Cybersecurity and AI: the new challenge is the ‘collapse of scarcity’

PARIS – There was no official mention of conflicts or cyberwarfare, which was to be expected at an event organised by Check Point Software Technologies, an Israeli company and one of the world’s leading cybersecurity providers. The presentations delivered on 8 July on the stage at Engage 2026 in front of 900 security managers from around the world – starting with the opening address by the CEO of the Tel Aviv-based company, Nadav Zafrir, offered an unexpected perspective on the impact of artificial intelligence on cybersecurity. The key concept to consider is, in fact, the ‘collapse of scarcity’. In other words, AI has removed the barriers that once constrained attackers, virtually eliminating the need for the skills, infrastructure and capital that were once crucial components for launching a sophisticated attack. According to Zafrir, it is therefore this – even more so than the growing power of generative models – that is set to redefine the balance of power between attackers and defenders: artificial intelligence makes offensive capabilities accessible that, until just a few years ago, were the exclusive preserve of a small number of highly skilled groups. What does this shift in the landscape mean for businesses? A great deal, because it entails a profound change in defence strategies and requires a rethinking of operational models that have been established for decades.

For years, the ability to identify software vulnerabilities, develop exploits or carry out particularly sophisticated campaigns has remained the preserve of organisations with high levels of technical expertise and substantial resources. Now, AI is drastically lowering this barrier to entry, and tools that until recently were available only to a select few are now accessible to anyone capable of using an AI model. The warning issued by experts at Check Point responds to a twofold shift: on the one hand, we are witnessing a gradual democratisation of offensive capabilities; on the other, attacks are taking on an industrial scale, as they can be generated, adapted and replicated on a large scale with ever-decreasing costs and timeframes. In this context, the value of ‘zero-day’ vulnerabilities is also changing: they can now be exploited immediately, in the knowledge that new tools will enable others to be identified rapidly. The result is a continuous acceleration of the attack lifecycle.

According to Check Point’s CEO, the debate on AI still tends to focus on the potential of new technologies, whilst the real game-changer lies in the transformation of the very nature of cyberattacks. “The hype surrounding artificial intelligence may well subside, but the collapse of scarcity will continue to have profound effects on cybersecurity. ‘The only way to navigate what lies ahead,’ observed Zafrir, ‘is to master the fundamentals, whilst building a future that we have not yet fully imagined.’

Artificial intelligence, another key point of analysis that emerged during the Paris event, is also changing the pace at which the battle between attackers and defenders unfolds, as it allows the former to test thousands of variations of a single attack, learn from their failures and adapt at a speed that is beyond human decision-making capabilities. The defenders, on the other hand, as Zafrir pointed out in his speech, are left with the burden of protecting every possible point of access, whilst being obliged to remain operational at all times. This gives rise to the conviction that the cybersecurity sector is undergoing a period of transition in which the paradigms established over the last thirty years remain valid, but are no longer sufficient to describe a reality that has changed profoundly.

According to Check Point, despite this paradigm shift, the principles of cybersecurity do not need to be rewritten from scratch – quite the contrary. Vulnerability management, prevention, continuous monitoring and patch management remain the cornerstones of defence, whilst what has changed is the timescale within which these activities must be carried out.