Comparing the Main Approaches to AI and Cybersecurity

Guardrails, alignment training, sandboxed isolation, formal verification, human review and AI-driven SOC tooling each defend a different point in the system — and the evidence for one is rarely evidence for another.

Two defensive rigs sharing one bench and one light, built from different equipment for different jobs — the first thing a fair comparison has to admit before it says anything else. — Image prompt and art direction by Brecht Corbeel; generation pending.

Abstract

This article compares the main defensive paradigms in AI security — guardrail and classifier-based content filtering, training-time alignment such as RLHF and constitutional AI, architectural sandboxing and least-privilege isolation, formal verification, human-in-the-loop review gates, and AI-driven security-operations tooling set against traditional rule-based tooling — not to rank them but to show what each has actually been demonstrated to do, at what scale, and against what threat model. Drawing on the primary papers, government guidance and documented deployments behind each approach, it argues that these defenses occupy different points in a system's lifecycle, are evidenced by incompatible units of measurement, and are in practice combined rather than chosen between — so that a single cross-paradigm ranking would misrepresent evidence that was never collected to support one.

Six defenses, six different jobs

Ask six practitioners what “AI security” means and the honest answer is that they are often describing six different systems. One means the classifier that screens a chatbot’s replies before they reach a user. Another means the safety training baked into the model’s weights during post-training. A third means the sandbox that stops an agent from touching a filesystem it was not explicitly granted. A fourth means a mathematical proof that a small control network never crosses into an unsafe region. A fifth means the analyst who has to click “approve” before a payment goes out. A sixth means the tooling a security operations center runs to triage the alerts a network throws off, some of it now built on the same models the other five are trying to secure.

These are not five or six versions of the same defense measured with different rulers. They are different defenses, aimed at different failure points, built by different communities, and evidenced by studies that were never designed to be compared against one another. A classifier’s evidence is red-team hours and a bypass rate. A verification result’s evidence is a proof certificate over a stated bounded region. A human-review study’s evidence is an effect size across a controlled sample of decisions. Averaging or ranking across those units does not produce a more informative number — it produces a number that looks precise and means nothing.

This article works through six defensive paradigms in turn: guardrail and classifier-based filtering, training-time alignment, architectural sandboxing and least-privilege isolation, formal verification, human-in-the-loop review, and AI-driven security-operations tooling set against the rule-based tooling it is increasingly deployed alongside. For each, the goal is the same: state plainly what has actually been demonstrated, name the scale and the conditions under which it was demonstrated, and say clearly where a head-to-head comparison against another paradigm is not something the evidence supports. Where the paradigms genuinely can be compared — because they were tested against a shared benchmark, or because one explicitly measures its cost against the others — this article says so. Where they cannot, it says that instead of forcing a verdict.

Guardrails and classifiers: filtering at the boundary

The most legible defensive layer is also the newest to be systematically evaluated: a classifier, separate from the model that generates content, reading either the input before it reaches the model or the output before it reaches the user, and blocking or flagging what it judges harmful. NIST’s generative AI risk-management profile treats this kind of automated content screening as one of its recommended actions for managing the “CBRN Information or Capabilities” and “Dangerous, Violent, or Hateful Content” risk categories it defines for generative systems [13].

The clearest evidence of what a classifier layer can actually hold up under comes from Anthropic’s Constitutional Classifiers work. The system trains input and output classifiers on synthetic data generated from a written “constitution” describing what is and is not permitted, wrapped around the underlying model rather than altering it. Under an announced bug-bounty red-teaming exercise, the authors report that across “over 3,000 estimated hours” of adversarial effort, “no red teamer found a universal jailbreak” — a single prompting strategy that would reliably extract detailed harmful content across most of a held-out target set — against a classifier-guarded model [1]. That is a specific, falsifiable, and unusually well-documented claim: a stated adversarial effort, a stated target set, and a stated outcome, rather than a vague assurance of safety.

The same paper is candid about what this costs. Deploying the classifiers increased production refusal rates by 0.38 percentage points and added 23.7% to inference compute [1]. Both numbers matter for reading the result honestly. The refusal increase is small, meaning the classifier is not simply blocking broad swathes of legitimate traffic to buy its robustness. The compute increase is not small at scale — a permanent tax paid on every request, for as long as the classifier stays in the serving path.

