‘The future is not a straight line. It is filled with many crossroads. There must be a future that we can choose for ourselves.’ – Kiyoko, Akira.
The Self Selecting Prophets
Historically, much of cybersecurity has operated as a game of whack-a-mole: breach, patch, breach again, then patch new vulnerabilities ad infinitum.
So far, the rhetoric around AI adoption has been shaped by the most dominant voices, those with unfettered access to resources and platforms to steer the narrative. Without accountability, they claim that humanity moves toward obsolescence. Some of the most influential voices simultaneously argue that advanced AI poses existential risks, while asserting that only the organisations building these systems possess the expertise to mitigate them.
Computational power is a structural constraint on frontier AI development; its concentration reflects and reinforces the distribution of technical, economic, and geopolitical power. According to the Preliminary Report on Artificial Intelligence, published by the United Nations on 1 July 2026, the United States operates 75% of the world’s top 500 AI supercomputers, China operates 15%, and the rest of the world shares 10%.
These figures obscure the structure beneath them. A small number of US companies maintain control and compete to consolidate it further. The leaders of frontier AI companies act as self-selected prophets of technological progress. To counter this, a different relationship with technology-built on scepticism, verification, and local control-must be enacted.
Photo by Moujib Aghrout on Unsplash
Our SOC Who Art in the Cloud
The prevailing model of AI often asks defenders to surrender control in exchange for capability. In many deployments, sensitive telemetry is processed within cloud platforms, and proprietary models operate as black boxes, making outputs difficult for analysts to interrogate.
Intelligence work is the continual construction and testing of hypotheses about adversaries, infrastructure, and intent. The value of the analyst lies in context and judgement, not in producing answers quickly. While massive cloud-based LLMs excel at macro-trend analysis and historical data crunching, no mature intelligence methodology advocates blind acceptance of AI outputs. Cybersecurity must champion a hybrid model: centralised cloud infrastructure handles the broad strokes, while local human judgment retains transparent, contestable control.
Instead of treating AI as an authority to defer to, cybersecurity shows the value of treating it as an instrument, one whose outputs must remain transparent, contestable, and subordinate to human judgement.
The Reformation
The belief that bigger is better sits at the centre of the current AI moment, a reflection of both marketing power and human bias. In this context it follows that large language models provide the default entry point, offering availability, efficiency and convenience. If LLMs represent a centralised, cloud-dependent megacity model of AI, Small Language Models (SLMs) represent decentralised, specialised local communities.
For CTI professionals, scale helps execute large tasks, but it increases the risk of losing human oversight. Fine-tuning small models on security telemetry-raw JSON logs, network traffic, indicator feeds, can improve speed and precision, while enabling local execution that better preserves privacy.
This is grounded in operational reality. Studies of compact open-source models, including IBM’s Granite and Microsoft’s Phi family, show that, on targeted tasks, they can achieve performance approaching much larger systems while requiring a fraction of the computational resources.
As these models require less computing power, effective AI defence becomes more accessible allowing individual analysts, small teams and underfunded organisations to operate beyond their scale. A hospital, a small family-owned business, or a local bank can run an SLM on existing hardware, and many can be deployed entirely offline, keeping sensitive data within physical control.
Redefining the Weakest Link
Cybersecurity has long operated on an assumption that the human is the weakest link, a liability to be managed. What if we reject this premise entirely? What if humans are the strongest link in the system?
That shift does not belong only to professional analysts. It applies wherever humans interpret information, make judgements, and act under uncertainty. Cybersecurity simply makes that process visible.
In that sense, threat intelligence work is not an exception-it is an intensified version of a general condition. Analysts operate under constant conditions of overload, but anyone operating in digital systems now navigates similar noise: fragmented data, automated outputs, and systems that demand interpretation. Manoeuvring through this environment toward signal defines the modern condition, not just the analyst’s role.
Choosing Our Future
The path forward provides an opportunity to build a decentralised, human-centric digital defence system. The trajectory of AI in cybersecurity emerges from the systems we build, because every technological design encodes a distribution of power.
This is the future we must choose for ourselves.
Leave a Reply