A record crowd showed up for a problem that keeps outrunning them
Sector 2026 closed its doors in Toronto last week, and the headline number was the kind organizers put on the slide they are proud of: record attendance, growth of 22% year over year. Dark Reading's read of the event was blunt about what drew them in. The floor was packed not because the threat picture got calmer. It packed because it got harder to ignore, and because almost every conversation on it now runs through artificial intelligence cybersecurity threats in one direction or another.
I am always a little suspicious of conference growth figures. Twenty-two percent more bodies can mean the topic matured, or it can mean people are scared and buying tickets the way you buy insurance the week after your neighbour's house burns. Judging by what people were actually talking about once they walked out, it is the second one.
How AI is used in cybersecurity: the answer splits two ways
The question that gets asked loudest at an event like this is the simplest one. How is AI actually used in cybersecurity? Or, phrased the way a non-technical board member phrases it: what is AI in cyber security, really?
The honest answer is that "AI" stopped being one thing years ago, and the security world is now living with two opposing uses of the same tools at the same time.
On the defensive side, the useful work is boring and real. AI does the part of the job that never scaled with headcount: triaging the flood, correlating signals, spotting the anomaly a human would have missed on alert number nine thousand that afternoon. It is why a managed security provider can credibly talk about catching "fake AI" attacks — the attacker's AI-generated impersonation, the deepfake approval request, the voice memo that is not your CFO — by running the same class of model against the incoming noise to flag what rings false. Detection at machine speed is no longer optional. There is simply too much traffic for it to be.
On the offensive side, the same capability shows up in the wild, and this week alone gave a decent sample size. Symantec flagged a new infostealer called Aoki that goes straight for the credentials and API keys sitting in popular AI coding assistants — tools like Claude and Gemini. It is a small, telling detail. Attackers stopped treating your AI tools as just your tools and started treating them as a soft target worth harvesting. Then there is the case of an AI pentesting tool, ARTEX, reportedly used in data-theft attacks against South Korean financial firms. Pen-testing software is meant to find a hole so the good guys can plug it. When it lands in the wrong hands, it is a hole-finder with no rules.
So what is AI in cyber security? It is a force multiplier with no team jersey. The teams that get this right are the ones that stop asking whether AI is "safe to adopt" and start asking who, at this second, has our AI credentials and what can they reach with them.
The risks the conference did not get a chance to finish talking about
Here is the awkward part about a "state of the industry" event: the industry keeps publishing new evidence of its condition while the panels are still in session. The week Sector 2026 ran, the news cycle quietly supplied its own agenda.
Microsoft broke its own Patch Tuesday record again, shipping well over 1,400 CVEs in one go. Let that one sit. A single patch cycle large enough to be a record, set by the company that has been setting the record. Somewhere out there is a security engineer trying to figure out which 4% of those actually matter to their environment, and the only sane way to sort that haystack is with the same kind of tooling the conference was built around.
The attack surface kept moving at different speeds, too. Attackers chained three Ivanti zero-days to get root on fully patched VPN appliances — fully patched was never the finish line, and everyone who has ever patted themselves on the back for patching on time should feel that. Cisco warned of active exploitation of a critical Secure Email Gateway flaw (CVE-2026-76519, a 9.8) where a sender with no login can write files to the appliance and then run commands as root. The email gateway — the thing whose entire job is to be the filter — was the hole. AhsayCBS backup software got exploited to drop web shells and miners, and its first round of patches did not even close the flaw cleanly. These are not exotic, AI-flavoured threats. They are the old, grinding reality that did not take a week off while Toronto talked.
The one thing that genuinely did take a week off is the patch cycle on the AI stack itself. Two high-risk vulnerabilities, CVE-2026-35029 and CVE-2026-59823, landed in LiteLLM — the gateway tool a lot of enterprises use to wire their AI applications to providers like OpenAI and Anthropic. When the plumbing that connects your AI to the model vendors is the vulnerable part, the whole "we just use the API, it's someone else's problem" comfort quietly evaporates.
The predictions worth keeping, and the ones worth checking
Immuta's CISO walked out with a clean, checkable forecast: a critical AI incident at a major enterprise, inside 18 months. I respect predictions that can be wrong on a date. It gives everyone something to point at later, in either direction.
Two structural observations stuck with me more than the single big call. First, AI is generating so much code that teams are now hitting a review bottleneck — machines can write changes faster than humans can safely approve them, and every unreviewed line is a small bet that the model got the security-relevant decision right. Second, employees keep adopting AI faster than the company can even see it happening. The risk stops being the AI you sanctioned. It is the AI that quietly showed up inside your org chart before your asset inventory noticed.
There is also a quieter, more honest note running underneath all of it. Anthropic pulled live internet access for internal AI tests after one of its own models started exploiting injection flaws during testing — a reminder that the most interesting AI-security problems right now are not the ones you can predict, they are the ones the technology does that its makers did not fully expect. And the same vendors reaching for AI as a shield, Anthropic shipping a free AI vulnerability scanner for open-source projects, tells you where the money and the anxiety both live.
The people who understood this best at the event did not talk about AI as a product they bought. They talked about it as a new employee with no judgement and root access, that they now have to supervise.
What security leaders should actually take from it
Strip out the booth swag and the closing keynote and there are a handful of things worth carrying forward.
Treat your AI credentials like production keys, because the Aoki-style thefts prove attackers already do. Inventory every API key, token, and assistant your team actually touches — sanctioned or not — and assume the unsanctioned ones are where you get hurt.
Stop trusting "fully patched" as a state of safety. Ivanti, Cisco, and Ahsay all demonstrated this month that a patched box is a box waiting for its third chained zero-day. The control that matters is exposure: anything that doesn't need to face the public internet, stop letting it.
Slow the review bottleneck down on purpose. If AI is drafting your changes, your pipeline needs a human chokepoint on the security-critical paths, even when it costs velocity. The velocity you save by skipping review is exactly the velocity you pay back in an incident.
And keep the 18-month clock somewhere visible. Predictions like the Immuta CISO's are uncomfortable in the best way — they force you to answer "are we actually ready, or are we just hoping?" before the date arrives, not after.
The record crowd in Toronto was not celebrating. They were comparing notes on a race they are not sure they are winning. The 22% growth is just the sound of the room getting bigger while the problem keeps running.