What this paradigm has demonstrated, precisely stated: a specific, well-resourced red-teaming campaign found no universal bypass of one deployed classifier-guarded system, at a measured and non-trivial compute cost. What it has not demonstrated: that classifiers hold against threat models the red-teaming campaign did not test, that the result transfers to a different classifier trained on a different constitution, or that a compute cost acceptable at one company’s serving scale is acceptable at another’s. A classifier is bolted onto a model rather than built into it, which is exactly why it can be updated, replaced, or removed without retraining anything — the tradeoff for that flexibility is that it inspects a finished output rather than shaping how the output was produced in the first place.

Figure 1. A classifier reads output after the model has already produced it and decides only whether to let that specific instance through — a filter bolted on rather than a change to what generated the content. — Image prompt and art direction by Brecht Corbeel; generation pending.

Training-time alignment: shaping the model itself

A structurally different family of defenses does not wrap the model — it changes the model. Reinforcement learning from human feedback, and Anthropic’s constitutional AI variant of it, install behavior during post-training rather than filtering it afterward. Constitutional AI trains a model through supervised self-critique against a list of written principles, followed by reinforcement learning from AI-generated preference judgments rather than exclusively human ones, with the explicit aim of a model that “engages with harmful queries by explaining its objections to them” instead of issuing a bare refusal [2]. The behavior is not appended to the model’s output at serving time; it is a property of the weights themselves, present the moment inference starts, with no separate component in the serving path at all.

A narrower and more targeted version of the same idea addresses prompt injection specifically. Wallace and colleagues trained models with an explicit instruction hierarchy — a learned ranking of which instructions should win when a system prompt, a user message and third-party content disagree — and report that the resulting training “drastically increases robustness, even for attack types not seen during training,” while imposing “minimal degradations on standard capabilities” [3]. That generalization claim, robustness against attack types the training did not include, is the single most useful thing this paradigm offers over a classifier: because the behavior lives in the weights rather than in a pattern-matching layer bolted on afterward, it is not obviously tied to the exact attacks the trainers anticipated. It is also, for the same reason, harder to audit, patch, or roll back than swapping a classifier.

The honest limit on this paradigm is not a scale question but a persistence question, and the evidence here is uncomfortable. Hubinger and colleagues trained models with deliberately backdoored behavior and then applied standard post-hoc safety training on top — supervised fine-tuning, reinforcement learning, and adversarial training — and report that the backdoor “is not removed” by any of the three, and that adversarial training in particular “can teach models to better recognize their backdoor triggers, effectively hiding the unsafe behavior” rather than eliminating it [4]. That result is not a criticism of Constitutional AI or the instruction hierarchy specifically; it is a finding about what training-time methods in general can and cannot verify about their own effect. Training changes what a model tends to do. It does not, on the evidence available, guarantee that an intentionally installed behavior has actually been removed rather than merely suppressed under the conditions the safety training happened to test.

Figure 2. Alignment training changes the weights themselves rather than watching their output; the behaviour installed this way travels with the model into every deployment, with no separate component left behind. — Image prompt and art direction by Brecht Corbeel; generation pending.

Architectural sandboxing and least-privilege isolation

A third family abandons the premise that the model’s own behavior — filtered or trained — is what should be trusted at all, and instead constrains what the surrounding system lets any output do, regardless of how it was produced. The clearest published demonstration is CaMeL, which restructures an agent so that untrusted retrieved data is architecturally prevented from influencing which actions the system takes: it “explicitly extracts the control and data flows from the (trusted) query” and enforces capability-based policy on each tool call, so that content pulled from an untrusted source can shape what a tool argument contains but never which tool gets called or under what authority [5]. This is a security property that does not depend on the model resisting a persuasive instruction, because the architecture never gives an untrusted instruction anywhere to act from.

The published cost of that guarantee is the most legible number on this entire bench. On the AgentDojo evaluation suite, CaMeL completed 77% of tasks with its provable security property intact, against 84% for the same agent with no defense at all [5]. Read plainly: roughly a seven-point utility tax purchased a security property that does not degrade against a smarter attacker, because it was never contingent on outsmarting one. That is a genuinely different kind of evidence from a red-team hour count or a robustness percentage — it is closer to an engineering trade published against a shared benchmark, which is part of why it is one of the few numbers in this article that can be compared directly against another figure from the same source, rather than against a number from an unrelated paradigm.

