Digital Business
September 16, 2026
Artificial Intelligence as a Lever for Cyber Resilience in Medium and Large Organizations
Murilo Gorski Rodrigues; Daniel de Sousa Valoto
DOI: 10.22167/2675-6528-202602287
Article derived from a Final Course Work (TCC), with content based on the student’s original work and adapted to the editorial format of the E&S Magazine with the support of the ResumeAI tool, an artificial intelligence solution developed by the Pecege Institute for textual synthesis and organization.
Abstract
The digitalization of business operations has expanded organizations’ exposure to cyber risks, intensified by automated attacks based on Artificial Intelligence. In this context, cybersecurity has become critical for business continuity, demanding adaptive and efficient defenses. The study analyzed how Artificial Intelligence applied to cyber defense contributed to the operational resilience of medium and large organizations, especially in incident response and service continuity processes, facing the increase of automated AI-based attacks. A qualitative, exploratory, and descriptive approach was adopted, based on semi-structured interviews with cybersecurity professionals from specialized companies. The collected data were analyzed through thematic content analysis. Patterns related to the use of AI in threat detection, incident response automation, and reduction of operational recovery time were identified. The results indicated that Artificial Intelligence was perceived as a relevant element for increasing the agility and effectiveness of cyber defenses, although challenges persist regarding the maturity of solutions, integration with existing processes, and trust in automated models. It was observed that the application of AI can strengthen organizations’ operational resilience, provided it is accompanied by adequate governance and technical training.
Keywords: cybersecurity; service continuity; artificial intelligence; operational resilience; incident response.
1. Introduction
With the increasing digitalization of business operations, data and information have become predominant in the online environment. It is estimated that more than 400 million terabytes of data are generated daily in the digital environment (SiDi, 2025), a volume that continues to grow rapidly.
This data has become valuable for both the growth of companies and the actions of digital criminal groups. In this scenario, cybersecurity, defined as the set of practices, technologies, and processes aimed at protecting systems, networks, and data against unauthorized access, attacks, and damage (NIST, 2018), has positioned itself as the fourth largest source of risk with a high probability of generating crises on a global scale in the coming years (World Economic Forum, 2024).
Advances in Artificial Intelligence (AI) have intensified this scenario, making it accessible and globally disseminated, including among cybercriminals (Gizmodo, 2024). Market data indicate that criminals use large language models, such as ChatGPT, to enhance cyber scams (Exame, 2025), and 86% of companies reported suffering attacks related to the use of AI between 2024 and 2025 (Cisco, 2025). This movement has resulted in an increase in adaptive attacks, which adjust strategies in real-time to evade traditional detection mechanisms (Delos, 2024).
For companies, the challenge lies not only in the growing volume of attacks but in the difficulty of developing defense mechanisms at the same speed, which increases operational risks and impacts business continuity. However, AI has also emerged as a relevant element for strengthening organizations’ defenses. Machine learning-based tools have been widely used in intrusion detection and prevention systems, processing large volumes of data in real-time and continuously learning from previous incidents (Matiz, 2023).
Organizations that adopted AI and automation solutions in their security processes managed to reduce the average incident identification and containment time by more than 90 days, increasing operational efficiency and response capacity to attacks (IBM, 2023). AI has been integrated into orchestration, automation, and incident response platforms, automating repetitive tasks and allowing security teams to focus efforts on more complex and strategic threats, in addition to strengthening threat hunting practices (Silva, 2024).
Despite the observed benefits, the adoption of AI in cybersecurity still faces relevant challenges. Among them, the lack of algorithm transparency, the risk of false positives, and the difficulties in updating models against the constant evolution of attack vectors (Matiz, 2023; Delos, 2024) stand out. These limitations reinforce the need for studies that analyze the practical application of AI and its real impacts on organizations’ digital security, especially from the perspective of operational resilience.
Operational resilience is understood as the ability to maintain essential functions even in the face of incidents, by absorbing impacts, adapting quickly, and resuming operations without significant interruptions (NIST, 2024). In the context of medium and large companies, operational resilience has taken on a strategic role, given the dependence on complex and critical digital environments for the continuity of operations. The ability to respond quickly to incidents, minimize impacts, and keep essential services running has thus become fundamental.
