AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
In this Book Essential
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
INTRODUCTION
This is an edited volume, not a monograph. Five editors assembled fourteen chapters by different author teams, published by CRC Press in 2026, and the result reads like a survey of a field in the middle of being rebuilt: part textbook, part literature review, part vendor pitch, part engineering notebook. That mixture is the reason to read it and the reason to read it with a pen.
The book's claim is straightforward. Attackers have automated, so defence has to. Rule sets and signature libraries were sufficient when attacks repeated themselves, and they are not sufficient now. Machine learning can compare an event to a learned baseline instead of a written rule, language models can read a report or a phishing email, and analytics can rank what deserves attention first. Each of the fourteen chapters takes one slice of that argument and describes how it is being built, from malware forensics to identity and access management, from intrusion detection to software-defined wide area networks.
What the book does not do is prove the claim. It reports it. Most chapters are organised as background, technique, application, challenge, future work, which is the shape of a doctoral survey rather than the shape of an argument. Numbers arrive from secondary sources: a projection of 10.5 trillion dollars in annual cybercrime cost by 2025, a Gartner figure that three quarters of businesses plan to adopt AI-based security by 2026, a 38 percent rise in attacks in 2023, an assertion that machine learning in endpoint detection cut infections by up to 95 percent. Each of those may be true. None of them is measured in this book, and several are not reconcilable with each other. A reader who wants evidence has to leave the book and go to the primary reports.
So why give it a fellow's time? Because the operational material is specific in a way that most commentary is not. The identity chapter explains why non-human accounts are now the largest unmanaged population in an enterprise directory and what that does to access reviews. The malware chapter walks the ladder from static inspection to memory forensics and says plainly what each rung can and cannot tell you. The intrusion detection chapter states the trade between sensitivity and specificity in the language of alert fatigue rather than in the language of accuracy scores. Those passages are useful whether or not you accept the framing around them.
There is also a structural reason. Every professional now works inside a security stack, even the ones who have never opened a security console. Your documents, your calendar, your identity, your model prompts and your meeting transcripts are all events that some system classifies as normal or abnormal. The question of who decides when an alert fires is therefore not a specialist question any more. It is the same question U365 asks about AI in general, translated into infrastructure: where does the machine's judgement stop and a named person's responsibility begin.
This Essential takes a position on that. The book's strongest contribution is the description of the detection stack: data, features, models, decision, response. Its weakest is the assumption that a better model improves the outcome. Detection is probabilistic by construction, and the cost of a wrong alarm is paid by a human being at a console. The control that turns a score into a decision is not a model. It is an accountable person with the authority and the evidence to act. That is CI-First (Co-Intelligence First) applied to security, and it is the test this Essential applies to every chapter.
One warning about the writing. The volume is uneven. Some chapters are careful reviews with a hundred references; others reuse framing paragraphs almost verbatim from their neighbours; several sentences carry the grammar of a second language. None of that makes the technical content wrong, and it does make the book slower than it needed to be. Read the chapters that touch your work, use the reference lists as a map, and treat the confident statistics as pointers to sources rather than as findings.
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
U365'S VALUE PROPOSITION
WHO THIS IS FOR
Fellows who work with AI tools daily and want to understand the security layer underneath those tools, the part that decides whether an action is allowed, logged, flagged or blocked.
Managers and board members who are asked to approve a security budget line labelled AI and need to know what is being bought, what it detects, and what it cannot.
Security practitioners early in their career who want a structured tour of the field's vocabulary before they specialise in one product.
Consultants and auditors who have to read vendor claims critically, and who need a vocabulary for asking where a number came from.
Educators building AI literacy curricula, who need a technically serious text that does not require a computer science degree to teach from.
KEY TENSIONS
Survey against argument: the book asserts that AI transforms defence and then spends fourteen chapters describing applications. The transformation claim is never tested against a counterfactual, such as an organisation that improved detection without machine learning, or one that deployed machine learning and got worse. Read the chapters as a catalogue and the book is useful. Read them as proof and it is thin.
Base rates against accuracy: a detector that is 99 percent accurate can still be wrong most of the time when the event it looks for is rare. The book knows this, mentions class imbalance in several chapters, and almost never carries the arithmetic through to a decision. The practical consequence is that the false-positive rate, not the headline accuracy, sets the analyst workload, and the workload sets how much of the signal is actually read.
The same models on both sides: chapter 12 describes attackers using language models for phishing text, dataset poisoning and evasion. Chapters 2 through 11 describe defenders using the same families of model. The book treats these as two topics rather than one contest, so it never asks the question that matters operationally: if the attacker can generate a thousand variants of a lure, what happens to a detector trained on last year's thousand lures.
Where the computation sits: the final chapter moves the argument to edge and fog computing and to software-defined networks. That is not a detour. Inspection is a function of placement. Traffic that never passes a chokepoint cannot be classified, and a model that runs in a central cloud cannot decide in the milliseconds a control loop allows.
Identity as the control plane: the identity chapter is the most operationally mature in the volume, because identity is where a security decision becomes a yes or a no rather than a score. The shift it documents, from human accounts to machine accounts, is the shift most organisations have not staffed for.
