CyberTech Top Voice: Interview with Eric Vanderburg, President of Nexus Cyber

In this latest edition of the CyberTech Top Voice Series, we spoke to Eric Vanderburg, President of Nexus Cyber, a thought leader and author with over two decades of experience in the field. He is widely respected for his deep expertise in cybersecurity, privacy, data protection, and data storage. Throughout his career, Eric has worked closely with global organizations to develop and implement comprehensive security strategies that align with evolving industry standards and complex regulatory frameworks. His leadership has helped companies across various sectors strengthen their security posture, manage risk, and address critical vulnerabilities in an ever-changing threat landscape. His expertise has also been requested in court, where he has served as an expert witness on technology, cybersecurity, and privacy.

He talked about how AI is reshaping cybersecurity for both defenders and attackers. Eric shares his perspective on where AI is already delivering value, why human judgment remains critical as security operations become more automated, and the new risks emerging from generative and agentic AI. We also explore how CISOs should evaluate AI-powered security tools, the skills security professionals need to develop, and what will distinguish organizations that successfully balance AI-driven automation with governance, accountability, and human oversight.

Here’s what Eric Vanderburg had to say about AI-driven cybersecurity, human oversight, agentic AI risks, security automation, and the future of cyber defense.

How do you see AI changing the cybersecurity landscape for both defenders and attackers today?

AI is accelerating both sides of cybersecurity. For defenders, it lets us analyze enormous volumes of telemetry, correlate events across systems, identify behavioral anomalies, summarize investigations, and automate parts of detection and response much faster than humans could do independently. For attackers, many of the benefits are similar. AI reduces the time and expertise required to conduct reconnaissance, develop convincing social engineering campaigns, analyze stolen information, modify malicious code, and identify potential vulnerabilities. I don't necessarily see AI creating an entirely new cybersecurity battlefield as much as dramatically increasing the speed and scale at which the existing battle can be fought.

The asymmetry is what concerns me most. This is not a new problem, just one exacerbated by AI. Attackers only need to find one successful path, while defenders have to protect an increasingly complex environment. AI allows an attacker to test, adapt, and personalize attacks at a scale that previously required significant human resources. At the same time, defenders can use AI to process security data at machine speed. We are consequently entering an environment in which both attack and defense increasingly occur at computational rather than human speed. Organizations that continue relying primarily on manual processes will find it increasingly difficult to keep pace.

Where do you believe AI is already delivering meaningful value for security teams, versus areas where expectations may be ahead of reality?

AI is already delivering significant value anywhere cybersecurity professionals face large quantities of information that must be correlated, classified, summarized, or prioritized. Security operations are an obvious example. AI can help automate almost ever step of the process. AI similarly adds value in vulnerability management, threat intelligence, secure development, policy analysis, compliance mapping, and identifying patterns in large datasets that humans simply cannot examine efficiently.

Expectations often outpace reality when we assume AI can replace experienced security judgment. AI can produce an impressive incident summary and still misunderstand what actually happened. It can confidently recommend remediation without understanding an organization's architecture, operational dependencies, or business consequences. The same problem appears in autonomous security operations. A substantial difference exists between letting AI enrich an alert and allowing it to disable accounts, isolate production systems, adjust firewall rules, or modify cloud configurations. AI is strongest today as a force multiplier for knowledgeable security professionals, not as a substitute for them.

As security operations become increasingly automated, which decisions should still require human judgment?

I would base that decision primarily on consequence, reversibility, uncertainty, and context. Highly repeatable, low-impact, easily reversible actions are excellent candidates for automation. As the potential business impact increases or the action becomes difficult to reverse, human involvement should increase as well. Disabling a confirmed malicious session is different from disabling the CEO's account based on a behavioral anomaly. AI may recommend either action, but recommendation and authorization should not automatically be treated as the same function.

I also think we need to distinguish between human-in-the-loop and human-on-the-loop systems. A human technically being present does not provide meaningful oversight if that person does not understand what the AI is doing. We cannot create a George Jetson model in which security professionals simply push an approval button while the machinery underneath becomes increasingly opaque. Humans responsible for oversight need sufficient expertise, information, time, and authority to challenge the AI's conclusion. Otherwise, we have preserved the appearance of human judgment while effectively automating the decision.

How should CISOs and security leaders evaluate AI-powered security tools without introducing new risks into their environments?