In this scenario, AI has been used as an enabler to increase efficiency and reduce response time, although its effectiveness still depends on the maturity level of processes and the integration between technology, people, and governance. The relevance of Artificial Intelligence for cybersecurity and the need to understand its practical impacts justify this study. Thus, the objective of this research was to analyze how Artificial Intelligence applied to cyber defense contributes to the operational resilience of medium and large organizations, especially in incident response and service continuity processes.
2. Material and Methods
The research had descriptive objectives, seeking to analyze the manifestation of Artificial Intelligence (AI) in cyber defense within a specific organizational context. The study focused on understanding and describing the application of AI in digital security strategies and its effects on the operational resilience of medium and large organizations, especially in incident response and service continuity processes, from the perception of market professionals.
A qualitative approach was adopted, based on the collection of participants’ perceptions, professional experiences, and interpretations regarding the use of AI in cybersecurity (Creswell, 2014; Gil, 2008; Sampieri et al., 2013). The research design was a qualitative field survey, chosen to collect direct information from professionals and capture real perceptions and experiences about the use of AI in digital security (Lakatos and Marconi, 2003; Mattar, 2005; Sampieri et al., 2013).
Data collection occurred in two stages, using two main instruments. The first consisted of documentary and bibliographic research, based on secondary sources such as scientific articles, technical reports on cyberattacks, public sector documents, and specialized publications in cybersecurity. This initial stage contextualized the problem and supported the construction of the interview script. The documents were identified through targeted searches in academic and institutional databases (Google Scholar and official repositories), prioritizing recent studies, market reports, and technical publications with practical application in the organizational context. The list of analyzed documents can be found in Table 1.
Table 1. Documents used in the research.
| Document type | Title | Year | Number of pages |
|---|---|---|---|
| Market Report | Cybersecurity Readiness Index | 2025 | Not applicable |
| Institutional Report | Global Risks Report | 2024 | 96 |
| Technical report | Cost of a Data Breach Report | 2023 | 83 |
| Scientific article | Artificial Intelligence Applied to Cybersecurity | 2023 | 12 |
| Scientific article | Cybersecurity and Artificial Intelligence | 2024 | 18 |
| Academic work | The Importance of Artificial Intelligence in Information Security | 2024 | 65 |
| Technical framework | NIST Cybersecurity Framework 1.1 | 2018 | 48 |
| Technical framework | NIST Cybersecurity Framework 2.0 | 2024 | Not applicable |
| Technical report | Hackers are using AI to enhance scams | 2025 | Not applicable |
| Technical report | Hackers create FraudGPT with malicious AI | 2024 | Not applicable |
Source: Original Survey Data.
The second data collection instrument was the realization of in-depth semi-structured interviews, conducted remotely with cybersecurity professionals and specialists working in companies specialized in providing digital security services for medium and large organizations. The interview script, composed of 17 open-ended questions organized into thematic axes (role of AI in incident detection and response, impacts on service continuity, operational benefits, technical limitations, and challenges), was developed from recurring themes in the literature and market reports (Matiz, 2023; Delos, 2024; IBM, 2023; Cisco, 2025; World Economic Forum, 2024). The complete script and the Free and Informed Consent Term (TCLE) were included in the Appendices section of the original work. The interviews had an average duration of 30 minutes each.
The research sample was non-probabilistic by convenience, composed of five cybersecurity professionals with practical experience in medium and large corporate environments. The selection was made through the researcher’s professional contacts and indications within the corporate environment (snowball strategy), prioritizing individuals from companies that offer digital security services. The number of respondents was considered adequate for the qualitative and exploratory nature of the study, given the recurrence of perceptions and convergence on the main points analyzed (Gil, 2019; Marconi and Lakatos, 2017).
The analysis of the collected data was performed using the thematic content analysis technique (Bardin, 2011; Franco, 2012; Bauer and Gaskell, 2002). The analysis was structured into three main axes: types of AI application in cyber defense, areas of digital security impacted, and perceived effects on operational resilience (incident response time, service continuity, and impact mitigation).
The research context focused on the specialized services sector in cybersecurity, with an emphasis on companies operating in the protection of medium and large corporate environments.
