AI strengthens cyber defenses across critical sectors

The study points up interpretability as a critical barrier to trust and adoption. Many AI-based cybersecurity tools function as black boxes, producing alerts or classifications without clear explanations. In high-risk environments, this opacity complicates decision-making, incident investigation, and regulatory compliance.

With cyber threats growing more sophisticated, the stakes for getting AI-driven security right continue to rise. Across critical sectors ranging from industrial automation to healthcare, finance, and smart energy systems, AI-driven cybersecurity solutions are increasingly capable of identifying attacks in real time, classifying complex threat patterns, and reducing response delays that often determine whether an incident becomes a breach. Yet a comprehensive new review finds that while performance gains are clear, the transition from laboratory success to dependable real-world protection remains uneven.

The findings are detailed in the study “Innovations and Future Perspectives in the Use of Artificial Intelligence for Cybersecurity: A Scoping Review,” published in Technologies. The research systematically evaluates recent peer-reviewed literature to assess whether AI can meaningfully strengthen modern cybersecurity infrastructures.

AI performance gains across critical sectors

The review analyzes 24 high-impact studies published between 2020 and early 2025, selected from an initial pool of more than 2,500 academic records using the PRISMA-ScR screening protocol. These studies span key application domains including Industry 4.0 manufacturing systems, Internet of Things networks, healthcare infrastructure, financial services, autonomous vehicles, smart grids, and other cyber-physical systems that combine digital control with physical processes.

Across these domains, AI systems are primarily deployed to detect intrusions, identify malicious traffic, classify attack types, and automate incident response. Machine learning methods such as Decision Trees and Random Forests remain widely used due to their relative simplicity and stability, while deep learning models including Convolutional Neural Networks, Recurrent Neural Networks, Long Short-Term Memory networks, and Autoencoders dominate studies reporting the highest detection accuracy.

The review shows that many AI-based intrusion detection systems achieve accuracy rates above 95 percent, with several reporting performance close to or at 99 percent under benchmark conditions. These results are especially strong for common attack categories such as denial-of-service, malware propagation, ransomware activity, man-in-the-middle interference, and abnormal network traffic patterns. In industrial and IoT environments, AI systems demonstrate a marked ability to flag anomalies early, often before attacks escalate into service disruptions or data loss.

Financial systems also show measurable gains. AI-enabled security models improve fraud detection, reduce false positives, and enhance risk management by analyzing large volumes of transaction data in real time. In healthcare and smart infrastructure, AI is increasingly used to protect sensitive data flows and operational networks where breaches could lead to physical harm or large-scale outages.

The review finds that deep learning models, in particular, outperform traditional machine learning approaches in complex classification tasks. Their capacity to learn nonlinear patterns allows them to identify subtle indicators of advanced or blended attacks that signature-based systems frequently miss. This advantage has driven growing adoption in environments where attack methods evolve quickly and manual rule updates cannot keep pace.

Despite these gains, the study notes that high reported accuracy does not automatically translate into robust security in live systems. Many of the strongest results are achieved under controlled experimental conditions that differ significantly from operational environments.

Dataset dependence and the limits of benchmark success

The authors identified a heavy reliance on outdated or simplified datasets. A large proportion of the reviewed studies train and evaluate AI models using well-known benchmarks such as KDD Cup 99 and NSL-KDD. While these datasets have long served as standard references for intrusion detection research, they no longer reflect the complexity, scale, or diversity of modern cyber threats.

These benchmark datasets often contain limited attack types, unrealistic traffic distributions, and static patterns that are easier for AI models to learn. As a result, models trained on them may achieve near-perfect scores without developing the adaptability required to handle real-world network noise, encrypted traffic, zero-day exploits, or coordinated multi-vector attacks.

The review notes that only a small subset of studies rely on datasets derived from real operational environments, such as industrial control systems, smart grid telemetry, or live IoT deployments. These studies often report lower but more realistic performance levels, highlighting the gap between experimental success and operational resilience.

Class imbalance is another persistent issue. Many cybersecurity datasets contain far fewer examples of rare but critical attacks compared with normal traffic. AI models trained on such data may perform well overall while failing to detect precisely the threats that pose the greatest risk. Several reviewed studies acknowledge overfitting, where models become overly specialized in recognizing known patterns but struggle when exposed to novel or slightly altered attacks.

Computational cost further complicates deployment. Deep learning models with high accuracy typically require significant processing power, memory, and energy. In cloud environments, this can translate into high operational costs. In edge settings such as IoT devices, wireless sensor networks, or embedded industrial controllers, resource constraints can make real-time AI-based security impractical without model simplification or offloading.

The review highlights emerging approaches such as lightweight neural networks, federated learning, and few-shot learning as possible responses. These methods aim to reduce data requirements and computational overhead while preserving detection performance. However, they remain underexplored in cybersecurity compared with other AI application areas.

Explainability, adversarial risk, and the path forward

The study points up interpretability as a critical barrier to trust and adoption. Many AI-based cybersecurity tools function as black boxes, producing alerts or classifications without clear explanations. In high-risk environments, this opacity complicates decision-making, incident investigation, and regulatory compliance.

The authors point to growing interest in explainable AI as a necessary evolution. Techniques that clarify why a model flagged specific activity or which features influenced a decision can help security teams validate alerts, reduce false positives, and identify weaknesses in defensive strategies. Explainability is also seen as essential for detecting AI-specific attacks such as data poisoning, where adversaries manipulate training data to compromise model behavior.

Adversarial threats against AI systems represent another underdeveloped area. Several reviewed studies note that while AI is used to defend against cyberattacks, AI models themselves are increasingly targeted. Attacks such as model inversion, membership inference, and adversarial input manipulation can undermine detection systems from within, potentially creating blind spots or false assurances of security.

The review also flags limited engagement with quantum-era risks. As quantum computing advances, existing cryptographic protections may weaken, yet few AI-cybersecurity studies address how AI can support quantum-safe defenses or adapt detection systems to post-quantum threat models.

Looking ahead, the authors argue that progress will depend on coordinated advances across data, models, and governance. Realistic, up-to-date datasets drawn from operational systems are essential for training resilient models. AI architectures must be redesigned with efficiency and scalability in mind, especially for real-time and edge deployment. Explainability should be embedded by design, not added as an afterthought, to support accountability and human oversight.

Equally important is interdisciplinary collaboration. Effective cybersecurity increasingly requires alignment between technical innovation, regulatory frameworks, and organizational practices. AI systems must operate within standards that ensure transparency, fairness, and safety, while remaining flexible enough to adapt to rapidly changing threat landscapes.