Cybersecurity Professionals Spend More Time Reviewing AI Outputs Than Coding

A recent survey of cybersecurity professionals indicates that the industry is shifting focus from creation to verification. According to data cited by Gizmodo, two-thirds of more than 850 security experts reported spending more of their time on the job reviewing AI outputs. These professionals are primarily tasked with determining whether to trust the automated suggestions provided by artificial intelligence tools in their daily operations.

This shift highlights a growing reliance on automation within the field. While AI adoption has increased efficiency for many organizations, it has also introduced new complexities in software development. The survey results suggest that much of modern cybersecurity revolves around trying to interpret AI. This trend raises questions about the long-term impact on professional expertise.

Impact on Technical Mastery

Research indicates that this heavy reliance on AI may be eroding technical skills among developers. In a study involving over 50 mostly junior software engineers, Anthropic found that using AI for coding resulted in a statistically significant decrease in mastery. The study suggests that while automation aids productivity, it can turn the programming process into a black box where underlying logic is less understood by the human operator.

The implications extend beyond individual skill sets to broader national security concerns. As programmers depend more on AI tools, the depth of their understanding of system vulnerabilities and code structure may diminish. This potential loss of critical thinking and creativity could have downstream consequences for the security of complex software systems that protect critical infrastructure and government operations.

Legacy Systems and Workforce Challenges

The cybersecurity landscape is further complicated by the persistence of outdated technology in government agencies. A July report from the U.S. Government Accountability Office found that the Department of Defense’s in-house IT system has been in use since before the first Apollo moon landing. The GAO noted that these legacy systems provide vital support for essential missions, including health care and national security, despite their age.

COBOL, a programming language invented in 1959, remains widely used on IBM mainframe computers across various government agencies. The Department of the Treasury and the Environmental Protection Agency also rely on similarly aged systems. During the pandemic, the governor of New Jersey had to request "cobalt" programmers to maintain the state’s overwhelmed unemployment system. This reliance on obsolete technology creates a unique challenge for a workforce increasingly focused on AI rather than legacy code maintenance.

What should you do?

Organizations should assess how much AI-generated code is entering their production environments without rigorous human review. Security teams need to establish clear protocols for verifying AI outputs to ensure they do not introduce vulnerabilities. Leaders should also monitor the technical proficiency of their staff to prevent skill atrophy.

What to do and how to stay safe

• Implement mandatory peer reviews for all AI-generated code before deployment to catch potential errors or security flaws.
• Conduct regular training sessions to ensure staff understand the underlying logic of the systems they are managing, not just the AI outputs.
• Audit legacy systems to identify dependencies on outdated languages like COBOL and assess the availability of skilled personnel to maintain them.
• Develop guidelines for AI usage that balance efficiency gains with the need for human oversight and critical thinking in security operations

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.