent challenges, potentially creating alert fatigue or missing critical threats.
• Perhaps most concerning is the lack of explainability in many AI security systems. This creates a “black box” problem in which security teams can’t fully understand the reasoning behind AI-driven security decisions.
  

AI in application security: What is the way forward?

The rise of Generative AI simultaneously presents unprecedented opportunities and challenges for application security. Security leaders and practitioners need to recognize this duality and adopt AI-driven security solutions to stay ahead of their fast-evolving adversaries. 

At Appknox, we are building an AI-powered, mobile-first security platform to help organizations maintain an up-to-date inventory of their mobile apps, protect their brand reputation, and simplify compliance with privacy regulations. It is built to seamlessly integrate into your team’s workflow and provide a comprehensive security solution for every stage of your app lifecycle.

Moreover, we have just released Storeknox, a security solution that helps enterprises detect, respond to, and prevent security incidents across their mobile app ecosystems with real-time store monitoring. So, with Appknox, you can now enjoy a broader scope of mobile application security assessment for both SDLC and post-deployment stages on a single platform.

Generative AI is reshaping the fabric of application security by not just speeding up development but fundamentally changing how organizations manage risks. 

As AI continues to reshape security demands, we should be committed to staying ahead of the curve, integrating AI’s strengths into security assessment while managing its inherent risks.

Author bio: Subho Halder is the CISO and Co-Founder of Appknox. He started his career researching mobile security, and his expertise has been pivotal in advancing the safety of banking and payment apps in Asia.

Currently, he helps businesses detect and fix security vulnerabilities by developing robust security frameworks with his talented team at Appknox.