Global enterprises like Amazon encounter more than 1 billion cyber threats daily and the rise of generative AI is adding fuel to the fire.

As AI agents join the ranks of both the offense and defense in cybersecurity, it’s worth asking: Can we build better software and infrastructure to brace for the generative AI era?

I’ve seen a lot of trends and promising developments in security take flight, like improved protection at the identity layer, and others plummet into the abyss, like solutions designed exclusively to keep attackers out of systems and networks.

So, while we may be able to create lasting security solutions with gen AI infrastructure, apps and tech stacks, the jury’s out on how fast the deployment of AI agents for security will advance from actively testing to truly trustworthy. It will remain so through 2025. But that doesn’t mean CISOs and security teams can get complacent or discouraged – quite the opposite.

While the tech is new, the hurdles facing cybersecurity in 2025 remain similar to what my team dealt with when I was the CEO of Symantec in the 2000s. We need to source or design, then implement tooling and infrastructure that can bridge contemporary talent, tech and surface area gaps. Success requires focusing all efforts around the three “I”s: invisible, invincible and inexpensive.

Invisible: Regularly Engaging with Solutions Should Remain a Security Team Workflow

The best security doesn’t change how your organization works. It doesn’t interrupt end-user workflows for more than a few seconds. Okta is solid because it takes only seconds to verify your identity with a simple “Yes, it’s me.” on the user’s end. Wiz is also great because security teams can trust it’s working and end users don’t have to care. Nebulock requires just a one-time acceptance of cookies’ access for a lifetime of value.

Before I assumed the CEO position at Symantec, I served as COO. My time spent managing departments and processes across our own organization reinforced that security products, tooling and infrastructure need to operate as much in the background of an organization’s daily workflows as possible. Back then (and today), it was important to add layers of security to businesses and end users, not impact or disrupt their operations in favor of achieving superior levels of security. As a solution provider and public company, it was important that we practiced what we preached and held ourselves accountable as well.

Invincible: Companies Need Protection from an Ever-Expanding Attack Surface Area

The best security is fit for purpose. People shouldn’t be able to work around enterprise security solutions. Founders working on solutions fit for purpose, meanwhile, should aim to lower time to value with less configuration. Disconnected products that promise strength only to add bloat are not the answer. Security solutions need to be simple to get up and running and as close to invincible as possible on day zero.

For example, Sysdig and Halcyon offer platforms that include useful features designed to protect points along the expanding attack surface area against very specific types of cyber incidents from ransomware on an individual level to container breaches impacting enterprise security.

As an independent board member of Mandiant, I had the privilege of reviewing pre-publish threat landscape reports completed by the organization’s team of analysts, researchers and hackers. Naturally, each report revealed an expanding threat landscape with new attackers, attacks and attack tooling. However, they all shared one takeaway: The job of securing a digital enterprise is never done.

Inexpensive: Security Teams Navigating Cyber Events Need to Create Efficiencies that Offset Costs, Not Add to the Bill

The International Monetary Fund estimates that cyberattacks will cost more than $23 trillion by 2027 globally – up from ~$8.4 trillion in 2022. For CISOs and security teams adopting new solutions or upgrading old ones – it’s crucial to not just solve for the cost of acquisition but take operational cost into account from the beginning.

For example, Prophet Security and Viso Trust all automate key areas of functionality and upkeep that enable security teams to cut down on operational cost tied to maintenance, upgrades and system-level updates. Straiker is designed as an end-to-end platform for an AI agent-populated security landscape.

Adoption and deployment of security platforms and tooling powered by gen AI should not require lots of ad hoc policies to prevent false positives – a big problem plaguing security teams and end users today that will only increase in the gen AI era unless further innovation can reverse the trend.

Navigating Security, Risk and CISO Headaches in 2025

As my team and I wrote previously, cybersecurity in 2025 will be about consolidating tools and tech, simplifying products and processes and automating security efficacy and detection efficiency. Operational efficiency will only be as good as tooling efficacy – and vice versa. In order to prepare and armor up for the gen AI-powered near future, CISOs and security teams operating across threat environments, industries and levels of AI agent involvement need to deliver the three Is. Failure to do so could leave the security and data integrity of an entire organization, client or user base and global digital society hanging in the balance.

The bottom line for CISO and security founders: You don’t have to do all three ‘I’s perfectly, but you can’t ignore or eliminate any of them.