Integrating Gai Into Cybersecurity: A Study of Organizational Practices

Abstract

With cyberattacks increasing in volume and number, organizations are increasingly at risk. This qualitative phenomenological study explored how Generative Artificial Intelligence (GAI) tools have been applied to improve cybersecurity and reduce risk. The research used semi-structured interviews of twelve technology leaders responsible for cybersecurity at U.S.-based organizations, purposively sampled from Society for Information Management members representing diverse organizational sizes, industries, and GAI maturity levels. Thematic analysis using NVivo revealed five interconnected themes: Risk Management and Quality Control (requiring structured human oversight and validation processes), Strategic AI Governance and Implementation (necessitating cross-functional governance structures), Human-AI Security Improvement (achieving collaboration where GAI augments human capabilities), Strategic Resource Amplification (addressing resource constraints through intentional adoption), and Third-Party Vendor Implementation and Oversight (leveraging partnerships with sophisticated risk assessment). Results demonstrate that successful GAI cybersecurity implementation depends on human expertise orchestration rather than technological replacement, challenging assumptions that emphasize technical capabilities over organizational factors. The study identifies distinct human roles, interdisciplinary decision-making requirements, and a refined Technology Acceptance Model, revealing risk-dominant evaluation processes. These findings provide actionable guidance for establishing governance committees, developing human-centric training programs, implementing risk assessment frameworks, and enhancing vendor management approaches, positioning human-AI collaboration as an essential strategic capability for secure GAI implementation across high-stakes domains.