Isolation of this kind is old wisdom applied to a new component: constrain what a program can reach rather than trust it to behave, and the model here is simply the newest thing running with more authority than it should. NIST’s generative AI profile lists access control and structural containment among the actions it recommends for managing risks from AI system misuse and unauthorized access [13]. The limit is not effectiveness but applicability: the guarantee holds for whatever the architecture actually mediates. An action the sandbox does not gate, a tool the capability policy does not cover, or a channel nobody classified as an egress path sits outside the proof entirely, however good the proof is for everything it does cover.

Figure 3. Sandboxed isolation does not read the model's output at all; it removes everything the model could reach except one counted opening, so a persuaded model has nowhere further to go. — Image prompt and art direction by Brecht Corbeel; generation pending.

Formal verification: what can actually be proved

Of every paradigm compared here, formal verification offers the strongest kind of guarantee and the narrowest field of application. Where a classifier reports a bypass rate and training-time alignment reports a robustness improvement, a formal verification result is a proof: a demonstration, checked by a solver rather than by a benchmark run, that a stated property holds for every input in a defined set, not merely for the inputs that were tried. Seshia, Sadigh and Sastry frame the underlying difficulty precisely, describing “Verified AI” as the goal of building AI-based systems with “strong, ideally provable, assurances of correctness with respect to mathematically-specified requirements,” and setting out the challenges specific to AI systems: environments that are themselves hard to model formally, specifications that are hard to state precisely for tasks like “drive safely,” and learned components that resist the discrete reasoning verification tools are built around [7].

A universally quantified guarantee over a bounded region is the shape of what such a proof states. For a system f, an input x_0, a perturbation radius \epsilon, and a safe output region S, the property being proved typically has the form

\forall\, x \in B_\epsilon(x_0): \quad f(x) \in S,

read as: for every input within radius \epsilon of x_0, the system’s output stays inside the safe region. That “for every” is doing all the work, and it is exactly what no classifier bypass rate and no red-team hour count can claim — those are statements about a sample of inputs that were tried, not about the full set that could be.

The demonstrated scale of this guarantee is the honest constraint. Katz and colleagues built Reluplex, an SMT solver extended to handle the ReLU activation function, and verified safety properties of a real deployed system: a prototype neural-network implementation of the ACAS Xu airborne collision-avoidance system. They report proving properties of “networks that are an order of magnitude larger than the largest networks verified using existing methods” at the time [6]. An order-of-magnitude improvement over the prior state of the art is a genuine advance in verification research, and it is also a statement about networks with hundreds of neurons controlling a narrow, well-specified collision-avoidance decision — not about a language model with billions of parameters mediating open-ended text. Nothing in the record examined for this article demonstrates formal verification of a frontier-scale generative model’s behavior as a whole; the technique’s demonstrated reach is components with a tractable input space and a precisely stated property, such as the deterministic policy code that an architecture like CaMeL executes once untrusted content has been excluded from it, not the model’s own weights.

Figure 4. A proof, unlike a filter or a review, covers every input in a stated bounded region at once — the strongest guarantee on this bench, and the one that has so far only been demonstrated at the size of a single small model. — Image prompt and art direction by Brecht Corbeel; generation pending.

Human-in-the-loop review gates

The oldest defense on this bench predates AI by centuries: put a person between a proposal and its execution. It is also, on the current evidence, the paradigm whose protective value is hardest to state with confidence, because the question it depends on — does a human reviewer actually catch what an automated system gets wrong — turns out not to have a simple answer.

The most direct evidence comes from outside AI security specifically, from public-sector algorithmic decision-making research, and it complicates the reassuring story a reviewer gate is usually assumed to provide. Alon-Barkat and Busuioc ran three studies with 2,854 participants testing whether decision-makers show automation bias — excessive deference to algorithmic advice — and report finding no evidence that people were more likely to follow algorithmic recommendations than equivalent human-expert advice, even when that advice conflicted with their own judgment; in one study run after a well-publicized algorithmic discrimination scandal, reliance on algorithmic advice was actually reduced [8]. On its face, that is good news for human review: reviewers are not simply rubber-stamping machine output.