Ethics as a paragraph: every chapter carries a short section on privacy, bias or ethics, and none of them carries the argument far enough to change a design decision. That is not a moral failure of the editors. It is a sign of a field that has not yet built the institutions that would make the question answerable.
WHY IT MATTERS NOW
The first reason is that the AI stack and the security stack have become the same stack. When a fellow pastes a contract into a model, the data crosses a boundary that a security team is accountable for. When a team deploys an agent with credentials, the agent becomes an identity. The book documents the machinery that governs those crossings: authentication, authorisation, logging, detection, response. A fellow who does not know the machinery is not careless. They are simply working without a map of the building they are in.
The second reason is budgetary. Security spending follows fear, and fear currently follows AI. That combination produces purchases that are hard to evaluate and hard to reverse. The book gives a reader the vocabulary to ask four questions of any AI security product: what data does it see, what does it predict, what does it do when it is wrong, and who is accountable when it acts. Those questions do not require technical depth. They require the discipline to ask them in the meeting where the decision is made.
The third reason is doctrinal, and it belongs to U365 specifically. CI-First holds that human intelligence leads and AI amplifies it, that CI equals HI plus AI multiplied by HI. A security operations centre is the purest test of that formula in any organisation, because it is the place where AI output is most tempting to automate end to end. The book shows how far automation can go: triage, enrichment, containment, even response. It does not show, and cannot show, how a machine inherits accountability. That gap is where a fellow's judgement still has to be exercised, and it is the reason this Essential exists.
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
OVERVIEW
The fourteen chapters fall into three clusters.
Chapters 1 to 5 build the foundation. Chapter 1 sets out the concepts, the applications and the challenges: machine learning and deep learning for detection, anomaly techniques, automated incident response, adversarial risk, privacy, data quality, and a future that includes quantum computing. Chapter 2 surveys applications and the architecture that supports them, with an unusually candid section on organisational and ethical obstacles. Chapter 3 turns to large language models: what they add to threat intelligence and incident response, and what they break, including prompt-based manipulation and the difficulty of telling machine-written text from human text. Chapter 4 is a compact research overview of machine learning for threat identification, organised by task: anomaly detection, intrusion detection, malware, phishing, threat intelligence, behavioural biometrics, spam filtering, user behaviour analytics. Chapter 5 argues for proactive analytics, using case studies and visualisation to move from reporting incidents to anticipating them.
Chapters 6 to 11 move into operations. Chapter 6 is the longest single treatment of malware in the book: history from the 1971 Creeper experiment, taxonomy by harm, spread, target, purpose and technique, symptoms of infection, and then the forensic ladder of static, dynamic, memory and behavioural analysis. Chapter 7 covers identity and access management, the shift from perimeter to identity, the limits of traditional IAM, and the use cases where machine learning earns its place, from access certification to privilege abuse detection. Chapter 8 describes real-time detection and response, with case studies in endpoint and network security. Chapter 9 widens the frame to national and sectoral cyber defence, and includes a short, uncomfortable section on offensive use. Chapter 10 is a focused treatment of intrusion detection and prevention systems. Chapter 11 is the most methodologically explicit: machine learning techniques, data preprocessing, real-time implementation, and an honest section on false positives, false negatives and adversarial machine learning.
Chapters 12 to 14 turn to the adversary and the infrastructure. Chapter 12 describes AI-powered attacks: synthetic phishing, model poisoning, jamming, malware, distributed denial of service, and the learning techniques attackers use. Chapter 13 examines automation of threat detection with case studies across intrusion detection, phishing, malware and endpoint protection. Chapter 14 leaves the security operations centre entirely and asks how AI, edge and fog computing change the security of software-defined wide area networks, where latency, distribution and the internet of things decide what can be defended at all.
The volume closes without a conclusion chapter. There is no synthesis, no ranking of what matters, no statement of what the editors believe a reader should do on Monday. That absence is the space this Essential fills.
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
KEY IDEAS
1. The unit of analysis is a stack, not an algorithm. The book's most useful contribution is implicit in its structure. Detection is a chain: sources produce events, features summarise them, models score them, a decision threshold converts scores into alarms, and a response changes the state of a system. Every failure can be located in that chain, and most failures are not in the model. A perfect classifier fed a log source that misses the lateral movement will not detect the intrusion. A good model with no response playbook produces a report nobody acts on. When a vendor says the product uses AI, the useful follow-up question is which link of the chain it occupies and what it receives from the link above.
2. Base rates decide whether a detector is worth running. The book says that dangerous activity occurs far less frequently than normal behaviour, and that this imbalance skews model performance toward false positives. That sentence deserves more weight than the volume gives it. If one event in ten thousand is malicious, a detector with one percent false positives will bury the true alarm under roughly a hundred false ones per true one. The number that matters to a security team is not accuracy. It is the ratio of noise to signal at the console, because that ratio decides how much of the output a tired analyst actually reads.
3. The false-positive economy is a labour problem before it is a technical one. Chapter 11 states it plainly: false alarms generate work for security teams and produce alert fatigue, while missed threats have consequences that can be disastrous. Both halves of that sentence cost money, and they pull in opposite directions. Turning up sensitivity buys detection and spends analyst hours. Turning it down protects the team and accepts risk. The book describes the trade but does not price it. A leader who approves an AI detection tool without asking who will read its output, and for how many hours a week, has approved half a system.
