AI-Driven Cyber Risk Management in Adaptive Threat Environments

Abstract

The fast integration of generative artificial intelligence (AI) into the work of cybersecurity has radically changed the face of cyber threat in modern companies. Attackers are now able to automate reconnaissance, create adaptive malware, and perform large-scale and individualized social engineering, and defenders are now increasingly relying on AI-based detention, automated response, and security coordination. The convergence has resulted in a rapidly changing adversarial environment where classical governance and risk management frameworks of cybersecurity are becoming less effective. This paper suggests a framework of engineering management of governing AI-enabled cyber risk, comprising adaptive risk evaluation, responsible AI governance, and strategic investments prioritization. The research paper uses a mixed-method design science methodology, which is based on the conceptual framework formulation, synthesis of the findings of the AI red-team and blue-team simulation studies conducted in previous research and qualitative synthesis of the reported individual industry cases. The framework describes how the management processes in engineering have to change as attackers and defenders switch to using generative AI, and introduces dynamical risk measures, multi-functional governance systems, and lifelong learning systems to aid adaptive defense. Findings can be used in the area of cybersecurity governance, engineering management scholarship, and offer guidance in practice that can be utilized by practitioners and policymakers to minimize AI-related cyber risk and maintain organizational resilience.