Regarding the ethical aspects, the study was not submitted to the PECEGE Research Ethics Committee, according to the FDE opinion. The Free and Informed Consent Term (TCLE) was used, with mandatory consent from participants and maintenance of respondent anonymity.
3. Results and Discussion
Participant Profile
The research involved the participation of five cybersecurity professionals, all active in companies specialized in providing digital security services for medium and large organizations. The participants’ profile was predominantly experienced, with three of them having more than ten years of experience and the others between six and ten years. This comprehensive experience allowed the respondents to follow the evolution of digital threats and defense technologies.
The participants performed strategic and operational roles, including incident response, security monitoring, threat investigation, and defensive architecture design. All reported direct experience with Artificial Intelligence (AI)-based solutions in corporate environments, especially in threat detection, response automation, and incident analysis support. This practical experience allowed for a critical evaluation of the benefits, limitations, and impacts of AI on the operational resilience of the organizations served, as detailed in Table 2.Table 2. Respondent Profile
| Interviewee | Gender | Position | Experience time | Company sector | Company size served |
|---|---|---|---|---|---|
| A | Male | Security Specialist | More than 10 years | Cybersecurity services | Large scale |
| B | Male | Security Specialist | Between 6 and 10 years | Cybersecurity services | Medium and large scale |
| C | Male | Safety Engineer | More than 10 years | Cybersecurity services | Large scale |
| D | Male | Security Consultant | Between 6 and 10 years | Cybersecurity services | Medium-sized |
| And | Male | Security Architect | More than 10 years | Cybersecurity services | Medium and large scale |
Source: Original Survey Data.
Organizational context of the companies served
The companies served by the interviewed professionals, medium and large-sized, had formal cybersecurity structures and continuous investments in technology. The interviewees, by working in digital security services, offered a transversal view on different corporate environments, maturity levels, and occurrences of real incidents.
An intermediate level of cybersecurity maturity was observed in the companies served. Despite the adoption of multiple protection solutions, difficulties were identified in the integration between tools, process standardization, and coordination of incident response actions. Maturity was assessed on a scale of 1 to 5, with responses concentrated in the intermediate levels, indicating structured initiatives, but with limitations in tool integration, process automation, and a data-driven approach to incident response.
Artificial Intelligence was already present in these environments, mainly in monitoring, threat detection, and alert prioritization, but in a partial way and concentrated in specific tools. Respondents reported the recurrence of cyber incidents, including automated attacks and AI-enhanced social engineering campaigns, suggesting that organizations still face challenges in keeping up with the speed and adaptability of threats.
The individual analysis of contexts showed that environments with more consolidated SOC structures (Interviewees A and C) presented more intense use of automation and event correlation. In contrast, organizations with lower maturity (Interviewees B and D) relied more on manual analyses and faced greater difficulty in orchestrating incident response, especially in cases of targeted phishing and vulnerability exploitation. These findings reinforce that the effectiveness of AI is directly linked to the level of organizational maturity and the integration of security processes.
The use of AI in incident detection and response
The use of Artificial Intelligence in cyber incident detection and response processes was already a reality in the organizations served, although at different maturity levels. AI acted mainly in continuous monitoring, analysis of large volumes of security data, and alert prioritization, directly supporting incident response teams.
Participants reported the use of machine learning-based solutions to identify anomalous patterns, correlate security events, and reduce irrelevant alerts. This application was considered crucial in complex environments, where exclusively human analysis would be unfeasible. AI accelerated incident identification and directed teams’ attention to occurrences with a higher potential for operational impact. One reported case (Interviewee B) highlighted the use of AI monitoring for automatic event correlation in a SOC, reducing manual alerts and prioritizing incidents, which resulted in a more agile response in the initial stages of the attack. This finding is in line with market studies indicating the reduction of detection and response time as a benefit of AI (IBM, 2023).
AI was also associated with the automation of initial actions, such as threat containment, isolation of compromised assets, and application of pre-defined responses. These capabilities allowed for faster action in critical moments of the incident, preventing the spread and amplification of damage. However, the recurring perception was that final decision-making remained under human responsibility, especially in complex incidents or those with a direct impact on critical systems.