4. Supervised learning needs labels that most organisations do not have. Several chapters present supervised classifiers as the default route, and then mention in passing that labelled attack data is scarce, imbalanced and quickly stale. That is the central practical constraint in the field. Labels come from past incidents, and past incidents are the attacks someone already detected. An unsupervised approach avoids the labelling problem and imports another one: it can only say that something is unusual, not that it is hostile, and unusual is a common property of legitimate work. The book is honest that both routes are partial. It is less honest about how much of the published performance depends on benchmark datasets that do not resemble a real estate.
5. Language models change the attack surface as much as the defence. Chapter 3 defines large language models as systems that produce text often indistinguishable from human writing, and then draws the consequence: the same capability that summarises an incident report can generate a convincing phishing message at scale. Chapter 12 adds the operational detail. Attackers use generated text to vary lures, to run dialogue with a target, even to answer security questions in a chat. Detection based on phrasing and templates degrades when the phrasing varies on every send. The defensive reading is not that language models are unsafe. It is that any detector trained on the shape of past attacks is exposed to an adversary who can change the shape cheaply.
6. Malware forensics is a ladder, and each rung answers a different question. Chapter 6 is the most useful technical chapter for a practitioner because it separates static analysis, dynamic analysis, memory analysis and behavioural analysis without pretending one replaces another. Static inspection tells you what the file claims to be and what it contains. Dynamic analysis tells you what it does when it runs. Memory analysis tells you what it did on a machine that is still running, which is often the only place the truth survives. Behavioural analysis tells you what family it belongs to. The chapter's implicit warning is that automation tends to be applied at the cheapest rung, while the evidence usually lives higher up.
7. Identity is the control plane, and the accounts that matter are no longer people. Chapter 7 documents the shift from network perimeter to identity as the primary security boundary, and then makes a point that most organisations have not absorbed: a large share of identities in a modern directory belong to applications, services and devices, not to employees. Those accounts often have broad permissions, no owner, and no joiner-mover-leaver process. Machine learning helps here in a specific and defensible way, by finding access patterns that deviate from a peer group, by flagging dormant privileged accounts, by ranking entitlements for review. This is the strongest evidence in the book that AI adds something a rule cannot express.
8. Real time is a latency budget, not a slogan. Chapters 8, 10 and 11 all promise real-time detection, and none of them defines the deadline. In practice the deadline is set by the attack: encryption of a file share takes minutes, a control loop takes milliseconds, an account takeover can be measured in seconds. A detection pipeline that ingests, enriches and scores in ninety seconds is real time for one of those and useless for another. The book would be more useful if every claim of real time carried a number and a comparison to the time the attack needs. Readers should supply the comparison themselves.
9. Automation without delegated authority is an unowned decision. The volume is enthusiastic about automated response: isolate a host, disable an account, block an address, open a ticket. Every one of those actions is a decision with a cost when it is wrong, and the book rarely says who authorised it. This is the point where a security architecture becomes a governance question. If a system may disable an account without approval, someone has delegated authority to a model, and that delegation should be written down, bounded and reviewed. If it may not, then a human is in the path and the response time is a staffing question, not a software question.
10. The model you deployed is not the model you have. Drift appears in several chapters under different names: concept drift, data drift, performance decay, evolving threats. The mechanism is simple. A model learns a boundary from historical data, the world moves, and the boundary stays where it was. The book's proposed answers are continuous learning, monitoring and retraining. What it does not say is that retraining is a release, with the same risks as any other release: it can regress, it can be poisoned, and it needs an owner and a rollback. Treat a model update like a firewall change, with a change record, and the drift problem becomes manageable rather than mystical.
11. Where the computation sits decides what can be inspected. Chapter 14 leaves the security operations centre and goes to software-defined networks, edge and fog computing. The security point inside the networking detail is worth extracting: centralised inspection depends on traffic passing a chokepoint, and distributed architectures remove chokepoints by design. If a decision has to happen within milliseconds, the model has to sit near the device, which means it runs on hardware you may not control, with data you may not retain. AI in defence is therefore also a placement problem, and the placement constrains the model, the evidence and the audit trail.
12. What the book leaves out is the governance layer. There is no chapter on accountability, evidence retention, incident declaration, regulatory notification or the audit of an AI system's decisions. Those topics appear as sentences inside other chapters. For a volume aimed at decision-makers this is the largest gap, and it is the gap that matters most to a fellow whose organisation is buying these tools. A security capability that cannot be explained after an incident is a liability, however well it scored during the incident. The missing chapter is the one that would tell a board what to sign and what to refuse to sign.
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
ULM ALIGNMENT
At University 365, the CI-First (Co-Intelligence-First) doctrine teaches you to invite AI into your reflection and work while remaining the orchestrator. Human Intelligence leads, AI amplifies. This Book Essential connects the book's security argument to U365's methods: ULM+EVA (University 365 Life Management powered by the Explore-Visualize-Action Plan cycle) turns a vague worry about digital risk into one domain, one gap and one action; LIPS+CARE (your digital second brain with the Collect-Action Plan-Review-Execute cycle) keeps the decisions you make about tools, access and data so that they survive staff changes and vendor changes; and SL-OS (Successful Life Operating System) integrates these with UP-Context-Engineering (context engineering for AI) into one system for living and working with machine intelligence.
