AI Reshapes Cybersecurity Jobs: Automation of Routine Tasks, Rising Demand for Architects and AI Defenders
The ongoing cognitive revolution driven by AI technologies will not leave the labor market in information security untouched. This article examines the tectonic shift underway: how autonomous agents are displacing linear routine work, which specializations are becoming scarce, how the architecture of cyber defense will change by 2030, and what engineers should learn today.
Artificial intelligence does not cancel information security; on the contrary, by expanding the attack surface it makes the InfoSec market larger. The key question is what role remains for humans. For a long time, a specialist’s value was measured by the volume of mechanical work: the number of alerts dissected, log lines reviewed, reports sent, or checklist settings verified. Today these streaming operations are being taken over by language models and autonomous agents. Humans are moving to the level of setting frameworks, verifying hypotheses, and being the sole subject bearing legal and financial responsibility for decisions made.
The main automation risk arises not for the “security professional” profession as a whole, but for positions consisting entirely of repeatable deterministic actions. At the same time, the shortage of system architects, AppSec and DevSecOps engineers, specialists protecting AI circuits themselves, and experts who can link raw network anomalies to business risk is sharpening.
Automation of Actions Instead of Automation of Responsibility
In May 2026 the international association ISC2 surveyed 856 cybersecurity specialists who regularly use AI in operational processes. Over one year, 65% of respondents began spending substantially more time deciding whether model outputs can be trusted, and 63% spent more time directly verifying results. At the same time, exactly 50% emphasized that in case of an erroneous decision, full responsibility in their company rests solely with the human.
Models handle primary event triage, alert deduplication, log normalization, rough vulnerability prioritization, and basic threat hunting. However, saved hours are redirected to validation, resolution of edge cases, and auditing agent reasoning chains. Trust in generative system outputs remains critically fragile: 89% of practicing security professionals have already encountered gross errors and hallucinations from AI-based tools.
Futuristic Outlook: Machine vs Machine Through 2027–2030
Transformation is occurring against the backdrop of a shift from static protection to confrontation between autonomous systems. DARPA’s AIxCC competition showed autonomous cyber defense systems capable of finding defects and generating patches without operator involvement, yet academic audits revealed that 37.7–45.6% of generated fixes contained hidden semantic errors.
Gartner forecasts more than 10 billion autonomous software agents by 2030 and warns of “Cost Exhaustion Attacks” that could drain operational budgets of organizations running public AI services. By 2027, attacks on AI systems are projected to exceed $4.78 billion globally.
Market Polarization and Russian Specifics
Global demand for cybersecurity specialists grew 9.5% year-over-year, with senior positions surging 65% while junior roles grew only 5.9%, according to the AI Workforce Consortium led by Cisco. In Russia, vacancies in information security rose 24–26% in 2025–2026 per Positive Technologies and SuperJob data, yet 46% of companies do not open junior positions because they are unwilling to invest in on-the-job training.
The following table summarizes how 13 specializations are evolving under AI automation, showing what routine tasks are being removed and what complex human responsibilities remain.
Related articles
Detecting Deepfakes: Tools, Signs, and Verification Methods for Video, Photos, and Voice
Deepfake technology now creates highly convincing synthetic videos, photos, and audio that can impersonate real people in video calls or voice messages. The article explains how modern neural networks using GANs, diffusion models, and transformers generate face swaps, voice clones, and fully synthetic scenes. It details visual and audio artifacts that may reveal fakes, such as inconsistent lighting, deformed fingers, or unnatural speech pauses, while noting that these signs are becoming less reliable. Practical verification steps include reverse image searches, metadata analysis, and tools like InVID-WeVerify. Specialized detectors such as DeepFake-o-Meter, Reality Defender, and Sensity AI are reviewed along with their limitations against unknown generators. Real-world cases, including a $25 million corporate fraud using deepfake video calls, illustrate the growing risks and the need for independent confirmation rather than relying solely on automated tools.
Can Open-Source AI Agents Replace Pentesters? Strix and PentAGI Tested on Real 200-Host Perimeter
An independent researcher evaluated two open-source LLM-based pentesting agents, Strix and PentAGI, against a live external perimeter containing roughly 200 active hosts. Both tools autonomously planned tasks, executed CLI utilities, generated proofs of concept, and produced reports while running inside isolated Docker sandboxes. Strix delivered only 15 findings with almost no false positives yet consistently overstated severity, while PentAGI reported 296 vulnerabilities including 42 critical issues, none of which proved exploitable. Real critical vulnerabilities on the same scope, including an RCE chain, were discovered only by a commercial autonomous scanner. The experiment highlighted fundamental limitations in scope control, context management, and risk assessment that still require human oversight. Token consumption reached 145.1 million for Strix and 31.4 million for PentAGI, illustrating the cost of maintaining long-running autonomous operations.
Thousands of Grok-Generated Apps Expose Sensitive Corporate Data Through Default Public Access
Security firm Claroc scanned 43,551 Grok-built application addresses and found 37,571 still online, with 94.7 percent requiring no login. Approximately 650 to 800 of these apps contained sensitive internal data belonging to SpaceX, X, Tesla, and 30 other organizations, including six Fortune 500 companies. Exposed records included ICU patient reports with lab results and ventilator status, contractor timesheets containing plaintext passwords, and Tesla service-center performance evaluations listing employee names, efficiency metrics, and bonuses. Researchers demonstrated that Grok sometimes inverts permission-check logic, allowing unauthorized Google accounts to view and modify data after login. In contrast, ChatGPT-generated apps default to private settings, preventing access even when URLs are discovered via passive DNS. The incident highlights how AI coding tools lower the barrier to publishing internal applications while weakening the review processes that traditionally protected sensitive data.
Enterprise Security Requirements Push Russian Developer to Deploy 125B MoE LLM Locally on Consumer Hardware
A cybersecurity journalist and platform developer detailed his transition from cloud-based AI agents to a fully local 125B-parameter MoE model after enterprise clients raised strict data-exfiltration concerns. The move was driven by the need to keep task statements, source code, configuration files, logs, and regulated personal data inside the corporate perimeter. After testing multiple inference engines, he settled on the Strata engine running a Qwen3.8-Flash-Next model quantized to IQ3_S, achieving 22-25 tokens per second generation and over 500 tokens per second prefill on an RTX 5060 Ti 16 GB GPU paired with a Xeon E5-2640 v3 and 128 GB DDR4. Extensive calibration of expert caching, PCIe fraction, KV streaming, and speculative decoding proved critical to reaching production-grade performance. The resulting setup now handles real agentic workloads such as incident investigation from traces, backlog grooming, and code generation without any data leaving the workstation. The author concludes that hybrid cloud-local workflows will become standard for development teams handling sensitive information within the next one to two years.