In general, AI acted as a complementary element to the work of security teams, expanding detection and response capabilities, but without replacing specialized analysis. The effectiveness of this use was directly related to the integration of AI tools into existing processes and the clarity of the automation rules adopted.
Perceived impacts on operational resilience
Respondents indicated that the adoption of Artificial Intelligence-based solutions directly impacted operational resilience, especially in the speed of response and the ability to maintain critical services during incidents. Before AI, incident identification and treatment were slower and more reactive.
The impacts of AI have focused on the detection and response stages, with less influence on prevention. Gains were highlighted in the early identification of threats and in the execution of initial containment actions. The incorporation of AI significantly reduced the time for incident detection and containment, transforming investigations from hours into automated seconds. This anticipation minimized the spread of attacks, reduced impacts, and avoided prolonged disruptions. The automation of initial responses, in particular, contributed to operational continuity in high-pressure scenarios, corroborating market data on the reduction of identification and containment time (IBM, 2023).
A reported case (Interviewee C) mentioned the use of AI solutions integrated into security event monitoring, allowing for the rapid identification of anomalous behaviors and the automatic triggering of initial containment measures, which reduced the time between detection and response and prevented the escalation of impact.
The perception of these gains was not uniform. Interviewees with more technical roles (A and C) highlighted evident operational gains in reducing response time and automation. Those with more strategic profiles (D and E), on the other hand, showed caution, emphasizing that resilience depends on process maturity and the ability to interpret AI data, not just on the technology.
Another recurring point was the improvement in the ability to handle multiple simultaneous incidents. AI assisted in prioritizing high-impact events, optimizing the allocation of human resources and contributing to greater operational stability, especially in environments with lean teams or high technological complexity.
Despite the advances, operational resilience was not exclusively linked to technology. The effectiveness of AI was greater in organizations with well-defined response processes, structured continuity plans, and trained teams. In contexts without these elements, AI was an enabler, but not a sufficient factor to guarantee resilience. The reports indicated that AI strengthened the ability to withstand, respond to, and recover from incidents, provided it was integrated into a broader strategy of risk management and business continuity.
This scenario highlighted a trade-off between speed and control: automation allows for faster responses but increases the need for validation to avoid misguided decisions in critical environments, especially in contexts of high operational dependence.
Risks, limitations, and over-reliance on automation
Although respondents acknowledged the gains of AI in cybersecurity, they also pointed out risks and limitations, mainly excessive dependence on automation. A recurring risk was over-reliance on AI system decisions, especially in environments with lower operational maturity. Interviewee C mentioned that automation without monitoring, clear rules, and human intervention can generate unnecessary blockages, service interruptions, and inadequate automatic responses.
This risk perception varied. Respondents B, C, and D considered excessive dependence a noticeable problem in contexts without continuous monitoring, human validation, or control criteria. A and E, on the other hand, saw this scenario as more incipient, conditioned by lower operational maturity, inadequate use of tools, or low tolerance for errors.
Participants reported that, in some contexts, automation is adopted as a substitute for human analysis, rather than as support. This practice was seen as a weakness, as AI models can generate false positives, misinterpretations, or inadequate responses in atypical scenarios. The absence of human validation was perceived as a risk to operational resilience, potentially leading to undue service blocking or incorrect incident prioritization.
Interviewee D reported a case where an automated response temporarily blocked a legitimate service, interpreting atypical behavior as a threat. Although the action was technically coherent, the lack of contextual validation generated unnecessary operational impact, highlighting the risks of unsupervised automation.
Another limitation highlighted was the transparency of the algorithms. Interviewees mentioned difficulties in understanding the AI’s criteria for classifying alerts or recommending actions, which reduces the teams’ ability to audit decisions and adjust strategies. This lack of visibility was an obstacle to security governance and trust in automation, highlighting the need for a balance between operational efficiency and control. With the increasing use of automation, the demand for mechanisms that ensure transparency, auditability, and security in system decisions is growing.
The effectiveness of AI also depends on the quality of the data for training and operation of the models. Environments with incomplete, poorly classified, or outdated data tend to generate less reliable results, requiring greater manual correction effort, a point reinforced by studies on the criticality of data quality for AI systems (MONFRE; SILVA; VICENTIN, 2023).
