The loudest promise in enterprise cybersecurity is also the easiest to misunderstand: connect a large language model to the security stack, give it an agent, and let artificial intelligence find the intruders. In a wide-ranging video conversation, Cylake founder and CEO Nir Zuk and marketing executive Rene Bonvanie challenge that assumption from the ground up. Their argument is not that AI has no place in cyber defense. It is that most organizations are trying to apply the most fashionable form of AI to an architecture that cannot provide the complete, timely evidence a machine would need.
The interview moves beyond chatbot enthusiasm to a harder question about security data infrastructure. Browser activity, endpoint telemetry, identity events, network flows, cloud workloads, SaaS APIs, source code, CI/CD pipelines, operational technology and sensitive files often live in different vendor systems. Some of those systems discard most raw events before storage. Others export only delayed summaries. The result is a fragmented view of an attack. Before a model can reason about a breach, the speakers contend, a unified cybersecurity data pipeline must first collect, correlate and process the right signals in real time.
Cybersecurity has a data problem before it has an AI problem
The distinction matters because cybersecurity products do not merely search an archive after something goes wrong. They make judgments while data is arriving. A modern enterprise can generate millions of security events per second across users, devices, applications and infrastructure. Detection systems must decide which behavior is normal, which activity violates policy, which sequence resembles an intrusion and which evidence should be preserved. A cloud data warehouse can store records, but storage alone does not perform those jobs. It is the equivalent of building a library without librarians, a catalog or a way to stop a fire while books are still being delivered.
Zuk's core criticism is aimed at the gap between a data lake and a security platform. Moving logs into cloud storage does not automatically persuade endpoint, identity, browser, DLP, SaaS, API, IoT and OT security tools to use the same information. Each product may have its own collector, schema, retention policy and detection engine. Organizations that want one coherent view must acquire raw telemetry at the source, normalize it, preserve context and create an ingestion pipeline that other security functions can use. That is an engineering program, not a prompt.
This is where the do-it-yourself proposal becomes expensive. Running Elastic, Kafka or another data stack is possible, but it creates a permanent operational obligation. The team must maintain collectors, resilient streaming infrastructure, schemas, storage tiers, access controls, model pipelines and security content. It must also negotiate useful feeds from vendors that may expose only a reduced copy of what they saw. A security team can successfully centralize old EDR records and still miss the decisive browser, identity or network event that occurred seconds earlier.
The real cost is therefore not simply cloud storage versus on-premises hardware. It is the cost of reconstructing a cybersecurity platform above the data layer. Thousands of machine learning models, detections and policy controls must be developed, tested and continuously updated. Specialists must understand data engineering, adversary behavior, malware, incident response and model operations. The interview's provocative price tag for that effort is $100 million. The exact number will vary, but the strategic warning is sound: assembling infrastructure is not the same as producing dependable detection.
Centralizing logs is not the same as seeing an attack.
The missing layer is real-time context during ingestion
Why real-time ingestion is the decisive layer
An ingestion pipeline sits between the moment activity occurs and the moment selected records reach long-term storage. That interval is critical. During ingestion, a security system can inspect the richest version of the data, correlate activity across sources and trigger immediate enforcement. Once records are filtered, summarized or delayed, some relationships cannot be recovered. A policy violation detected while a file is moving may be blocked; the same violation discovered in an archive can only be investigated after the information has already left.
Consider an industrial environment. Network monitoring may reveal a suspicious connection to a programmable logic controller or medical imaging system. Endpoint protection may separately observe an unusual process on the Windows workstation used by an operator. A secure browser may hold the session details that explain how the operator reached a malicious site, while identity software records an abnormal login. If these feeds remain in separate pipelines, each tool sees an incomplete story. Correlating them as they arrive can expose the chain from initial access to control-system manipulation.
.jpg?width=1000)
That unified timeline also changes incident response. Analysts frequently spend hours moving among a SIEM, an EDR console, email security, cloud logs and identity tools to determine what happened. The problem is not a shortage of alerts; it is the labor needed to connect them. Data-centric security architecture attempts to assemble those relationships continuously. Files, users, devices, sessions and cloud resources become linked entities rather than isolated log lines. Investigation can then begin with a coherent case instead of a pile of unrelated notifications.
