Why Offensive Cybersecurity Experts Are Hesitant to Embrace AI — And What That Means for the Future

Artificial intelligence (AI) is often hailed as a game-changer across industries, promising faster insights, automation, and smarter solutions. Yet, a recent government study reveals a surprising trend in cybersecurity’s offensive wing: red team specialists remain skeptical about integrating AI into their services. Despite AI’s growing buzz, these experts are sticking to more traditional, manual methods, favoring cloud technology advances instead. This cautious stance raises important questions about AI’s real impact on offensive cybersecurity and what lies ahead for the sector.

The Current Reality of AI Adoption in Offensive Cybersecurity

In December 2024, the UK’s Department for Science, Innovation and Technology (DSIT) commissioned Prism Infosec to investigate how offensive cybersecurity teams—those who simulate attacks to find vulnerabilities—are using emerging technologies. The findings highlight a clear divide: while cloud adoption has transformed the way these teams operate, AI adoption remains limited and controversial.

According to the study, many experts see AI as overhyped, with its capabilities often exaggerated in commercial products. They fear that AI is more commonly exploited by cybercriminals for enhanced social engineering attacks rather than used beneficially by defenders. Ethical concerns around AI misuse, risks related to data privacy, high costs, and the security challenges of public AI models are cited as key barriers to adoption.

Despite these challenges, the report offers a hopeful outlook. Experts anticipate that as more accessible, customizable AI models become available, red teams will gradually incorporate AI into critical tasks such as attack surface monitoring, vulnerability research, and prioritization. For now, however, human expertise and manual processes remain the backbone of offensive cybersecurity.

Interestingly, the study also points out that AI isn’t the only emerging technology met with skepticism. Quantum computing, still viewed as too theoretical and confined to labs, sees even less attention. Instead, offensive teams are focusing on penetrating previously “untouchable” environments like operational technology systems and automated vehicles—including land, air, sea assets, and drones.

What Undercode Say: The Complex Road Ahead for AI in Offensive Cybersecurity

This report sheds light on a nuanced and cautious industry grappling with emerging technologies. The resistance to AI among offensive cybersecurity experts stems from legitimate concerns about its current limitations and risks, which are often glossed over in hype-driven narratives.

First, the fear of AI’s misuse in social engineering by threat actors is valid. AI-generated phishing, deepfakes, and automated attack scripts raise the stakes for defenders, making AI a double-edged sword. The ethical dilemma here cannot be ignored—cybersecurity firms hesitate to adopt tools that could potentially backfire or erode trust with clients.

Secondly, the challenge of data privacy and securing AI models cannot be overstated. Offensive cybersecurity relies heavily on sensitive information, and deploying AI in the cloud or through public models exposes companies to new vulnerabilities. This technical barrier adds complexity and cost, discouraging widespread AI use.

The skepticism toward quantum computing, while expected, also highlights how the industry prioritizes practical, near-term solutions over futuristic technology. Offensive teams focusing on riskier targets such as operational technology and autonomous systems suggest a strategic shift to areas where AI might have less immediate influence but where specialized expertise is critical.

Still, the anticipation around “more accessible AI models” suggests the tide may turn. Once models become easier to customize and secure, AI could augment red teams’ capabilities, speeding up reconnaissance and vulnerability prioritization without replacing the skilled human touch. This balance will likely define the next phase of offensive cybersecurity evolution.

Finally, the preference for cloud technologies over AI reveals an interesting dynamic: teams prioritize infrastructure and scalability improvements first, possibly because these bring clearer, more immediate benefits. AI’s promise remains a future possibility, not a current reality for most offensive services.

🔍 Fact Checker Results

AI adoption in offensive cybersecurity remains limited due to skepticism and ethical concerns ✅
Cloud technology currently has a greater impact on offensive cyber services than AI ✅
Quantum computing is viewed as too theoretical and not yet viable for practical use ✅

📊 Prediction: AI’s Gradual Rise in Offensive Cybersecurity

Looking ahead, AI will likely become a crucial tool in offensive cybersecurity—but on the red teams’ own terms. The technology must mature, becoming more accessible, affordable, and secure before wide adoption. Expect gradual integration focused on augmenting, not replacing, human expertise.

In the near future, AI-driven automation will streamline routine tasks like data analysis, vulnerability scanning, and report generation, freeing experts to focus on complex, creative challenges. However, ethical and security concerns will drive a cautious, measured approach, with transparency and control paramount.

Cloud-based AI platforms tailored specifically for cybersecurity will emerge, enabling red teams to harness AI safely without exposing sensitive data. Meanwhile, offensive teams will continue targeting high-risk environments such as operational technology and autonomous systems, where specialized skills remain indispensable.

Ultimately, AI’s role in offensive cybersecurity will evolve from hype to a pragmatic, complementary tool that enhances the precision and speed of human-driven attacks—reshaping the landscape but never fully replacing the human element.