SCHEMA PRIME: ULM Domain: Career and Finance
DOMAIN MAPPING: Primary: Career and Finance. Secondary: Quality of Life and Character and Emotions. Security is a professional and financial exposure before it is a technical one: the incident costs money, the response costs reputation, and the decision to buy or refuse a tool lands on someone's record. Quality of Life enters through the ordinary digital life a fellow is protecting, and Character and Emotions through the discipline of asking hard questions while a vendor is smiling.
EVA PARAGRAPH: You want a defensible position on the AI security tools your organisation is buying or being sold. The obstacle is that the field rewards confidence: every product claims detection, every dashboard shows green, and the questions that would expose a weak link are not in the sales deck. The plan: choose the one system that would hurt most if it failed, write down what it sees, what it decides and what it does on its own, then ask the three questions this Essential supplies, namely who reads the output, what happens when it is wrong, and who is accountable when it acts. If the answers are not written down anywhere, you have found the gap to close before the next renewal.
LIPS+CARE CAPTURE CARD:
Book: AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems
Primary ULM Domain: Career and Finance
3 Key Takeaways:
1. Detection is a five-link stack, sources, features, models, decision and response, and most failures sit outside the model.
2. The false-positive rate sets the analyst workload, and the workload sets how much of the signal is actually read.
3. Automated response is delegated authority, so every autonomous action needs a named owner, a bound and a review.
Apply It Action: In the Career and Finance domain, take the security tool you rely on most and write a one-page decision record: what data it sees, what it predicts, what it may do without approval, who reads its output, and what would make you switch it off. Keep the page in LIPS and revisit it at the next renewal.
Next CARE Step: Collect, by opening a LIPS note titled after this Essential and listing every system in your work that holds credentials or classifies your activity, with the owner of each one named.
EXPLAINER LINK: For more on ULM, EVA, LIPS, and CARE methods, see the ULM page and the LIPS page. For the CI-First doctrine, see the CI-First page. For the full SL-OS framework, see the SL-OS page.
APPLY IT (domain-tagged): In the Quality of Life domain, list the five accounts that would cause the most damage if taken over, starting with the one that can reset the others. Turn on the strongest authentication each one offers, remove any that no longer need to exist, and write the date you did it. The book's evidence on identity is unambiguous, and this is the one action in the whole Essential that reduces risk today without buying anything.
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
SUMMARY
Mindmap skeleton
Center: AI-Driven Cybersecurity, edited by Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad.
Branch 1: Fundamentals. Prediction, detection, response, and the move from rules to learned behaviour.
Branch 2: Large language models. Threat intelligence, phishing text, prompt risk, and the loss of phrasing as a signal.
Branch 3: Machine learning. Supervised, unsupervised and reinforcement approaches, and what each one needs to work.
Branch 4: Data. Telemetry, class imbalance, drift, and the labels an organisation does not have.
Branch 5: Malware. Static, dynamic, memory and behavioural analysis, from Creeper to modern ransomware.
Branch 6: Identity. IAM as the control plane, MFA, privileged access, and non-human accounts.
Branch 7: Defence. IDPS, real-time detection, SOC automation, and where the computation sits.
Chapter 1: Concepts, Applications and Challenges
The opening chapter does the work of a syllabus. It defines machine learning, deep learning and anomaly detection, then walks the applications that recur through the volume: real-time detection, vulnerability management, automated incident response. Its most valuable section is the one on constraints, because it states the problems the rest of the book then works around. Adversarial inputs can be crafted by anyone who knows the model's training data, and mitigated only partially by adversarial training, gradient masking or input preprocessing, each of which imports its own cost. Data in security is imbalanced, so models skew toward false positives or false negatives. Privacy and ethics get a page. The chapter ends with a future that includes quantum computing and fully autonomous defence, which is optimistic in a way the evidence in the chapter does not support.
Chapter 2: Applications, Architecture and the Organisational Obstacle
A survey of where AI is applied and what has to exist underneath for the application to work: data pipelines, feature stores, model serving, feedback loops. The chapter is at its best on the organisational side. It names the obstacles that decide whether a deployment survives: unclear ownership, missing skills, procurement that buys features rather than outcomes, and the difficulty of measuring a tool that succeeds by producing no incident. Its weakest passage is the section on predictive analytics, which describes prediction as a capability without discussing the base-rate arithmetic that decides whether a prediction is actionable. Read it for the architecture and the organisational list, not for the evidence.
Chapter 3: Large Language Models and the Text Problem
Chapter 3 introduces language models as text systems that are hard to distinguish from human writers, and then does something the volume needs more of: it looks at both directions. In defence, language models summarise threat intelligence, draft incident notes, explain a vulnerability and help with detection rules. In attack, they generate phishing text, run conversations with targets, and produce content at a volume no template library could match. The chapter is honest about the limits: cost, latency, hallucination, prompt manipulation and the difficulty of evaluating a model whose outputs are open-ended. Its treatment of prompt injection is brief for a risk that has become the standard opening move against any system that reads untrusted text.
