Cybersecurity myths debunked: What AI changes, what it doesn't, and why the fundamentals still matter

AI is rewriting the rules of cybersecurity. But are we confusing technological breakthroughs with the death of proven security practices?

From claims that AI will make traditional software development obsolete to predictions that open-weight models will replace their frontier counterparts, the cybersecurity industry is awash in bold declarations. Add quantum computing, AI safety concerns, and the environmental impact of increasingly powerful models, and separating legitimate risks from hype becomes a challenge of its own.

In a recent Immersive webinar, Cybersecurity Myths Debunked, Kev Breen, Senior Director of CyberTech Research at Container 7, joined Principal Cybersecurity Engineer Naomi Roberts and Lead Cybersecurity Engineer Robert Klentzeris to challenge some of the industry's biggest assumptions.

Their message? Technology is evolving rapidly, but the fundamentals of cybersecurity remain as important as ever.

Myth #1: AI and vibe coding are making traditional software development obsolete

AI-powered coding tools have dramatically lowered the barriers to building software. Applications that once required experienced developers and weeks of work can now be created in a fraction of the time.

But does that mean traditional software development, application security, and even software-as-a-service (SaaS) are becoming obsolete?

Not quite.

While AI can quickly generate functional applications, there's a significant difference between building something that works and delivering software that organizations can trust.

Enterprise applications require reliability, scalability, ongoing support, secure data handling, and rigorous testing. AI-generated code doesn't eliminate those requirements.

As Breen emphasized, application security extends far beyond writing code. Secure-by-design principles, CI/CD pipelines, testing, code reviews, and security engineering remain essential to delivering dependable software.

The opportunity isn't to replace these processes with AI, but to embed AI within them.

For security teams, that means evolving from simply reviewing code after it's written to helping establish the guardrails, workflows, and validation processes that guide AI-generated development from the outset.

AI may transform how software is created, but it doesn't eliminate the need to prove that software is secure.

Myth #2: Open-weight AI models will replace frontier models in cybersecurity

As frontier AI providers introduce increasingly sophisticated safety guardrails, cybersecurity professionals are encountering an unexpected challenge: models sometimes refuse to assist with legitimate security research.

Activities such as exploit development, penetration testing, and creating attack simulations can trigger restrictions designed to prevent malicious use.

That has fueled interest in open-weight models, which can offer greater flexibility and control.

Roberts highlighted the practical challenges of using AI to develop attack scripts for legitimate cybersecurity training environments. A model may struggle to distinguish between authorized security exercises and genuine malicious activity.

Open-weight alternatives can help overcome some of those limitations. However, removing restrictions introduces its own risks, particularly when powerful capabilities become more broadly accessible.

The panel's discussion underscored that neither approach offers a universal solution. Security professionals must balance capability, flexibility, safety, and the requirements of their specific use cases.

The future of AI in cybersecurity isn't necessarily about choosing one model category over another. It's about understanding where each delivers value and how to use it responsibly.

Myth #3: Quantum computing is yesterday's cybersecurity problem

With AI dominating industry conversations, another potentially transformative technology has faded somewhat from the spotlight: quantum computing.

But the threat hasn't disappeared.

The concept of "Q-Day" describes a future point when sufficiently powerful quantum computers could compromise widely used forms of encryption.

While the exact timeline remains uncertain, Klentzeris stressed that organizations shouldn't wait until quantum threats become immediate before taking action.

One particularly concerning scenario is "harvest now, decrypt later," in which attackers collect encrypted information today with the intention of decrypting it when quantum capabilities advance.

For organizations protecting sensitive information with long-term value, that makes preparation a current priority rather than a distant concern.

Quantum readiness shouldn't be postponed simply because AI is commanding more attention. Organizations need to begin evaluating their cryptographic exposure and planning for post-quantum security.

Myth #4: AI's biggest risk is its environmental impact

The extraordinary computing resources required to develop and operate advanced AI models have raised legitimate concerns about energy consumption, data centers, and environmental sustainability.

But the panel challenged the notion that environmental impact is the only—or necessarily the greatest—risk organizations should consider.

Roberts noted that perceptions of AI risk often differ significantly between people working in technology and those outside the industry.

Beyond environmental concerns, AI introduces broader questions about economic disruption, security, safety, and society's ability to adapt to increasingly capable systems.

Meanwhile, the enormous costs associated with training new models raise questions about the long-term economics of AI development.

The challenge is that these risks don't exist in isolation. Organizations must consider the security, operational, economic, and societal implications of AI adoption together.

Responsible AI adoption requires a broader understanding of risk than any single headline or emerging concern can provide.

The Biggest Myth: That New Technology Makes Human Expertise Less Important

Perhaps the most important theme throughout the discussion was the continued importance of human judgment.

AI can accelerate coding, automate tasks, and support increasingly sophisticated security workflows. But speed and capability aren't substitutes for understanding, critical thinking, and accountability.

Klentzeris cautioned against abandoning established security pipelines simply because AI offers a newer alternative. Existing processes still deliver value, often with greater predictability.

Roberts reinforced the importance of maintaining foundational cybersecurity skills even as technology changes how professionals work.

And Breen emphasized the essential role of human critical thinking in evaluating AI-generated outputs.

For cybersecurity leaders, the implication is clear: the goal shouldn't be to automate human expertise out of the equation. It should be to combine emerging technologies with the skills, oversight, and proven practices that make security effective.

The future of cybersecurity won't be defined by how quickly organizations adopt new technology. It will be defined by how confidently they can use it—and prove that it works.

‍