AI Overreliance Could Erode Critical Thinking for Security Teams

In an opinion column published on SecurityWeek, F5 Field CISO Joshua Goldfarb warned that heavy reliance on AI is harming the cybersecurity profession. Prompted by a substitute speaker who asked him for presentation content like an AI prompt, Goldfarb acknowledged AI boosts productivity and aids attackers, but argued it erodes six human strengths: creativity, humour, sincerity, distinctive messaging, clear communication, and critical thinking. For security teams and organisations, including IT administrators and businesses in Malaysia adopting AI tools, losing critical thinking poses risks during novel incidents with no pre-existing playbook.

Key Facts

Why Does Overreliance on AI Harm Security Teams?

Goldfarb argues that delegating core security tasks to AI strips away human qualities that technology cannot replicate, specifically creativity, humour, and sincerity. While AI rapidly curates and searches large volumes of data, he writes that overreliance weakens how practitioners spot irregularities, connect with colleagues, and deliver difficult news effectively.

In his column, Goldfarb notes that security work relies on noticing oddities and solving problems creatively, tasks he believes cannot simply be handed to AI. He adds that witty humour helps defuse tension and make serious security guidance easier to accept, while genuine human emotion builds trust. Because AI can only mimic emotion rather than feel it, teams that lean too heavily on AI risk sounding insincere when asking stakeholders to cooperate.

According to Goldfarb, security teams that overrotate on AI risk losing sincerity, which he describes as one of their most important tools.

How Does AI Affect Security Communication and Critical Thinking?

Goldfarb warns that using AI to write, organise thoughts, and perform analysis is making security language less precise and weakening critical thinking. He observes that AI-generated vendor messaging sounds repetitive and unremarkable, while turning to AI for answers leaves practitioners less prepared for unfamiliar security situations that lack pre-existing solutions.

Reflecting on a large security conference, Goldfarb writes that expo floor attendees noticed many companies repeating the same points, which he attributes partly to marketing teams generating copy with AI. Beyond messaging, he emphasises that cybersecurity depends on timely, accurate communication and that AI-assisted writing is easy to recognise while eroding clarity. Most critically, relying on AI to analyse incidents or suggest next steps diminishes independent judgement when defenders encounter unprecedented events.

Goldfarb states that the security profession depends on timely, accurate communication and critical thinking for unprecedented situations where no pre-existing answer exists.

What Boundaries Did the Author Recommend for AI Use?

Rather than banning AI outright, Goldfarb recommends setting firm boundaries around when security professionals will and will not use it. He explains that he refuses to use AI to suggest topics, conduct research, organise his thoughts, build outlines, or draft content, extending his long-standing career rule against using ghostwriters.

Goldfarb acknowledges that AI has valid use cases that improve productivity and efficiency, even as attackers use AI to increase the speed and accuracy of their operations. However, he maintains that resisting AI for thinking, researching, and writing tasks keeps published work sharper and preserves essential professional habits over the long run.

Goldfarb writes everything bearing his own name and refuses to use AI for topic suggestions, research, outlining, or content creation.

What Should You Do?

Because the source is an industry commentary rather than a software vulnerability advisory, no software patch or vendor fix applies. Based on the practices supported in the column, security teams and IT administrators can take the following steps:

• Establish firm internal boundaries defining which tasks may use AI and which require solely human judgement.
• Keep human analysts responsible for critical thinking and analysis during unfamiliar incidents where no pre-existing answer exists.
• Draft security communications, advisories, and presentations directly without delegating outlining, research, or writing to AI when precision and sincerity matter.
• Seek guidance, lessons learned, and practical tips from experienced peers rather than treating colleagues like an AI prompt interface.

Common Questions

Does Joshua Goldfarb claim AI has no benefits in cybersecurity?

No. Goldfarb explicitly acknowledges that AI provides productivity, efficiency, and other operational benefits across many use cases. His concern is that relying on AI for creative observation, communication, and analytical judgement weakens human skills that remain essential when security teams face unprecedented situations.

What prompted Goldfarb to write this column?

After declining a speaking invitation due to a schedule conflict, Goldfarb was approached by the replacement speaker for content. Instead of asking for guidance, tips, or lessons learned, the speaker essentially sent a prompt requesting key points and a presentation, mirroring how people query AI.

Are attackers also using AI according to the source?

Yes. Goldfarb notes that he is aware of many instances where attackers are using AI to increase both the speed and accuracy of their attacks against organisations, though his column focuses on how AI usage is affecting defenders internally.

Sources and Methodology

This dispatch is based exclusively on the SecurityWeek opinion article Is AI Making Us Worse at Cybersecurity? by Joshua Goldfarb (the provided source text did not include a publication date). No other documents, advisories, or vendor pages were reviewed or consulted.