How defenders use AI
Threat hunting
Hunting means searching logs for attacks no alert has caught. AI assistants help turn a hunch — “has anyone run unusual admin commands at night?” — into a search query, and summarise thousands of results into patterns worth checking.
Defensive scripting
Defenders write small Python or shell scripts to parse logs, enrich alerts and automate checks. AI drafts these scripts quickly; the analyst still has to read, test and correct them.
Alert summaries and reports
Security tools increasingly add AI summaries to alerts and draft incident write-ups. That saves time on first reading, so analysts spend more of their day on decisions.