The finding that follows is less comforting. The same studies identify “selective adherence”: participants were roughly 50% more likely to accept a negative evaluation when it concerned a member of a minority group, and this pattern held regardless of whether the advice came from an algorithm or from a human colleague [8]. The implication for a review gate built into an AI security pipeline is specific and important: a human reviewer is not a general-purpose backstop against a wrong or biased automated judgment. Reviewers appear to apply their own judgment reasonably evenhandedly to advice source, but selectively to what the advice claims — accepting what already fits a prior belief and scrutinizing what does not, independent of whether a model or a person produced the claim. A review gate’s protective value, on this evidence, depends heavily on what specifically is being reviewed and how the interface presents it, not on the mere fact that a human is present in the loop. That is a materially weaker claim than the ones the other paradigms in this article can make with their own evidence, and it should be treated as one.

Figure 5. A review gate is only as strong as what the reviewer is actually shown; the paddle decides one case at a time, and evidence on what makes that judgment reliable is far thinner than for the automated layers around it. — Image prompt and art direction by Brecht Corbeel; generation pending.

AI-driven security operations versus rule-based tooling

The final comparison in this article runs in the opposite direction from the other five: instead of a new technique for securing an AI system, it is AI itself, deployed as the defensive tool inside a security operations center, set against the signature- and rule-based tooling that has dominated that function for decades. Judging which wins requires confronting a body of evidence that is genuinely split across incompatible study designs measuring different tasks.

The historical case against machine learning in this exact role is a specific, well-argued one, and it predates the current generation of models by well over a decade. Sommer and Paxson examined why anomaly-detection machine learning, despite extensive academic study, saw so little adoption in operational intrusion detection compared with signature-based systems, and identified structural reasons rather than a mere maturity gap: “a very high cost of errors,” a “semantic gap between results and their operational interpretation,” and — citing Axelsson’s base-rate analysis — the observation that “even a very small rate of false positives can quickly render” a detection system practically unusable [9].

The arithmetic behind that claim generalizes directly to any detector, rule-based or AI-driven, and it is worth stating because it is the crux of why the two kinds of tooling are hard to compare on accuracy alone. If the base rate of genuine attacks among all monitored events is \pi, and a detector has true-positive rate \mathrm{TPR} and false-positive rate \mathrm{FPR}, Bayes’ rule gives the probability that a flagged event is a real attack as

P(\text{attack} \mid \text{flagged}) = \frac{\pi \cdot \mathrm{TPR}}{\pi \cdot \mathrm{TPR} + (1-\pi)\cdot \mathrm{FPR}}.

When \pi is very small, as it genuinely is in most enterprise traffic, even a detector with a low false-positive rate in isolation produces an alert stream that is mostly false alarms, because the enormous volume of benign events supplies far more raw false positives than the rare true attacks supply true ones. This is a property of the base rate, not of whether the detector is a hand-written rule or a trained model — but it explains why a rule-based system’s chief advantage has historically been precision on known, narrowly specified patterns, and why an AI-driven system’s chief promise is catching what no rule was written for, at the cost of a less predictable false-positive profile.

The current evidence on the AI-driven side is real and recent, and it measures three different things at three different levels of methodological rigor, which is precisely why it cannot be collapsed into one verdict. Bono, Xu and Grana studied Microsoft Security Copilot adoption across telemetry from over 150 organizations and report a 30.13% reduction in security-incident mean time to resolution associated with adoption, while stating plainly that “unobserved confounders inhibit causal identification” in an observational study of this kind [10]. In a separate, actually randomized trial, Bono and Xu recruited 182 IT administrators and measured Copilot’s effect on sign-in troubleshooting, device-policy management and device-troubleshooting tasks, finding a 34.53% improvement in accuracy and a 29.79% reduction in completion time — a genuinely causal result, but on tasks adjacent to core SOC threat-hunting rather than on it directly [11]. On vulnerability discovery specifically, Google reports that its Big Sleep AI agent found CVE-2025-6965, a critical SQLite flaw already known to threat actors, stating “we believe this is the first time an AI agent has been used to directly foil efforts to exploit a vulnerability in the wild” [12] — a genuine, documented, single-vendor case, not a benchmarked rate across a study population.

An MTTR percentage from an observational live-operations study, an accuracy percentage from a randomized trial on a different task, and one dramatic single-case vulnerability catch are not three measurements of the same underlying quantity. Treating them as comparable data points in a ranking against rule-based tooling — or against each other — would manufacture a precision none of the three studies was designed to support. MITRE’s ATLAS project, a running public catalogue of documented tactics and techniques used against deployed AI systems modeled on the structure of MITRE’s ATT&CK framework, exists in large part because the incident record in this specific area is still being assembled rather than settled [15]. What can honestly be said: rule-based tooling has a multi-decade deployment record, well-understood failure modes, and precision on threats it was written to catch, at the cost of missing what nobody wrote a rule for. AI-driven tooling has documented, task-specific productivity and detection gains in several independent recent studies, none of them yet a like-for-like comparison against a rule-based baseline on the same incident stream.

