LIVE from Gartner: Why AI Could Give Cyber Defenders the Upper Hand in 2027

At the Gartner IT Symposium/Xpo 2026, cybersecurity and artificial intelligence are taking center stage as technology leaders confront an increasingly complex threat landscape.

During a session examining the 2027 cybersecurity outlook, Leigh McMullen, Distinguished VP Analyst, outlined how AI could shift the advantage toward defenders through automation, stronger governance, and operational resilience.

His message was surprisingly optimistic. While AI is giving attackers new capabilities, it is also changing the way organizations defend themselves. And for CIOs and CISOs, that could mean an opportunity to finally get ahead.

The Cybersecurity Advantage Could Be Shifting

For years, attackers have held the advantage. They only need to find one weakness, while security teams are responsible for protecting everything.

But AI could begin changing that equation.

“The technology that is scaling attackers scales us too,” McMullen said.

According to McMullen, cybersecurity is moving away from a competition centered on who can discover the next vulnerability first. Instead, automation is becoming the deciding factor.

And that’s an area where enterprise IT teams already have experience.

Automated security investments can protect more systems and business operations over time. Defenders also benefit from sharing threat intelligence, understanding their own environments, and deploying new protections before attackers can fully exploit emerging capabilities.

Still, technology leaders aren’t convinced the advantage will shift overnight.

“Automation will be indispensable in combating cyberattacks that use AI bots for command and control. Responding at the speed of electrons is what is needed to counter this emerging threat,” said Lonnie Garris, cybersecurity consultant and former CIO.

Saïd Toro, CIO, sees a similar opportunity but believes attackers will maintain their advantage in the near term.

“I think AI will narrow the gap, but attackers will keep the upper hand in the near term. They only need to be right once, and they’re using AI faster and with less friction than enterprises can govern it,” Toro said.

For organizations hoping to benefit from AI-powered security, the groundwork matters.

“Defenders gain the most where AI takes on detection triage and response at machine speed, and that benefit goes to organizations that have already cleaned up their data, identity and tooling,” Toro added.

AI Agents Bring a Familiar Security Problem

As organizations move toward autonomous AI agents, Gartner sees another challenge emerging: controlling what these systems can actually do.

Deepfakes, prompt injection, software supply chain attacks, and AI application compromise are among the threats Gartner highlighted.

But McMullen argues that many of these risks come back to something security teams already understand: access and permissions.

The human problem and the AI agent problem is the same problem.

“The human problem and the AI agent problem is the same. It’s a problem of circumscribing and limiting agency,” he said.

AI agents can access enterprise applications, execute tasks, and modify information. The more authority they’re given, the greater the potential consequences when something goes wrong.

Gartner’s approach involves applying different security controls based on what an AI system is capable of doing.

An AI tool generating content requires different protections than an autonomous agent accessing sensitive records or executing administrative commands.

McMullen also questioned whether human oversight can keep pace with increasingly autonomous systems. Instead, organizations will need stronger identity controls, containment strategies, and automated guardrails.

The challenge is finding ways to enable AI without giving it unrestricted access to the enterprise.

Resilience Is Becoming the New Measure of Cybersecurity

Perhaps the biggest shift in Gartner’s outlook has less to do with preventing attacks and more to do with what happens afterward.

“Resilience is how we play offense in cybersecurity,” McMullen said.

Resilience is how we play offense

His argument is that organizations cannot guarantee they will prevent every incident. What they can do is demonstrate how quickly they can recover.

That changes the conversation with the board.

Rather than focusing solely on security spending and potential threats, CIOs can show measurable improvements in recovery times and business continuity.

Toro says that shift is already influencing executive priorities.

“In the PE-backed mid-market companies I’ve led, the board and sponsors want to know how fast we’re operational again, not whether we blocked every attempt,” he said.

“That has pushed my priorities toward immutable backups, tested restore times for critical systems like ERP, and tabletop exercises with the business. Prevention still matters, but proven recovery is now the measure I report on.”

That creates a more tangible way to demonstrate the value of cybersecurity investments.

Recovery Plans Need to Be Tested, Not Just Written

Gartner is also encouraging organizations to rethink how they prepare for incidents.

McMullen emphasized recovery rehearsals rather than relying exclusively on tabletop exercises.

The idea is straightforward. IT teams already restore backups, rebuild environments, and test infrastructure. Why not use those activities to validate actual recovery capabilities?

A routine server restoration could test a ransomware recovery playbook. Development teams could rebuild production systems from backups. Organizations could even practice recovering operations in an entirely different cloud environment.

These exercises help identify gaps before a real incident occurs.

More importantly, they give technology executives something concrete to bring to the board: evidence that critical systems can be restored within defined timeframes.

The Wrap

Gartner’s 2027 cybersecurity outlook challenges the assumption that AI will always favor attackers.

Automation could give defenders new advantages, but getting there requires more than deploying AI-powered security tools. Organizations need stronger governance, better identity management, and the ability to respond at machine speed.

And while prevention remains essential, resilience is becoming just as important.

For CIOs, the priority heading into 2027 is clear: turn automation into a defensive advantage and make cyber resilience a proven business capability.