Q&A: Cybersecurity and AI Leader and Educator Eva Benn Says AI Is Rewriting Cybersecurity—and Creating an Opportunity to Rethink Who Leads It

AI is transforming cybersecurity at a pace that sets it apart from previous waves of
technological change. Earlier disruptions gave organizations and their workforces years to
adjust, often affecting industries one at a time. AI is different: change is happening across
industries simultaneously, introducing new attack surfaces, lowering barriers for attackers and
forcing security professionals to learn new ways of working in real time. As Eva Benn, Cybersecurity and AI Leader and Educator, puts it, “We're all beginners in 2026.”

That disruption also presents an opportunity. As AI automates some highly technical tasks and
requires even experienced practitioners to develop new skills, cybersecurity has a chance to
welcome people with different professional backgrounds and perspectives. For women,
however, creating pathways into the field addresses only part of the problem. Women remain
underrepresented in leadership, and the demands of caregiving can make sustaining a
cybersecurity career increasingly difficult as they advance. Benn argues that addressing that
imbalance will require more than broad commitments to diversity. Employers need tangible
support structures—and leaders need to stop treating hours worked and visible activity as
proxies for performance.

Benn explores both sides of cybersecurity's transformation: how AI could broaden participation in the profession and why organizations need to rethink workplace structures if they want diverse talent to stay and lead. She also examines the limits of AI itself, from the importance of getting cybersecurity fundamentals right to the continued need for human oversight, judgment and genuine AI literacy as agentic workflows become more prominent.

Q. How is AI changing cybersecurity compared with previous technology disruptions and
what new challenges is it creating?

A. I'm not going to beat a dead horse here. AI is clearly transforming how we work, how we live,
and that brings new opportunities as well as new challenges for cybersecurity. With any new
technology that has disrupted the industry and how we work and live over the years, we've
always had to relearn security. We are in one of those redefining moments, but on a much
larger scale and speed because with any other previous disruption, we had years to adapt. And
also industries were transforming, one at a time. Now everything is happening all at once, very
fast.

AI is introducing new attack surfaces, as well as new types of attacks, as well as lowering the
bar for attackers. In cybersecurity, this creates challenges as well as opportunities. We are
going to need more cybersecurity professionals, not less.

Q. Despite the risks, why are you optimistic about AI's impact on cybersecurity?

A. I believe that we are also going to see more opportunities for diversity and for more women
to get into the field. Actually, I am very optimistic about this whole transformation. We are
uniquely positioned to rethink a lot of our traditional approaches.

Q. How could AI create opportunities for people who have traditionally faced barriers to
entering cybersecurity?

A. The entire workforce is upscaling in real time. We're all beginners in 2026, and with
traditional security over the years, when someone from non-technical background or someone
transitioning from being a mother, for instance, or a caretaker, they have to compete with
peers who have years and decades of experience. Everybody now has to relearn security.
Everybody has to rethink what we're doing. This creates an opportunity for more people to
come in and actually give us fresh perspectives on how we've always done things.
I'm not going to say there are more jobs opening specifically to women because that is not true.
In cybersecurity, I think that what we need is a diversity of thought, especially when it comes to
AI.

Q. Could AI make it easier for people without deeply technical backgrounds to contribute to
cybersecurity?

A. I believe with AI, we have the opportunity to bring more people with non-technical
backgrounds that can ramp up quickly. And because a lot of these super highly technical things
are now low-value things that can be automated with AI. Think about it, when the calculator
was invented, we used to do math in our heads. Now we're able to suddenly offload this queue
to a little machine. It’s a very similar thing. We no longer need math professors to do complex
calculations. We can have more people do math. So it's the same for thinking with AI.

Q. Why do women continue to be underrepresented in cybersecurity leadership and leave
the industry in mid-career?

A. As a practitioner and somebody who is also a leader in cybersecurity, and who's worked my
way up the chain, we as females usually are the primary caretakers of our homes. As we grow older and mature in our careers, it becomes a little bit harder to sustain the pace and the tempo because our impact and outcomes are evaluated against our peers, who often have stay-at-home wives. I'm expected to produce the exact same impact or more next to someone who goes home, and their laundry is done and their kids are taken care of, so they get to enjoy that.

Q. What does the combination of career pressure and caregiving responsibilities mean for
women trying to advance?

A. Women have to go home and basically start the second job all over and especially when you
have two working parents, or you don't have support. It's extremely high pressure, nonstop
high pressure, and this is a big reason why it's harder for women to one climb up the rank, to
stay within cybersecurity because simply it's not an even playing field, and let's stop pretending
that it is.

Q. What can employers do to help more women remain in cybersecurity and advance into
leadership?

A. Gender diversity and any diversity in cybersecurity is a net win for the entire world. Because
cybercriminals and threat actors are not all one gender, all one background, so we certainly
need that. We all bring different skills. What I would love to see, if I had no limitations, is for big
organizations to actively support and encourage women to grow into leadership roles by
providing them support to be caretakers and mothers and raise a family and children, while
also delivering impact.