This does not mean every byte must remain forever. Real-time analysis and long-term retention are different requirements. The pipeline can evaluate high-volume raw data when it is most valuable, then retain the events, features and relationships needed for hunting, compliance and forensics. That design can reduce storage pressure while improving detection coverage. The essential requirement is to make reduction an informed security decision, rather than allowing each upstream vendor to discard evidence before the broader system has a chance to examine it.
Large language models are not universal threat detectors
The video's sharpest claim is that generative AI is the wrong primary engine for attack detection. Large language models excel at producing and transforming language. Security detection is a different computational problem: identify rare, malicious behavior across enormous, noisy and fast-moving event streams. Even a large context window can hold only a small fraction of the telemetry generated by a sizeable organization. An LLM cannot evaluate evidence it never receives, and choosing the perfect evidence in advance would often require knowing the attack already.
Token economics compound that limitation. Continuously converting millions of events into prompts would be expensive, slow and operationally awkward. Rolling context windows also risk separating the beginning of a campaign from actions that occur hours or days later. Intrusions do not respect prompt boundaries. Attackers may establish access, wait, move laterally, change identities and exfiltrate information over a long period. Effective behavioral detection needs durable features and relationships that span those intervals without repeatedly sending the entire environment through a language model.
Machine learning is better suited to this first-pass task. Supervised models can recognize known malicious patterns, unsupervised techniques can surface deviations from normal behavior, and graph or entity analytics can connect events across users, hosts and applications. None of these methods is magic. Their accuracy depends on coverage, clean labels, feature design and continuous tuning. Yet they can process structured signals at the scale and frequency a modern SOC requires. Generative AI should enter after that machinery has narrowed the problem and assembled relevant context.
Use high-scale machine learning for detection, deterministic controls for hard policy, graph analysis for relationships, and generative AI for language, explanation and flexible interaction.
This division of labor offers a practical AI cybersecurity strategy. Detection can rely on statistical and behavioral systems operating inside the ingestion path. Deterministic controls can enforce non-negotiable rules. Graph analytics can build an attack timeline. An LLM can then translate the resulting case into plain English, answer an analyst's questions or propose response steps. Each technology handles the work it is structurally equipped to perform. The result is less dramatic than an autonomous cyber agent, but far more credible.
Generative AI has already changed the economics of offense
On the attacker side, generative AI matters immediately because it lowers the cost of experimentation. Criminals can use models to draft convincing phishing messages, vary social engineering campaigns, accelerate malware development, generate scripts and research potential vulnerabilities. A defense that blocks 99 percent of attempts sounds formidable until an adversary can cheaply create and test hundreds of variations. Scale turns the remaining one percent into an opening. The strategic posture therefore shifts from assuming prevention will hold to assuming some attacker activity will enter the environment.
That change does not make vulnerability management irrelevant, but it does expose the danger of treating patching as the whole cyber problem. The interview emphasizes that successful breaches frequently begin with stolen credentials, phishing, malicious insiders or compromised suppliers rather than a novel software flaw. A perfectly patched application can still be accessed with a valid session token obtained through social engineering. A trusted update can still carry malicious code if the software supply chain itself has been breached.
For defenders, "assume breach" is not an admission of defeat. It is an operating principle. Security controls still reduce the number of successful entries, but detection engineering must look for what happens next: unusual identity use, suspicious process execution, lateral movement, changes to cloud permissions, command-and-control traffic and data exfiltration. Those signals cross product boundaries. The cheaper it becomes to generate attacks, the more important it becomes to observe behavior across the entire environment and stop a campaign before it reaches its objective.
Where generative AI can deliver real value in the SOC
Once an incident has been detected and its timeline assembled, an LLM becomes genuinely useful. It can turn technical evidence into an incident narrative for a security leader, executive team or board. That task aligns with the model's strengths: summarization, translation, structured writing and audience adaptation. Instead of asking a language model to discover an attack inside an ocean of events, the platform gives it a curated case containing affected identities, endpoints, files, network connections and actions. The LLM explains what happened, why it matters and what remains uncertain.