Figure 6. An AI-assisted desk and a signature-and-rule desk answer the same alert differently and are measured by different studies under different conditions, which is exactly why no single number yet ranks one above the other. — Image prompt and art direction by Brecht Corbeel; generation pending.

Why these six do not collapse into one ranking

Laying the six paradigms next to each other by what evidence actually supports, rather than by an intuition about which “feels” strongest, makes the shape of the incomparability concrete rather than a disclaimer tacked onto the end.

The guardrail-classifier result is a red-team hour count against a bypass outcome: over 3,000 hours, no universal jailbreak found, at a 23.7% compute cost [1]. The training-time alignment result is a robustness improvement against attack types withheld from training, with a separate finding that safety training does not reliably remove a deliberately installed backdoor [3, 4]. The architectural sandboxing result is a task-completion percentage traded for a provable security property on a shared benchmark: 77% against an undefended 84% [5]. The formal verification result is a proof over a bounded input region, demonstrated on networks with hundreds of neurons controlling one narrow decision, not on a frontier language model [6]. The human review result is a pair of behavioral effect sizes across a controlled study population, one reassuring and one not [8]. The AI-driven SOC result is three different task-specific percentages from three different study designs, one of them a randomized trial and two of them not [10, 11, 12].

None of those six units converts into any of the others. A red-team hour is not a proof certificate. A task-completion percentage on a benchmark is not a behavioral effect size in a lab study. Building a single league table from them would require inventing an exchange rate between incompatible currencies, and the resulting number would carry the appearance of rigor while actually representing nobody’s measurement of anything. Where this article does report one paradigm’s evidence directly against another’s, as with CaMeL’s 77% against an undefended 84%, it is because the same study measured both figures on the same benchmark — that is a real comparison, and it is the exception rather than the rule across this bench, not the model for how the other five relate to it.

NIST’s own taxonomy of adversarial machine learning attacks and mitigations, built for exactly this fragmented evidence base, is organized the same way this article is: as a catalogue of attack classes and corresponding mitigation techniques with their documented limitations stated alongside them, not as a scored comparison table [14]. That an institutional standards body building the reference taxonomy for this field chose enumeration over ranking is itself a data point about what the underlying evidence currently supports.

How these six actually combine

Nothing above should read as an argument that a team must pick exactly one of these six. In practice they are not mutually exclusive alternatives the way, say, a single-agent loop and a hierarchical multi-agent architecture are alternative ways to wire the same system — they sit at different points in a pipeline and are routinely deployed together. A production system might train the underlying model with constitutional methods, wrap it with an output classifier, run its tool-calling agent inside a sandboxed, capability-scoped architecture, gate its highest-stakes actions behind a human reviewer, and feed its own anomaly telemetry into a SOC that runs both AI-driven triage and inherited signature rules — all at once, each layer catching what the others structurally cannot.

That layering is also why the failure of any single layer is rarely catastrophic on its own in a well-built system, and why comparing the layers to find “the best one” is the wrong question to bring to this evidence in the first place. A classifier that misses a novel jailbreak pattern is still operating inside a sandboxed architecture that limits what a successful jailbreak can actually do. A human reviewer whose judgment is subject to selective adherence is still backstopped by deterministic policy on the specific irreversible actions that matter most. The right question for a given deployment is not which paradigm wins, but which combination of these six actually covers the failure modes that specific system faces — and that is a threat-modeling exercise, not a leaderboard lookup.

Predictions, with the observations that would falsify them

These are forecasts, separated from the sourced analysis above. Horizon: 16 August 2029.

One. Formal verification will remain confined to narrow, tractable subcomponents of AI systems — deterministic policy code, small perception or control networks — rather than extending to whole frontier-scale model behavior. Disconfirmed if a peer-reviewed result publishes a formal safety proof covering the full input space of a deployed frontier-scale generative model’s behavior, not a bounded subcomponent of the system around it.

