At Intersec Dubai, one of the world’s largest gatherings for security, safety and fire protection, the conversation around cyber security has shifted decisively from whether organisations should use artificial intelligence (AI) to how quickly they can operationalise it.

For Jean Wiles, head of cyber security for the Middle East and Africa at Cigna Healthcare, the challenge facing security operations centres (SOCs) today is no longer just sophistication, but also speed and scale. Speaking at the event, Wiles argued that defenders remain structurally disadvantaged against attackers who are already using AI to compress timelines and overwhelm human-led processes.

“If you think about a SOC analyst today, AI allows an attacker to look at thousands of minutes of activity and rewrite malicious code in a minute,” he said. “We’re still slow to respond. We’re primarily reactive, not proactive.”

According to Wiles, attackers no longer need to be perfect. They only need to be fast. While defenders must navigate regulatory requirements, internal approvals and layered decision-making, threat actors operate in a far more linear way. “Attackers don’t need the same level of assurance,” he said. “Humans can’t scale like that, but machines can.”

This imbalance is becoming increasingly visible as the volume of cyber attacks continues to rise across industries. Healthcare, in particular, remains a prime target due to the value of personal and medical data, as well as the operational impact of downtime. At the same time, it is one of the most heavily regulated sectors, where mistakes can lead to breaches, compliance failures, financial penalties and reputational damage.

“The cost of being slow is huge,” said Wiles. “But the cost of being wrong is also massive, especially in regulated environments like healthcare.”

That tension, between speed and accuracy, is now at the heart of cyber security strategy discussions. SOC teams are expected to detect and respond faster than ever, while maintaining high confidence in their decisions.

We need to bring technology in that allows decision-making to happen quickly. AI should be a trusted lieutenant. As a commander, you need to trust it. If you do, you will make faster decisions

Wiles warned that relying purely on human judgement in this environment is no longer sustainable. “The volume of attacks has expanded across the industry,” he said. “We rely heavily on service providers to maintain visibility, and when you see phishing campaigns still being successful at scale, it’s scary. You have to adapt and be stronger to win the battle.”

At Intersec, much of the focus was on how AI-driven automation can help close this gap. But Wiles cautioned that automation alone is not enough. Organisations need to rethink how AI is integrated into decision-making processes, not just detection. “We need to bring technology in that allows decision-making to happen quickly,” he said. “AI should be a trusted lieutenant. As a commander, you need to trust it. If you do, you will make faster decisions.”

For Wiles, this trust comes from architecture. AI systems must be designed with clear triggers, strong identity isolation and defined human oversight. Rather than replacing analysts, AI should augment them, enabling rapid triage and response while humans focus on validation and strategy. One area where this balance is critical is threat detection.

“You need to build systems that can act quickly, but you also need to partner,” Wiles said, pointing to the growing reliance on managed security service providers (MSSPs) and AI-enabled platforms to maintain scale and visibility.

The healthcare sector faces an added layer of complexity. Operational disruption can have direct consequences for patient care, making downtime unacceptable. Yet regulatory scrutiny means that automated responses must be carefully governed. “That’s the challenge for us,” said Wiles. “Attackers are sophisticated and targeted, but we also don’t want to be wrong. We need systems that move fast without compromising compliance.”

Looking ahead, Wiles sees the industry moving inevitably towards a more AI-enabled security world. As attack volumes increase, variation increases too, making manual analysis increasingly ineffective. “Everyone is overdoing it when volume goes up,” he said. “We need to architect for the future, find the right service providers, and use AI to fight AI.”

Read more on Artificial intelligence, automation and robotics

• 
  

  Cyber’s defining lessons of 2025, and what comes next

• 
  

  Natural History Museum deploys sensor network to decode urban biodiversity with AWS

  By: Caroline Donnelly

• 
  

  US CISA agency extends Iran cyber alert, warns of CNI threat

  By: Alex Scroxton

• 
  

  Defending against cyber grinches: AI for enhanced security