Experts emphasized that automation does not eliminate the need for structured processes, continuous review, and training of technical teams. The perception of these risks varied according to organizational maturity. In the contexts of Interviewees A and C, automation was more reliable due to validation, integration, and governance processes. In the accounts of Interviewees B and D, the risks of AI dependency were more critical, due to the absence of adequate controls and greater difficulty in contextual validation of automated responses.
In general, respondents converged in the perception that AI strengthened operational security and resilience as a support tool, rather than a replacement for human governance. Excessive reliance on automation, without clear control and validation criteria, was seen as a factor that could compromise organizations’ ability to respond to cyber incidents, especially in critical scenarios requiring contextualized decisions.
Between theory and practice: an analysis of the results
The results of the interviews indicated a partial convergence with the literature and market reports on the use of AI in cybersecurity. Professionals confirmed that AI-based solutions are part of security operations, especially in threat detection, event correlation, and alert prioritization, strengthening defensive capabilities (MATIZ, 2023; CISCO, 2025).
However, this convergence was not homogeneous, varying according to the level of organizational maturity and the integration of AI solutions. There was a divergence between the theoretical potential of AI and its practical application. Although the literature highlights gains in efficiency, reduced response time, and automation of decisions (IBM, 2023; SILVA, 2024), in practice, AI mainly acts as support for human decision-making, rather than as an autonomous element in critical incident response processes.
This finding reinforces that factors such as organizational maturity, governance, trust in models, and integration with existing processes limit more advanced technology adoption. The distancing was also related to the initial expectation that AI would fully automate incident response. In practice, human validation remains essential, especially in critical scenarios, which reduces the effective autonomy of the solutions.
Another point of alignment with the literature was the critical view on the risks of excessive use of automation. The interviewees highlighted concerns with false positives, over-reliance, and difficulties in model explainability, aspects widely discussed in recent studies on AI in security (PEREIRA; ALMEIDA; LIMA, 2024; MONFRE; SILVA; VICENTIN, 2023). These risks reinforce the need for a balance between automation and human supervision in high-criticality contexts, evidencing a tension between efficiency and control. Automation expands operational capacity, but critical decisions require supervision to avoid negative impacts.
Regarding operational resilience, AI contributes more consistently to the response and recovery phases than to isolated prevention. Reduced identification time, event prioritization, and crisis decision-making support were the main benefits, aligned with the literature on the impact of AI on service continuity and damage mitigation (IBM, 2023; NIST, 2024). AI’s contribution has a greater impact on response and recovery capabilities, while anticipation and adaptation dimensions depend more on organizational and structural factors (NIST, 2018).
The results suggest that AI represents an advancement in cyber defense, but its contribution to operational resilience is conditioned by the maturity of processes, team capabilities, and clear definition of roles between automation and human analysis. This reinforces the importance of realistic and progressive approaches in AI adoption, aligning the technology with organizational maturity, existing processes, and governance, avoiding unrealistic expectations and risks of excessive automation.
Practical implications for cybersecurity management
The adoption of Artificial Intelligence in cybersecurity must be strategic and aligned with the maturity of organizations. The greatest gains are concentrated in the detection and incident response processes, suggesting that these stages should be prioritized in the initial implementation.
The automation of critical decisions without human validation was identified as a relevant risk, especially in environments with lower operational maturity. It is recommended to avoid the complete replacement of human analysis, maintaining supervision and control in sensitive processes with potential direct impact on service continuity.
The results reinforce the importance of investments in governance, data quality, and team training to ensure the effectiveness of AI-based solutions. The absence of these elements can limit the benefits of the technology and introduce new operational risks, compromising resilience.