Chapter 4: Machine Learning for Threat Identification
The shortest and most disciplined chapter, organised by task rather than by technology: anomaly detection, intrusion detection, malware detection, phishing detection, threat intelligence, behavioural biometrics, spam filtering, user and entity behaviour analytics. Each task gets its standard techniques and its standard difficulty, which makes the chapter a useful index for a reader who wants to know which method belongs to which problem. The challenges section repeats the four constraints that matter: data quality, adversarial manipulation, scalability and interpretability. There is no case study and no measurement, so the chapter reads as a map rather than a report. As a map it is accurate, and it is the chapter to reread when a vendor uses a term you cannot place.
Chapter 5: Proactive Analytics and Prediction
Chapter 5 argues that analytics should move security from reporting to anticipating, and illustrates the argument with predictive threat modelling, threat intelligence enrichment and visualisation. The case studies are sketches rather than evaluations, and the visualisation section describes dashboards without showing what decision a dashboard improved. The chapter is strongest where it connects analytics to the rest of the organisation: risk registers, asset inventories, business continuity. Its weakness is conceptual. Prediction in security is not forecasting an attack date; it is ranking a population of assets, users or events by likelihood, and the quality of the ranking depends on the completeness of the inventory underneath. Read it as an argument for asset and identity data hygiene, which is what predictive analytics actually requires.
Chapter 6: Malware, Analysis and Forensics
The longest chapter, and the one with the most operational detail. It traces malware from the 1971 Creeper experiment through viruses, worms, trojans, ransomware and fileless techniques, then classifies malware by harm, spread, target, purpose and technical characteristic. The forensic half is the useful part. Static analysis reads the file without running it and is defeated by packing and obfuscation. Dynamic analysis runs it in a controlled environment and is defeated by evasion that detects the sandbox. Memory analysis examines a running system and finds what never touched disk. Behavioural analysis groups the sample with its family. The chapter says plainly that automation usually stops at the cheapest rung, and that the evidence an incident team needs is usually higher up.
Chapter 7: Identity and Access Management
The most mature chapter in the volume, because identity decisions are binary and therefore measurable. It describes the IAM stack, the threat landscape that has grown around credentials, and the specific failures of traditional IAM: role explosion, review fatigue, privileged accounts without owners, and machine identities created by automation and never retired. The machine learning use cases are concrete and modest: peer-group analysis for access anomalies, risk scoring at sign-in, entitlement recommendation for reviews, detection of privilege abuse. The challenges section is equally concrete, including false positives in access reviews and the difficulty of explaining a risk score to an auditor. If you read one chapter for immediate application, read this one.
Chapter 8: Real-Time Detection and Response
Chapter 8 covers detection and response together, which is the right unit. It compares learned detection to signature detection, describes the techniques used at each layer, and then describes response: isolation, blocking, credential revocation, ticketing. The case studies are anonymised success stories without numbers, which limits what a reader can take from them. The implementation challenges are the familiar three, data quality, integration with legacy systems and analyst trust, and the chapter is candid that trust is earned by evidence rather than by accuracy figures. Its most transferable idea is that detection without a rehearsed response only shortens the time to a decision nobody has authority to make.
Chapter 9: National and Sectoral Cyber Defence
This chapter widens the frame to critical infrastructure, health, finance, energy and defence, and argues that AI has become a condition of national cyber resilience rather than a commercial advantage. It also contains the volume's most uncomfortable section, on offensive use, where it concedes that the same tools that find vulnerabilities for a defender find them for an attacker, and that the boundary between penetration testing and exploitation is a matter of authorisation rather than capability. The chapter's weakness is that it treats national capability as a scale-up of enterprise capability, which it is not: states have different time horizons, different legal constraints and different adversaries. Read it for the framing, and read the offensive section twice.
Chapter 10: Intrusion Detection and Prevention Systems
A focused treatment of a single technology, and better for it. It describes IDPS components, the difference between detection and prevention, the placement decisions that determine what can be seen, and the machine learning techniques applied at the network and host level. The case studies are the usual anonymised deployments. The challenges section names the two that matter: the false-positive rate at scale, and the difficulty of explaining why a sequence of packets was classified as hostile. The chapter's practical contribution is the placement argument. An IDPS can only classify what passes through it, so the architecture decision precedes the model decision, and no amount of model quality recovers from a sensor on the wrong segment.
Chapter 11: Real-Time Detection Against Evolving Threats
The most methodologically explicit chapter. It sets out the machine learning families, the data collection and preprocessing pipeline, and the implementation choices that decide whether a model can run inside a service-level objective. It then does what the rest of the volume avoids: it states the error trade directly, with false positives producing alert fatigue and false negatives producing undetected intrusions, and it names adversarial machine learning as a first-class threat rather than a footnote. Its answer to the trade is human-in-the-loop confirmation of critical alarms, which is the correct answer and deserves more than a sentence. Read this chapter with chapter 7 if you want the two places where the book's claims survive contact with an operations team.