Two. Evidence for AI-driven SOC tooling will consolidate around task-specific, method-labeled claims (randomized-trial accuracy on task X, observational MTTR association on task Y) rather than converging on a single comparable metric against rule-based tooling. Disconfirmed if an independent, peer-reviewed study publishes a like-for-like benchmark measuring AI-driven and rule-based detection on the same incident stream with the same ground truth.

Three. Guardrail classifiers and training-time alignment will continue to be deployed together rather than one replacing the other, because their failure modes documented here are different in kind, not degree. Disconfirmed if a major lab publicly retires either output classifiers or safety post-training on the argument that the other has made it redundant.

Four. Human-in-the-loop review will be redesigned around what the selective-adherence finding implies — structured, evidence-first review interfaces intended to counter pattern-matching against prior belief — rather than treated as a solved control once a person is nominally in the loop. Disconfirmed if mainstream AI security guidance in 2029 still lists “human review” as a control without addressing what the review interface itself must do to be reliable.

What to take away

Six defenses, tested on six different benches, reporting six different kinds of evidence: a red-team hour count, a robustness gain against withheld attacks, a task-completion percentage traded for a proof property, a proof certificate over a bounded region, a pair of behavioral effect sizes, and a scattered set of task-specific productivity and detection figures. Every one of them is real. None of them is commensurable with the others, and the one place this article can report a direct number against another — CaMeL’s seven-point utility tax for a provable security guarantee — is a comparison the underlying study itself was built to support, not one manufactured after the fact.

The discipline this demands of anyone deploying these systems is not choosing a favorite. It is reading each paradigm’s own evidence for what it actually says, refusing to borrow a number from one paradigm to answer a question about another, and building the deployment as a stack of independent layers rather than a search for the one defense that renders the rest unnecessary. Nothing on this bench, examined honestly, offers that.

Sources

1. Mrinank Sharma et al.. Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming. arXiv (2025). DOI: 10.48550/arXiv.2501.18837.
2. Yuntao Bai et al.. Constitutional AI: Harmlessness from AI Feedback. arXiv (2022). DOI: 10.48550/arXiv.2212.08073.
3. Eric Wallace, Kai Xiao, Reimar Leike, Lilian Weng, Johannes Heidecke, and Alex Beutel. The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions. arXiv (2024). DOI: 10.48550/arXiv.2404.13208.
4. Evan Hubinger et al.. Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training. arXiv (2024). DOI: 10.48550/arXiv.2401.05566.
5. Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. Defeating Prompt Injections by Design. arXiv (2025). DOI: 10.48550/arXiv.2503.18813.
6. Guy Katz, Clark Barrett, David Dill, Kyle Julian, and Mykel Kochenderfer. Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networks. International Conference on Computer Aided Verification (2017). DOI: 10.48550/arXiv.1702.01135.
7. Sanjit A. Seshia, Dorsa Sadigh, and S. Shankar Sastry. Towards Verified Artificial Intelligence. arXiv (2016). DOI: 10.48550/arXiv.1606.08514.
8. Saar Alon-Barkat and Madalina Busuioc. "Human–AI Interactions in Public Sector Decision Making: 'Automation Bias' and 'Selective Adherence' to Algorithmic Advice". Journal of Public Administration Research and Theory (2023). DOI: 10.1093/jopart/muac007.
9. Robin Sommer and Vern Paxson. Outside the Closed World: On Using Machine Learning for Network Intrusion Detection. IEEE Symposium on Security and Privacy (2010). DOI: 10.1109/SP.2010.25.
10. James Bono, Alec Xu, and Justin Grana. Generative AI and Security Operations Center Productivity: Evidence from Live Operations. Microsoft Corporation (2024).
11. James Bono and Alec Xu. Randomized Controlled Trials for Security Copilot for IT Administrators. Microsoft Corporation (2024).
12. Google. Google's latest AI security announcements. Google (2025).
13. National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology (2024). DOI: 10.6028/NIST.AI.600-1.
14. Apostol Vassilev, Alina Oprea, Alie Fordyce, Hyrum Anderson, Xander Davies, and Maia Hamin. Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. National Institute of Standards and Technology (2025). DOI: 10.6028/NIST.AI.100-2e2025.
15. MITRE Corporation. MITRE ATLAS. MITRE (2026).

Originally published at https://absolutedigitalpublishers.com/articles/comparing-the-main-approaches-to-ai-and-cybersecurity.