In April, I wrote about what I called the Cyber AI Parity Window. This is the rare period in which defenders and adversaries gained access to the same transformative technology at roughly the same moment. For most of cybersecurity history, advanced offensive capability reached attackers years before defenders could respond with comparable technology. AI changed that pattern.
At the time, my argument was simple. Parity creates an opportunity, and its value depends on what defenders do with it. I also warned that the window would narrow.
Five months later, we have a better sense of how quickly.
OpenAI recently described what it calls the “defender’s window.” Greg Brockman wrote that open-weight models with significant cyber capabilities are already only months behind frontier systems, and that organizations need to begin significantly automating their security programs over the coming months. The warning carries unusual weight after OpenAI’s own models, operating during internal cybersecurity evaluations, circumvented controls and compromised parts of Hugging Face’s production infrastructure.
For CISOs, the significance reaches well beyond another dramatic AI milestone. The parity window gave defenders simultaneous access to a new capability. The defender’s window puts a timeframe around converting that access into institutional capability.
That should shape what security leaders do next.
The window is operational
The conversation around AI in security has moved quickly. A year ago, many CISOs I spoke with were still asking whether AI could investigate alerts accurately enough for production. The discussion soon expanded into deployment, architecture, trust, and the effect on security teams.
Today, the question I hear most often is how quickly organizations can put AI to work while managing the operational risk that comes with greater autonomy.
OpenAI’s own security program offers a useful signal. Brockman writes that almost all of OpenAI’s initial security alerts are already triaged by intelligence before humans become involved. The company is connecting detections to bounded automated responses and using frontier intelligence continuously to probe its environment for attack paths, vulnerabilities, misconfigurations, excessive privileges, and unintended trust relationships.
Progress should now be measured by how much security work an organization can safely move to machine speed while preserving accountability, visibility, and human judgment.
That requires changes in the operating model around the technology. Security leaders need to establish where AI can take ownership of work, how performance will be measured, when authority can expand, and where people remain responsible for consequential decisions.
Start where performance can be measured
The first priority is identifying security workflows with outcomes that can be evaluated rigorously.
Alert investigation is one obvious area. Phishing, identity events, endpoint alerts, and similar workflows generate large volumes of repetitive evidence-gathering work. They also have established analyst practices that give CISOs a baseline to measure AI performance against.
I have watched experienced analysts test AI systems by repeating investigations step by step and searching for errors in the conclusion or reasoning. That instinct is healthy. It creates the evidence required for confidence.
Security leaders should formalize that process. Measure agreement between AI conclusions and experienced analysts. Track false positives, false negatives, escalations, missing data, investigation time, and the evidence supporting each determination. Study the circumstances where performance remains consistent and the circumstances where ambiguity increases.
Over time, this creates an empirical record of performance that can guide decisions about additional autonomy.
Make trust an operating metric
CISOs should treat trust as something they can observe and measure.
A security team should be able to answer basic questions about every AI-driven workflow. What evidence produced the conclusion? Which systems were queried? Where was information missing? How frequently do experienced analysts agree with the result? Under what conditions does the system escalate?
Those answers give security leaders a basis for defining thresholds around authority.
A workflow with a strong record of high-confidence conclusions may progress from read-only analysis to recommended actions and then to bounded execution. Policies governing critical infrastructure, privileged identities, sensitive data, and high-impact changes can establish different levels of oversight based on business risk.
The progression follows demonstrated performance. Each successful cycle builds additional evidence, and that evidence gives the organization confidence to determine where AI can safely assume greater responsibility.
Define machine-speed response before you need it
Faster investigation naturally creates the next operational question: what happens after the system reaches a conclusion?
CISOs should establish response authority before an incident forces those decisions under pressure. Response policies can account for asset criticality, identity, reversibility, business impact, and confidence in the underlying investigation. A session revocation or temporary containment action carries a different risk profile from shutting down production infrastructure or altering access to a critical business system.
Security leaders, infrastructure owners, legal teams, and business stakeholders need a common understanding of the authority assigned to AI across those scenarios. The policy should make clear which actions can execute automatically, which require approval, and which remain under direct human control.
When an attack moves at machine speed, these decisions cannot begin after the attack does. Predefined authority reduces decision latency and lets the organization act within boundaries established when everyone had time to consider the consequences.
Invest the recovered capacity in proactive defense
The defender’s window has much greater value when AI changes what the security organization can do with its time.
As repetitive investigation work moves to machines, CISOs should deliberately redirect human capacity toward threat hunting, detection engineering, attack-path analysis, security architecture, and improving the organizational context that guides defensive decisions.
This is where the advantage can begin to compound.
An investigation may reveal a noisy detection rule. A threat hunt can expose a coverage gap. Repeated escalations may identify missing telemetry or an unclear policy. Analysts can turn those findings into stronger controls, improved detections, better response procedures, and fewer avoidable alerts entering the system.
I believe this is one of the most important organizational shifts ahead. The security team can increasingly learn from every investigation and use those lessons to improve the environment itself. Analysts gain more time to ask questions that never fit into the alert queue, such as where are we exposed? What are we missing? What should we hunt for next?
Turn the window into durable capability
The Cyber AI Parity Window gave defenders something rare: access to a transformative technology before adversaries had years to establish an uncontested lead.
The defender’s window adds urgency. Capabilities concentrated among frontier organizations today will continue to diffuse. Offensive experimentation will expand. Longstanding vulnerabilities, weak configurations, forgotten permissions, and accumulated technical debt will become easier to discover and exploit. OpenAI is explicitly telling organizations to use the coming months to strengthen their defenses and put capable AI into the hands of security teams.
I have already underestimated the pace once. I expected enterprise trust in autonomous investigation to develop over years. I have watched that confidence develop much faster as teams accumulated operational evidence and learned where they could safely expand AI’s responsibility.
CISOs still control how prepared their organizations will be as these capabilities spread. The work now is practical. Identify measurable workflows, establish evidence-based trust, define response authority, and redirect human expertise toward proactive defense and continuous improvement.
In April, I argued that parity’s value would depend on execution. Five months later, that opening is visibly narrowing. Frontier capabilities are diffusing faster, offensive experimentation is accelerating, and the time available to turn access to AI into institutional capability is shrinking.
The defender’s window remains open, and every new advance narrows it. What CISOs build in the coming months will determine whether they enter the next phase of AI-driven security with a durable defensive advantage.