Chapter 12: AI-Powered Attacks
The adversary's chapter, and the one that changes how the rest of the book reads. It catalogues synthetic phishing and spear phishing, dataset poisoning that degrades a detector or biases a classifier, jamming, malware and distributed denial of service, and then reviews the learning techniques attackers use to build them. The writing is the roughest in the volume, with several sentences that need a second reading, and the technical depth is uneven. The content still lands. An attacker who can generate training samples can poison a model. An attacker who can vary text on every send can defeat a detector trained on phrasing. Once you have read this chapter, the optimism of chapters 8 and 13 looks like a statement about the defender's budget rather than about the technology.
Chapter 13: Automating Detection
Chapter 13 assembles the automation case across intrusion detection, phishing, malware and endpoint protection, and reports the numbers the rest of the book gestures at, including a claim that machine learning in endpoint detection reduced infections by up to 95 percent. The case studies are the strongest in the volume because endpoint telemetry is the one place where outcomes are countable. The challenges section is standard: data quality, integration, skills, ethics. The chapter's blind spot is the counterfactual. A reduction in infections may come from the model, from better patching, from a change in attacker behaviour, or from the measurement starting after a bad year. Automation is plausible and unproven here, which is not the same as wrong.
Chapter 14: SD-WAN, Edge and Fog
The final chapter leaves the security operations centre and asks how AI secures a network whose intelligence is distributed. It explains software-defined wide area networking, its controller and orchestrator architecture, the limits of centralised inspection, and the case for processing near the device in fog and edge layers. The security argument is the placement argument: latency budgets, data sovereignty and intermittent connectivity all push analysis outward, and outward means onto infrastructure the security team may not own. The chapter is detailed on architecture and thin on threat modelling. Read it for the sentence that reorganises the rest of the book: where the computation sits decides what can be inspected, and what can be inspected decides what can be defended.
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
IN PRACTICE
1. Map your own detection stack before you buy anything.
Take the security tool you rely on most and write its five links: what it collects, what it turns that into, what model or rule scores it, where the threshold sits, and what it does when the threshold is crossed. Most people discover that they know the vendor's name and nothing about the middle three links.
Action: draw the five boxes on one page, fill in what you can, and mark the gaps. The gaps are the questions for your next vendor call.
2. Ask for the false-positive rate at your volume, not the accuracy score.
Accuracy on a benchmark tells you how a model behaves on a balanced dataset. Your estate is not balanced. Ask what proportion of alarms were false in a comparable deployment, how many analyst hours per week the output consumed, and what happened to that number after tuning.
Action: put the three numbers in the procurement record. If the vendor cannot supply them, write "not supplied" and treat that as the answer.
3. Find every account that is not a person.
Ask your identity team how many accounts in the directory belong to applications, services, scripts or devices, and how many of those have an owner recorded. The answer is usually a large number and a small number.
Action: pick the ten with the broadest permissions, confirm each has an owner, and disable or scope one that does not.
4. Write down what your systems may do without approval.
List every automated action in your environment that changes state: isolating a host, disabling an account, blocking an address, deleting a message, quarantining a file. For each one, record who authorised it and what happens when it is wrong.
Action: choose one action that is currently unauthorised in writing and either authorise it with a bound or remove it.
5. Give every model update a change record.
Treat retraining as a release. Record what data it was trained on, what changed, what the regression test showed, and how to roll back. Drift is not solved by continuous learning; it is managed by release discipline.
Action: add a model entry to your change log this month, even if the model is a vendor's and the entry says "vendor managed, no visibility", because that sentence is itself a finding.
6. Decide who declares an incident, and practise it once.
The gap between detection and response is usually authority, not technology. A team that can see an intrusion and cannot declare an incident has a detection problem disguised as a governance problem.
Action: name the person who can declare an incident out of hours, confirm they know it, and run one table exercise where the model's alert is wrong and the team has to say so out loud.
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
QUIZ: TEST YOUR UNDERSTANDING
Question 1: The book reports that dangerous activity is rare compared with normal activity. Why does that single fact change how you read every accuracy figure in the volume?
Answer: Because a low base rate amplifies false positives. When malicious events are a tiny fraction of traffic, even a small false-positive rate produces far more alarms than true ones, so the analyst sees mostly noise and the model's headline accuracy says nothing about the workload it creates.
Explanation: This is the arithmetic the book mentions but does not carry through. A detector with one percent false positives against a one-in-ten-thousand event produces roughly a hundred false alarms for every true one. The number to ask a vendor for is the false-positive rate at your volume, not accuracy on a benchmark.
Question 2: Chapter 11 recommends human-in-the-loop confirmation for critical alarms. Why is that a structural choice rather than a temporary concession to imperfect models?
Answer: Because the confirmation step is where authority lives. A model produces a probability, and an organisation needs a decision with an owner. Human confirmation converts a score into an accountable act, and it also produces the labelled outcome that the next model needs.
Explanation: The book presents human-in-the-loop as a way to manage error rates. It is also the mechanism that makes the system governable: someone can be asked why an account was disabled, and someone can be trained to say no. Automation without that step is delegated authority with no record of the delegation.
Question 3: The book describes malware analysis as a ladder of static, dynamic, memory and behavioural techniques. What goes wrong when an organisation automates only the first rung?
