Every major cybersecurity vendor now claims their product is “AI-powered.” The term has become so overused that it has lost almost all meaning. When everything from a firewall to a password manager is described as artificial intelligence, the word stops being informative and starts being noise. But behind the marketing, there is a real question worth answering: where does AI actually work in cybersecurity, and where is it still failing? Having worked in cybersecurity across regulated industries — aviation, port operations, healthcare, and manufacturing — I have seen both sides of this problem. I have seen AI-labelled tools that were nothing more than regex under a dashboard. I have also seen machine learning solve problems that no human team could handle at scale. And in my own work, I work with a credential exposure dataset of over 8.2 billion records — large enough that the question of what AI can and cannot do stopped being theoretical a long time ago. The difference comes down to one idea: AI is useful in cybersecurity when the problem is scale. It is dangerous when the problem is judgement. Everything below follows that line. Where AI Actually Works These are scale problems — problems where the volume of data exceeds what any human team can process manually, and where pattern recognition provides genuine, measurable value. 1. Dark Web Content Classification The dark web produces an enormous volume of unstructured content across multiple languages, formats, and platforms — forums, paste sites, Telegram channels, marketplaces, and onion services. Manually triaging this content is not scalable. NLP works well here because many threat actor communities use recurring language patterns, listing formats, and commercial vocabulary. Ransomware groups announce victims using consistent phrasing. Credential sellers describe their data in formulaic ways. Multilingual NLP models can classify posts by threat