There needs to be some very explicit support system, because as a mother, you have one job
that you cannot ever drop.

Q. What does meaningful workplace support look like in practice?

A. When push comes to shove, when you're hitting that roadblock, unfortunately, we have to
make some very hard choices. So, unless there is an explicit support, not like kumbaya support,
an actual support structure, that, for instance, gives working mothers an extra day off a week.
Maybe two days, or leave two hours early, something very explicit, right? That is tangible and
enables women to be peers who may have more energy, more time, more opportunity to
contribute.

Q. Are cybersecurity organizations measuring employee performance in the wrong way?

A. This is a message for leaders who might be reading this. We need to stop measuring the
wrong things in cybersecurity. Hours and activity do not mean output.

Q. What should leaders measure instead of time spent online or at a desk?

A. For way too long we have perceived the hours that people exist or are logged as meaningful,
contributing input. And, it is not. I can work for two days and deliver more output than on days
that I can be online for 12 hours. And vice versa. It all goes back to: Am I capable? Are my body and my nervous system capable to deliver outcomes.

Q. Is AI exposing organizations that have allowed longstanding security gaps and
vulnerabilities to remain unresolved?

A. Security Monday has actually talked to a lot of some of the best cybersecurity leaders, and
we’ve discussed a lot of how AI is reshaping security strategies for senior leaders. I don't think
that it's necessarily changing how much we care. Like budget constraints and resources
constraints, it's always been there. AI is just making it a lot harder for us to ignore the
fundamentals and to ignore those trivial and annoying bugs that we know that are sitting in our
backlog, or some of the gaps, or the attack paths that we know that are there, and we never
could prioritize.

Q. Are organizations using AI for problems that could be solved more efficiently with
traditional automation?

A. What we are confusing here is the resources that we use with AI. For a lot of stuff we want
to automate, we don't need AI. Automation has been there for a long time. We have been using
automation and security for a long time, So, there are deterministic systems that could still
handle a lot of repetitive work that are less costly than AI. Where we need to be focused is not
necessarily on the cost and the speed, but what the problems are that we're trying to solve, and
where does AI fit into solving these problems better than humans.

Q. Where does agentic AI have the greatest potential in cybersecurity?

A. There’s been a lot of hype around AI SOC and AI detection response. There's definitely a lot
of really good use cases of agentic workloads in these areas. They’re evolving, and that's
definitely where the future is going.

Q. Why will humans remain necessary even as agentic security capabilities improve?

A. These are still going to be areas that require human oversight. AI is very good at giving
confidence, competent answers, but unfortunately, we can't afford not having human
oversight. AI knows how to do the thing, but doesn't know what the thing is that it needs to be
doing. Companies are investing billions in AI infrastructure. But do you think that AI will just
secure itself?

Q. Will AI ultimately reduce the need for cybersecurity professionals?

A. I don't want to believe in AI. I'm a believer that the future will absolutely have to be led by
AI-driven workflows, especially agentic workflows, but do I believe that we are not going to
need humans? I don't. I know that we're going to need more humans.

Q. Why doesn't simply giving organizations access to AI guarantee that they will use it
effectively?

A. There are a lot of these big companies such as Anthropic and they're starting to have services
like consulting arms where they help companies implement AI simply because AI exists and the
technology is there. It doesn't mean that people know how to make the most out of it. Once
again that goes back to the skill.

Q. What does real AI literacy require?

A. We are all thinking that talking to chatbots is using AI. That's not AI literacy at all.
AI may be changing the skills required to succeed in cybersecurity, but technology alone will not
solve the industry's talent and diversity challenges. By automating certain technical tasks and
forcing experienced practitioners and newcomers alike to learn new ways of working, AI could
make cybersecurity more accessible to people who previously faced a steep technical barrier to
entry. That creates an opening for greater diversity of thought at precisely the moment the
industry is being forced to reconsider many of its traditional approaches.

But attracting more women into cybersecurity is different from creating an environment in
which they can build sustainable careers. The interviewee points to the unequal burden of
caregiving as one reason women may struggle to remain in the field or advance into leadership.
Her prescription is deliberately concrete: employers should provide meaningful support for
caregivers while judging employees by the impact they deliver rather than the amount of time
they appear to be working. “Hours and activity does not mean output,” she says.

The same emphasis on outcomes applies to AI adoption. Organizations should not use AI simply
because they can, nor assume that every automation problem requires it. Instead, they need to
identify the problems AI can solve better than people or traditional deterministic systems. And
even as agentic workflows become increasingly important to security operations, human
oversight remains essential. In the interviewee's formulation, AI may know how to perform a
task, but it does not necessarily know which task it should be performing.
The opportunity, then, is larger than adopting a new technology. Cybersecurity has a chance to
rethink both how the work gets done and who gets to do it. Realizing that opportunity will
require organizations to embrace AI without losing sight of human judgment—and to build
workplaces where a broader range of people have support and flexibility.