The adoption of AI should occur in a structured manner, integrated into existing processes and with a clear definition of responsibilities between automated systems and human teams. The technology should act as support for decision-making, not as a substitute for critical analysis, as synthesized in Table 3.Table 3. Synthesis of the main research findings
| Dimension of analysis | Main results | Practical implications |
|---|---|---|
| Use of AI in detection and response | AI is already widely used in monitoring, event correlation, and alert prioritization, acting as support for security teams | Prioritize the adoption of AI in detection and response processes, where the gains are most evident |
| Impacts on operational resilience | Reduction in response time and greater capacity to handle multiple incidents, with greater impact on the response and recovery phases | Direct investments in AI to strengthen response capabilities and operational continuity |
| Differences by organizational maturity | More mature environments present greater integration, automation, and reliability in the use of AI | Align AI adoption to the organization’s maturity level, avoiding implementations disconnected from processes |
| Limitations and risks of automation | Risks of false positives, misguided decisions, and lack of model explainability | Maintain human oversight and validation mechanisms in critical decisions |
| Data dependency and governance | The effectiveness of AI depends on data quality, structured processes, and governance | Invest in data quality, governance, and team training before scaling automation |
| Gap between theory and practice | AI still acts mostly as support, and not as an autonomous element in critical processes | Avoid unrealistic expectations about total automation and adopt a progressive approach |
| Operational resilience (overview) | Greatest contribution of AI in the response and recovery phases, with less impact on anticipation | Integrate AI into broader risk management and business continuity strategies |
Source: Original Survey Data.
In summary, Artificial Intelligence has proven to be a relevant element for enhancing operational efficiency and reducing response time in cybersecurity, especially in incident detection and response. However, its effectiveness is intrinsically linked to organizational maturity, adequate governance, and team training, acting as a support for human decision-making and not as a complete substitute, which is crucial for operational resilience.
4. Conclusion
This research sought to analyze how Artificial Intelligence applied to cyber defense contributes to the operational resilience of medium and large organizations, especially in incident response and service continuity processes. It was found that AI is already widely used in continuous monitoring, threat detection, and alert prioritization, acting as fundamental support for security teams. The findings indicated that the incorporation of AI significantly reduced the time for incident detection and containment, transforming investigations that previously took hours into automated seconds. This capacity for anticipation and automation of initial actions, such as threat containment and asset isolation, contributed to operational continuity and improved the ability to handle multiple simultaneous incidents, optimizing human resource allocation. However, it was observed that the final decision-making in complex or critical incidents remained under human responsibility, highlighting that AI acts as a complementary element, enhancing detection and response capabilities, but without replacing specialized analysis. The study’s main contribution lies in demonstrating that Artificial Intelligence strengthens operational resilience by increasing the agility and effectiveness of cyber defenses, provided it is integrated with adequate governance and technical training of teams.
Despite the advances, the research identified limitations, such as excessive reliance on automation without human validation, which can generate false positives and inadequate responses, compromising resilience. The lack of transparency of algorithms and the need for quality data for model training were also pointed out as challenges. The effectiveness of AI proved to be intrinsically linked to the maturity of security processes and the integration of solutions. As limitations of the study, the reduced number of interviewees and the use of a non-probabilistic sample, which restricts the generalization of the results, should be highlighted. For future studies, it is suggested to expand the sample, include different sectors and organizational profiles, and adopt quantitative or mixed approaches to more objectively measure the impacts of Artificial Intelligence on operational resilience, delving into dimensions such as anticipation and adaptation.
Bibliographic References
EXAME. Hackers estão usando inteligência artificial para aprimorar golpes, diz Microsoft. Disponível em: https://exame.com/tecn
FÓRUM ECONÔMICO MUNDIAL. Relatório de Riscos Globais 2024. Genebra: Fórum Econômico Mundial, 2024. Disponível em: https://www.weforum.org/reports/global-risks-report-2024. Acesso em: 14 out. 2025.
GIZMODO. Hackers criam FraudGPT com IA maliciosa para gerar golpes com um clique. Gizmodo Brasil, 1 fev. 2024. Disponível em: https://gizmodo.uol.com.br/hackers-criam-fraudgpt-com-ia-maliciosa-para-gerar-golpes-com-um-clique/. Acesso em: 03 nov. 2025.
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST). Framework for Improving Critical Infrastructure Cybersecurity. Version 1.1. Gaithersburg: NIST, 2018. Disponível em: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf. Acesso em: 30 mar. 2026.
Article originating from the Final Course Work of Specialization in Digital Business from the MBA USP/Esalq
To learn more about the course, click here and access the MBX Academy platform