Answer: It learns what a file claims to be rather than what it does. Packing, obfuscation and evasion defeat static inspection and sandbox-aware dynamic analysis, so the samples that matter most are the ones that produce no useful result at the cheapest rung.
Explanation: Chapter 6 is explicit that the evidence an incident team needs usually sits higher up, in memory or in behaviour. The automation decision is therefore a resourcing decision about where in the ladder the organisation is willing to pay for expertise.
Question 4: Chapter 7 argues that identity is now the control plane. What does that imply for an organisation that has automated most of its access provisioning?
Answer: That automation has been creating identities faster than governance has been creating owners. Machine accounts with broad permissions and no joiner-mover-leaver process are the predictable result, and they are exactly the accounts an attacker prefers.
Explanation: The chapter's machine learning use cases, peer-group anomaly detection and entitlement review, are valuable precisely because the population of identities has outgrown manual review. The first step is not a model; it is an inventory with owners.
Question 5: The book's final chapter moves to edge and fog computing. Why is that a security argument and not a networking detour?
Answer: Because inspection depends on placement. A sensor can only classify traffic that passes through it, and distributed architectures remove the chokepoints that centralised inspection relies on. Moving analysis to the edge restores visibility and removes the audit trail from your control at the same time.
Explanation: Latency budgets, data sovereignty and intermittent connectivity all push computation outward. The consequence is that the model, the evidence and the retention policy all sit on infrastructure the security team may not own, which turns a technical choice into a contractual one.
How many did you get right? Which ones surprised you?
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
CAN THIS BOOK ESSENTIAL REPLACE THE ORIGINAL?
No. This Essential compresses fourteen chapters into one argument and marks where the evidence is thin, but the book's value is in its breadth and its reference lists. Each chapter ends with a bibliography that is a reading list for its subfield, and no summary can substitute for that. Use this Essential to decide which four chapters belong to your work, then read those chapters in the original, follow two references from each, and treat the rest of the volume as a map you can return to when a vendor uses a term you cannot place.
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
QUOTES
"AI-driven cybersecurity is not merely a technology upgrade; it represents a fundamental transformation in how digital ecosystems are safeguarded."
"For professionals, researchers, and decision-makers, understanding and leveraging AI in cybersecurity is not just advantageous; it’s essential for building robust, future-proof defences in a world where digital security is paramount."
"Organizations around the globe are facing a growing arms race in cybersecurity as attackers employ advanced tools and tactics to breach networks, steal data, and interrupt operations."
"The emergence of adversarial AI highlights the creativity of attackers, driving advancements in defensive approaches."
"However, reliance on automation may pose challenges in managing complex, multi-faceted attacks or in dealing with false positives."
"This discrepancy can skew model performance, leading to a higher occurrence of false positives or negatives."
"While AI excels at handling extensive data sets and recognizing patterns, human knowledge is crucial for contextual understanding and strategic choice-making."
"Large language models (LLMs) are machine learning (ML) models designed for natural language processing (NLP) tasks, capable of producing high-quality text that is often indistinguishable from the text that a human wrote."
"A stark example of this is the 2017 WannaCry ransomware attack, which infected over 200,000 computers across 150 countries, crippling hospitals, governments and businesses while causing billions of dollars in damages."
"Traditional methods often fail due to their reliance on predefined rules and signature-based detection, which are ineffective against novel and sophisticated attacks."
"IAM is at the core of the cybersecurity realm, and it impacts other security disciplines like data security and Identity Security."
"Intrusion Detection and Prevention Systems (IDPS) play a vital role in cybersecurity by monitoring, analyzing, and responding to suspicious activities and potential threats within a network or system."
"On the one hand, false positives occur when alerts are generated for activities that are not genuinely malicious, leading to an overload of work for security teams and alert fatigue. On the other hand, false negatives happen when real threats go undetected, which can have disastrous consequences for organizations."
"Security teams can balance sensitivity and specificity and confirm crucial alarms by integrating human-in-the-loop technology."
"Current approaches are quite often based on static, rule-based systems unable to adapt in the dynamic struggle against cyber criminals, who adjust their strategies time and again."
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
AUTHOR'S EXPERTISE
Hooman Razavi is an associate research assistant in the Department of Engineering Science at Tecnológico de Monterrey in Mexico and at the University of Ottawa. He holds a bachelor's degree in computer engineering, a master's in artificial intelligence and a doctorate in engineering science, has taught as a sessional lecturer at University Canada West and as a lecturer for the United Nations Institute for Training and Research course on the internet of medical things, and has worked as a senior data scientist and consultant in fintech firms. He sits on the editorial board of the International Journal of Cybersecurity and Risk Assessment and reviews for a long list of IEEE and Elsevier journals.
Mariya Ouaissa is Professor of Cybersecurity and Networks at the Faculty of Sciences Semlalia, Cadi Ayyad University in Marrakech. She holds a doctorate in computer science and networks from ENSAM-Moulay Ismail University and an engineering degree in networks and telecommunications, co-founded an information technology consultancy, and has published more than eighty papers and edited thirty books in information security, internet of things security and constrained networks.
Mariyam Ouaissa is Assistant Professor of Networks and Systems at ENSA, Chouaib Doukkali University in El Jadida, with a doctorate from ENSAM-Meknes and an engineering degree from ENSA-Khouribga. Her research covers the internet of things, machine to machine communications, wireless sensor networks, vehicular networks and access control, with more than sixty papers and twenty edited books.
