Is AI Making IT More Secure or More Exposed?
Cybersecurity Risks and Opportunities: What IT Professionals Need to Know

Artificial intelligence is accelerating digital transformation, but it is also reshaping the cybersecurity landscape. AI can help organisations strengthen cyber defence, yet the same technology can make certain attacks faster, more scalable and harder to detect. For IT professionals, cybersecurity is therefore becoming more than a specialist technical function: it is an increasingly important area for professional development.

What Risks and Opportunities Does AI Bring to Cybersecurity?
AI can help threat actors create convincing phishing and social engineering content, analyse vulnerabilities and conduct activities more efficiently. At the same time, AI-enabled security tools can support threat detection, alert analysis and incident response. Human expertise remains essential for risk assessment, governance, accountability and business decisions.

The Risk: Cyberattacks Can Become Faster and More Convincing

Generative AI can quickly produce fluent and targeted text, images and audio. This may make phishing emails, false information and social engineering attempts appear more credible and more difficult to identify at first glance. The UK National Cyber Security Centre has assessed that AI is likely to increase the frequency and impact of cyberattacks and lower the technical barrier for some malicious activities.

The growing adoption of AI within organisations creates another challenge. Business data may pass through a wider range of applications, cloud platforms and third-party services. If organisations introduce AI tools without reviewing data flows, access permissions, system integration and supplier arrangements, they may increase the risk of data exposure or inadequate security control.

The Opportunity: AI Can Also Strengthen Cyber Defence

AI is not only available to attackers. Some cybersecurity tools can help security teams to:

• analyse large volumes of system records and recognise unusual patterns;
• prioritise security alerts for investigation; and
• reduce repetitive initial analysis and accelerate incident response.

However, AI-generated analysis and recommendations still require professional verification. Security teams must interpret the findings in the context of the organisation’s systems, business needs and risk appetite. Decisions about which alerts require immediate attention, which response is appropriate and how to balance security with operations cannot be delegated entirely to a tool.

AI therefore does not mean that organisations no longer need cybersecurity professionals. As the pace of cyber offence and defence increases, organisations need people who can apply professional judgement, governance and risk management to turn technical findings into appropriate action.

Can AI Replace Cybersecurity Professionals?

AI can support threat detection, data analysis and selected automated tasks, but it cannot independently assume responsibility for an organisation’s risk decisions, governance obligations or business priorities.

A cybersecurity incident may affect operations, finance, regulatory compliance, reputation and multiple groups of stakeholders. Responding effectively involves assessing the wider impact, determining priorities, coordinating different teams and explaining risk clearly to management. The future is therefore not a simple choice between people and technology: organisations need professionals who can use AI effectively while applying sound judgement in cybersecurity governance, risk management and incident response.

Why Do IT Professionals Need to Strengthen Their Cybersecurity Capabilities?

IT professionals with experience in systems administration, software development, network operations, data or AI already possess a valuable technical foundation. However, enterprise cybersecurity extends beyond patching vulnerabilities, configuring firewalls or keeping systems operational. Organisations must also identify risks, establish policies, allocate resources and maintain critical operations when incidents occur.

The role of an IT professional is therefore expanding from ensuring that technology works to helping the organisation understand, manage and withstand cyber risk. Further study in cybersecurity can help experienced IT professionals build a wider enterprise security perspective on top of their existing technical knowledge.

How Can IT Professionals Prepare for the AI Era?

IT professionals do not necessarily need to leave their existing specialism or make a complete career change. A more practical approach is to build on their current technical experience and understand how their work connects with enterprise security, business risk and operational decisions.

• Systems and network operations professionals: In addition to maintaining stable systems, they need to consider access control, incident response and business continuity.
• Software and application developers: In addition to building functionality, they need to understand secure design, vulnerability risk and data protection.
• Data and AI professionals: They need to consider data flows, third-party services, and the security and ethical implications of emerging technologies.

Preparing for the AI era is therefore not only about learning to operate another security tool. IT professionals need the ability to identify risk, assess its impact and approach cybersecurity from the perspective of the organisation as a whole.

Which Cybersecurity Capabilities Are Valuable for IT Professionals?

• identifying, assessing and managing cybersecurity risks at an organisational level;
• translating technical issues into business implications that management can understand;
• planning cyber defence, incident response and business continuity measures;
• evaluating the security and ethical implications of AI and other emerging technologies; and
• coordinating technical teams, management and different business functions.

These capabilities enable IT professionals to contribute beyond individual technical tasks and participate more fully in cybersecurity governance, risk management and operational decision-making.

Why Is a Systematic Approach to Cybersecurity Development Important?

Cybersecurity is not a single technical skill. Governance, risk management, engineering, operations, incident response and emerging technology security are closely connected. Learning individual tools can address selected operational needs, but it may not provide the wider judgement required at an enterprise level.

For professionals with an IT background, systematic postgraduate study can connect their existing technical experience with cybersecurity governance, risk and operations. It can support progression from carrying out individual technical tasks to contributing to enterprise security planning and decision-making.

Developing a Broader Cybersecurity Perspective

The part-time MSc in Cybersecurity offered by HKCT Institute of Higher Education can be completed in two years. The programme covers areas including Advanced Cybersecurity Governance and Risk Management, Cybersecurity Engineering and Operations, and Integrated Organisational Cybersecurity Framework. It is suitable for professionals who wish to strengthen their cybersecurity capabilities while continuing to work.

Related CTIHE programmes in Cybersecurity

Master of Science in Cybersecurity