Use AI for defence, but keep humans in authorityFrontier AI can help search code, correlate signals, support testing and speed up triage. The IIF paper says firms that move faster to build defensive capability will be better placed as the threat shifts. So yes, use AI to test, find weak paths, help the SOC cut noise and scan code before deployment. Agents that write code, test controls, scan infrastructure or act in workflows need scoped permissions, monitoring, logs and kill switches. Evidence should include board papers, risk decisions, expired acceptances, supplier attestations, incident timelines, recovery tests and lessons learned.