Offence–Defence Asymmetry in the Age of Artificial Intelligence: Implications for the Cyber Threat Landscape

Abstract

The swift integration of artificial intelligence (AI) into digital architecture is generally considered a transformative process in the area of cybersecurity. However, much of the current literature on the topic considers AI either as a technology that amplifies cyber capabilities or as a new form of governance challenge that demands regulation. This chapter presents a different case: that AI is best conceptualized as a structural variable that alters the balance of offence and defence in cyberspace. By using the theoretical framework of International Relations (IR) theory, specifically the literature on offence-defence asymmetry and security dilemmas, this chapter contends that the current form of AI systems aggravates the pre-existing imbalance between offence and defence in cyberspace, thereby exacerbating the instability of the global cyber threat environment. The offence-defence balance approach, which has traditionally been used to assess conventional and nuclear security, examines the prevailing technological and strategic conditions of a given environment to determine whether it is more advantageous to launch an attack or defend against one. When the costs of offence are lower than those of defence, states are likely to pursue preemptive strategies, the threat of escalation rises, and deterrence policy becomes unreliable. Cyberspace has long been considered an offence-preferred environment, where attackers need only find one vulnerability to breach the system, while defenders must protect a complex and constantly evolving target, where attribution is slow and uncertain, and where offensive capabilities can be easily copied at a low cost. The pre-AI cyber environment is already characterized by asymmetrical vulnerability. Cyber operations are different from traditional warfare in that they leverage systemic interconnectivity, civilian infrastructure, and dual-use technology. The defensive effort is high due to the expansive and constantly updated nature of digital networks, while the offensive community, whether state or non-state, enjoys the benefits of obscurity and anonymity. These characteristics establish what can be termed a persistent offence bias in cyberspace. The chapter will establish this baseline in order to evaluate the impact of AI on the balance and in which direction. Second, the chapter will explore how particular AI capabilities increase the reach of the offensive community. AI-enabled vulnerability scanning, code generation, and machine learning-driven reconnaissance decrease the technical skill set and time previously required for sophisticated cyber operations. Generative tools facilitate scalable and context-specific social engineering attacks, reducing the traditional trade-off between credibility and scalability in phishing and fraud. Adaptive malware can iterate independently in response to defensive efforts, improving the resilience and longevity of intrusions. Taken together, these trends reduce the barriers to entry for malicious actors, accelerate attack cycles, and improve the strategic reach of relatively resourceconstrained actors.
Notably, the chapter will show how AI interacts with existing cyber structures to increase the flexibility of the offense. Third, the chapter will critically evaluate whether defensive AI mitigates these trends. Advocates claim that machine learning improves anomaly detection, threat intelligence analysis, and real-time response capabilities. While these tools improve defensive monitoring, they are subject to structural and institutional constraints. Defensive AI systems require high-quality training data, produce a high rate of false positives, and require human direction within legal and administrative frameworks. Furthermore, defensive infrastructures are typically situated in complex public-private ecosystems, which impede coordination and response. By contrast, the offensive community enjoys fewer normative or institutional constraints. The imbalance is not only based on technical capability but also on organisational and regulatory environments that shape the use of AI. On the basis of this comparative analysis, the chapter goes on to examine the wider implications of international security. If AI further expands the offence defence gap in cyberspace, several implications follow. First, the risk of escalation could rise as the condensed time frames for detection and response leave less time for decision-makers to deliberate. Second, deterrence becomes more problematic as the delay between attacks and attribution trails the rapid execution of AI-enabled attacks. Third, the proliferation of superior capabilities to non-state actors further cloud state-centric visions of cyber stability. The chapter thus places AI in the context of debates on strategic stability, contending that cybersecurity must be understood not only as a technical challenge but also as a space of evolving power relations, and explores structural avenues for mitigating AI-driven asymmetry through architectural reform, collective defence coordination, improved attribution, and normative adaptation.The aim is to offer a framework by which policymakers and scholars might assess future technological developments without recourse to either alarmism or technological optimism.

DOI - https://doi.org/10.65525/SVUP.9788199328631.2025.87-102