Generative AI may also improve security orchestration, automation and response. Traditional SOAR products depend on predetermined playbooks: when a specific alert appears, execute a fixed set of steps. A model with access to a complete incident can suggest a response that reflects the actual path of the attack, such as revoking a session, isolating an endpoint, blocking a domain and preserving a particular cloud workload. Human approval and guardrails remain essential, especially for destructive actions, but dynamic recommendations can reduce the effort required to maintain thousands of rigid playbooks.
The interface is another strong use case. Analysts should be able to ask a security platform which accounts contacted a domain, request a timeline, change a policy or generate a dashboard in natural language. That conversational layer can hide navigational complexity without pretending that the conversation itself performs detection. Outside the SOC, models may help interpret the business context of sensitive information. A quarterly earnings document, for example, changes from highly confidential to public at a specific time. Language-based reasoning can help policy systems understand that shift.
Even these applications depend on preparation. A useful incident report requires examples of strong reporting, a reliable timeline and domain-specific post-training or retrieval. A safe response recommendation requires approved actions, permission boundaries and evidence. A natural-language interface requires an accurate control plane beneath it. Organizations cannot skip those layers by buying a generic model. Generative AI is best treated as a reasoning and communication surface over trusted security infrastructure, not as a replacement for that infrastructure.
Data sovereignty turns architecture into policy
Sending security telemetry to an external model introduces a second category of risk. Emails, source code, files, identity records and endpoint activity may include an organization's most sensitive information. Financial institutions, defense organizations, governments, healthcare providers and critical infrastructure operators may be restricted from moving that data into a public AI service. Even where regulation permits cloud processing, leaders must understand retention, model-training, residency, access and breach implications before handing a provider the raw material of their internal operations.
Running models on-premises or inside a controlled private cloud can address some of those concerns, but it returns the discussion to cost and engineering. GPUs, storage, updates, model evaluation and access control all have to be operated. The attraction of sovereign AI cybersecurity is therefore not simply that hardware sits in a customer's building. It is that collection, detection, investigation, generative AI and automation can function as one controlled system without exporting the underlying data. Sovereignty must apply to the entire processing path, not just the final archive.
The interview is ultimately a warning against architectural shortcuts. Adding delayed EDR data to a SIEM does not create full visibility. Placing an agent over disconnected consoles does not create a unified timeline. Loading logs into a data lake does not create detections. And attaching an LLM to that lake does not create autonomous defense. Each step may offer incremental value, but the claims made for it should match the evidence and the underlying data quality.
The AI security race will be won below the chatbot
The most important takeaway from the video is not anti-AI. It is a demand for technical precision. Artificial intelligence in cybersecurity is a family of tools, not a single product category. Generative models can help people understand incidents, operate complex systems and design flexible responses. Machine learning can inspect vast event streams and find behavioral anomalies. Deterministic systems can enforce policy at speed. Human analysts can investigate ambiguity, test hypotheses and make accountable decisions. Strong defense combines those capabilities around complete, well-governed data.
For chief information security officers evaluating AI security platforms, the due-diligence questions should start with architecture. Which raw signals are collected? What is discarded? Can detections run during ingestion? How are identities, files, devices and cloud resources correlated? How long can a behavioral timeline extend? Which tasks use an LLM, which use machine learning, and what does each task cost at enterprise scale? Where is sensitive data processed, and can the provider train on it? Those answers reveal more than a polished copilot demonstration.
Attackers will continue using generative AI to increase speed, variety and reach. Defenders cannot answer that pressure with branding alone. They need real-time telemetry, resilient pipelines, disciplined detection engineering, governed automation and models chosen for the actual workload. The interface may look like a conversation, but the protection comes from everything beneath it. In the next era of cybersecurity, the organizations with the clearest view of their data will have the best chance of finding an adversary already inside.