[2504.13371] The Impact of AI on the Cyber Offense-Defense Balance and the Character of Cyber Conflict

The Impact of AI on the Cyber Offense-Defense Balance and the Character of Cyber Conflict

 
 
 Andrew J. Lohn
 
 Center for Security and Emerging Technology, Georgetown University 
 
 

 
 Abstract

 Unlike other domains of conflict, and unlike other fields with high anticipated risk from AI, the cyber domain is intrinsically digital with a tight feedback loop between AI training and cyber application. Cyber may have some of the largest and earliest impacts from AI, so it is important to understand how the cyber domain may change as AI continues to advance. Our approach reviewed the literature, collecting nine arguments that have been proposed for offensive advantage in cyber conflict and nine proposed arguments for defensive advantage. We include an additional forty-eight arguments that have been proposed to give cyber conflict and competition its character as collected separately by Healey, Jervis, and Nandrajog. We then consider how each of those arguments and propositions might change with varying degrees of AI advancement. We find that the cyber domain is too multifaceted for a single answer to whether AI will enhance offense or defense broadly. AI will improve some aspects, hinder others, and leave some aspects unchanged. We collect and present forty-four ways that we expect AI to impact the cyber offense-defense balance and the character of cyber conflict and competition. 

 
 
 Keywords : AI, cyber, offense-defense balance, conflict, crisis 

 

 
 1. Introduction

 
 Of all the domains that AI is likely to affect, cybersecurity and cyber conflict may be the most significant ( Younis , \APACyear 2023 ; Silver , \APACyear 2022 ) . As a digital domain, cyber is naturally amenable to incorporating AI advances. Cyber’s digital nature also benefits AI advancement in that useful data can be easily generated through normal operations, directed experiments, or through autonomous self-play. While cyber may not usually be as directly disastrous as risks from some other domains such nuclear war or biological pathogen development, cyberattacks can, in principle, lead to disasters in almost all other domains ( S. Smith , \APACyear 2021 ; Radoini  \BBA Siddiqui , \APACyear 2021 ) . 

 
 
 As AI continues to progress and continues to be incorporated into nearly every domain, any clues about how those domains will change become more valuable. Whether the changes are for better or worse, knowing that they may come provides time for society to adjust and prepare. Although predictions about the future of technology are highly uncertain, considering possible futures allows policymakers, regulators, and society as a whole to make decisions that lead to preferable futures that are less risky. 

 
 
 In this article we try to take a comprehensive view of how AI may affect the character of cybersecurity and cyber conflict and ask whether AI will benefit offense or defense. The question of whether cyber has historically been offensively or defensively biased has

... (truncated, 98 KB total)