Haïfa Nakouri is a machine learning specialist, invited professor of computer science at the University of Quebec at Chicoutimi and assistant professor in business computing. She is a member of the UQAC Cybersecurity Research Chair, where her work concentrates on the vulnerabilities of machine learning models and on designing defences that improve their resilience, with more than twenty five research papers.
Ahmed Abdelgawad is a professor of computer engineering at Central Michigan University, with master's and doctoral degrees from the University of Louisiana at Lafayette and a previous role at IBM's semiconductor research and development centre. He is a senior member of the IEEE, has published two books and more than one hundred and thirty articles on the internet of things, wireless sensor networks, embedded systems and field programmable gate arrays, and has chaired several IEEE conferences in the field.
The limitation is structural rather than personal. An edited volume has no single argument and no single standard of evidence, and this one shows both. Several chapters are literature reviews, several are application surveys, and the statistical claims are drawn from trade reports rather than from measurements the editors performed. The contributor list is also narrower than fourteen chapters suggest, with a small number of research groups supplying multiple chapters, which shows in the repetition of framing paragraphs across the volume. None of that disqualifies the book. It does mean the reader should treat each chapter as the work of its authors rather than as the position of the editors, and should check the reference list before trusting a number.
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
RESOURCES
AI-Driven Cybersecurity, publisher page at Routledge and CRC Press (first edition, 2026).
The book's DOI record, which resolves to the Taylor and Francis page with chapter-level metadata.
NIST Cybersecurity Framework, the reference structure for the governance layer this book leaves out.
MITRE ATT&CK, the public knowledge base of adversary tactics and techniques that makes a detection claim testable.
CISA Known Exploited Vulnerabilities Catalog, the list that turns patch prioritisation from a policy into a schedule.
OWASP Top 10 for Large Language Model Applications, the closest thing to a standard list of language model risks, including prompt injection and data poisoning.
Verizon Data Breach Investigations Report, the annual dataset on how breaches actually start, useful for testing the book's framing against observed incidents.
NIST AI Risk Management Framework, for organisations that need a documented process around the models they deploy.
UK National Cyber Security Centre, practical guidance that is closer to operations than most vendor documentation.
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
NEXT STEPS
Read chapter 7 first: Identity is where the book's claims are most concrete and least dependent on model quality. If your organisation has not inventoried its machine identities, that gap is the finding.
Read chapter 11 second: It is the only chapter that states the false-positive and false-negative trade in operational terms. Use its language in your next procurement conversation.
Then read chapter 12: The adversary's chapter changes how the optimistic chapters read. Keep it open while you reread the case studies in chapters 8 and 13.
Draw your own stack: Use the five links, sources, features, models, decision, response, and place every security tool you own somewhere in the chain. Anything that cannot be placed is either a policy control or a purchase you cannot evaluate.
Write the delegation record: For each automated action in your environment, name the person who authorised it. If nobody did, you have found authority that has been delegated without a decision.
Set a review date: Drift means the model you approved is not the model you have a year later. Put the review in the calendar now, with the questions you will ask.
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
U365'S RECOMMENDATIONS TO LEARN MORE
This list collects the publisher record, the standards that make a security claim testable, and three recorded conversations about AI in security operations. Every link was checked at the time of writing. Information verified as of 2026-11-08.
Official learning resources
Video tutorials and channels
A Forrester analyst on security operations, alert volume and detection engineering, published Oct 3, 2025
A practical discussion with SOC analysts and detection engineers about daily use of AI, published Feb 5, 2026
A conversation on the operating model of a security operations centre and where AI fits, published Nov 10, 2025
Written tutorials and deep-dive articles
OWASP Top 10 for Large Language Model Applications, the reference list of language model risks, with prompt injection at the top.
Verizon Data Breach Investigations Report, the annual evidence base on how breaches begin.
NIST AI Risk Management Framework, the process side of governing a model in production.
UK National Cyber Security Centre guidance, practical and vendor-neutral.
Community and social
MITRE ATT&CK, the shared vocabulary for adversary behaviour.
CISA Known Exploited Vulnerabilities Catalog, updated continuously and used by most patch programmes.
CISA, the US cybersecurity agency, which publishes advisories and incident guidance.
Resources on X
Dedicated X channels:
AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems (Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad)
IMPORTANT NOTICE
This Book Essential is an original summary and critical analysis of AI-Driven Cybersecurity: Revolutionizing Threat Detection and Defence Systems, edited by Hooman Razavi, Mariya Ouaissa, Mariyam Ouaissa, Haïfa Nakouri and Ahmed Abdelgawad (CRC Press, 2026). Short quotations from the book are attributed and cited for purposes of criticism, review, and education. All rights in the original work belong to its editors, contributors and publisher; this Essential is not a substitute for the book: read the original at the publisher's page.
This book is part of University 365's learning library. Explore INSIDE, our publications, and our programs. The best summary is not a substitute for the book. Read the original. Discuss this book with a U.Coach.
Note: verify current details before relying on this comparison. Information verified as of 2026-11-08.
Comments