CISOs should evaluate AI security products with the same skepticism they would apply to any other technology that receives sensitive data or obtains privileged access, while recognizing that AI introduces additional questions. What data is being sent to the model? Where is it processed and retained? Can it be used for model training? Which third parties receive it? What permissions does the system have? Can it take autonomous actions? How are those actions logged and audited? How is the model protected against prompt injection, data poisoning, excessive agency, insecure tool use, and manipulation of the information upon which it bases decisions? Organizations should also understand what happens when the AI is unavailable, produces an incorrect answer, or behaves differently following a model update.

I would also insist on measurable evidence rather than accepting an "AI-powered" label as evidence of effectiveness. Test the product against the organization's own environment and representative use cases. Measure false positives, false negatives, analyst time saved, detection improvements, and recommendation quality. Red-team the AI components where appropriate and establish boundaries around autonomous actions. Most importantly, understand the architecture. If the vendor cannot clearly explain what information the system consumes, what authority it possesses, and what controls exist between an AI recommendation and an operational action, that should be a significant concern.

What new attack surfaces or security risks do you expect wider enterprise adoption of generative and agentic AI to create?

Generative AI expands the attack surface primarily through data exposure and new trust relationships. We are already seeing shadow AI create situations where employees place proprietary information, source code, credentials, regulated data, or other sensitive information into systems the organization has not evaluated. As AI becomes integrated into enterprise applications, organizations must also consider prompt injection, retrieval-augmented generation poisoning, insecure plugins and connectors, model manipulation, sensitive information disclosure, excessive permissions, and vulnerabilities in the increasingly complicated supply chain supporting AI systems.

Agentic AI raises the stakes considerably because we move from systems that generate information to systems that can take action. An agent with access to email, cloud infrastructure, source repositories, financial systems, or security tools is effectively a privileged identity that can reason about and execute tasks. Attackers may not need to compromise the underlying model if they can manipulate its context, instructions, memory, tools, or data sources into performing an action on their behalf. Identity, least privilege, segmentation, authorization boundaries, provenance, monitoring, and zero-trust principles become even more important when the identity being governed is an autonomous software agent rather than a human employee.

What skills should cybersecurity professionals develop now to remain effective as AI becomes a more significant part of security operations?

Cybersecurity professionals need AI literacy, but I don't think everyone needs to become a machine-learning engineer. They should understand how modern AI systems work in practice, including large language models, retrieval-augmented generation, agents, embeddings, context windows, tool calling, model limitations, hallucinations, prompt injection, and the security implications of connecting models to enterprise systems. Security professionals should also become comfortable using AI themselves. Someone who understands how to delegate appropriate work to AI, validate its output, and incorporate it into an investigation can potentially accomplish considerably more than someone performing the entire process manually.

At the same time, I would caution professionals against allowing AI to erode the foundational expertise that makes them capable of evaluating its output. If AI investigates every alert, writes every script, analyzes every packet capture, and recommends every remediation, how does the junior analyst develop the expertise necessary to recognize when the AI is wrong? That creates an expertise paradox: as automation becomes more capable, humans may get fewer opportunities to develop the skills necessary to supervise it. The most valuable professionals will therefore combine strong cybersecurity fundamentals with AI fluency, critical thinking, business understanding, and the ability to independently validate machine-generated conclusions.

Looking toward the next few years, what do you think will distinguish organizations that successfully use AI for cybersecurity from those that struggle with it?

The successful organizations will treat AI as an architectural and governance change rather than simply another product category. They will know where AI is being used, what information it can access, what decisions it can influence, what actions it can take, and who remains accountable for the outcome. They will integrate AI into well-designed security processes instead of using it to compensate for poorly designed ones. They will measure results, establish appropriate autonomy boundaries, preserve auditability, test failure scenarios, maintain human expertise, and continually reevaluate controls as the underlying models and threats change.

Organizations that struggle will likely fall into one of two extremes. Some will resist AI so aggressively that employees adopt it outside approved channels and competitors gain substantial productivity advantages. Others will embrace it so quickly that they automate processes they do not fully understand and grant AI systems authority they have not adequately governed. The organizations that succeed will occupy the disciplined middle ground: aggressive enough to capture the advantages of AI, skeptical enough to verify what it produces, and mature enough to recognize that automation does not eliminate accountability. If anything, as machines assume more operational responsibility, good governance and knowledgeable human oversight become more important, not less.

Thank you, Eric, for speaking to us. We look forward to speaking to you again.

For Interview inquiries, you can write to our CyberTech Intelligence team at sales@cybertechintelligence.com