In Cybersecurity, "AI-Powered" Has Stopped Being an Argument by Itself

Every security vendor now describes its technology as AI-powered. When a claim becomes universal, it stops carrying information. Buyers have worked this out, and so have regulators.

In September 2024 the US Federal Trade Commission (FTC) launched Operation AI Comply, a law enforcement sweep announcing five actions against operations using AI hype or selling AI technology in deceptive ways. The most instructive case for our industry came two months later. The FTC took action against Evolv Technologies over allegations that the company made false claims about the extent to which its AI-powered security screening system could detect weapons and ignore harmless personal items, including in schools. The complaint alleged that Evolv deceptively advertised that its scanners would detect all weapons, and made misleading claims that its use of artificial intelligence made the systems more accurate, efficient and cost-effective than traditional metal detectors. Evolv settled and admitted no wrongdoing.

This case says something simple. "AI-powered" functions as a claim about performance, and a claim about performance has to be substantiated the same way any other advertising claim does.

Europe took the other route. Rather than policing claims after the fact, the AI Act builds documentation and transparency obligations into the product itself, with the main requirements now phased in between December 2027 and August 2028 following the 2026 Digital Omnibus. Most security tools fall outside that high-risk category, but the expectation it sets is spreading through European procurement anyway... Different mechanism but same direction of travel. On both continents, the burden of proof is moving onto the vendor.

That changes what a serious technical conversation looks like. What separates vendors is no longer whether AI is involved, but how the technology is built and what it can account for:

• Where does the technology come from? Are the AI models proprietary and developed in house, or is the detection layer licensed from a third party and rebadged?
• What was the technology trained on, and how old is that data?
• Can the technology explain itself? When it raises a verdict in a cybersecurity landscape, can an analyst see what drove it, or is the reasoning a black box?
• What does it return? A raw score, a classification, or something an analyst can act on?
• How is accuracy measured, on which corpus?

The first question matters more than it looks. A vendor that does not own its detection technology cannot fix what it cannot see, and inherits every limitation of the engine underneath.

Three lessons from being on the answering side of those questions.

Publish the limits before anyone asks. Every model has conditions under which it performs worse (data it has never seen, cases too rare to have been learned, inputs outside its design range). Naming them is uncomfortable but decisive in front of a technical buyer. A vendor who volunteers limits is believed on the rest.

Make the model account for itself, or say plainly that it cannot. Explainability is an engineering decision taken years before the sales call. If an output cannot be traced back to what produced it, that is a legitimate design choice, and it needs to be stated rather than obscured.

Be precise about what the AI actually does inside the product. Most systems combine rules, statistical methods, third-party data and models. Attributing the whole result to artificial intelligence is where overclaiming usually begins, and it is the easiest claim for a buyer to dismantle during a trial.

If you sell a product that uses AI, retire the adjective and describe the function. If you buy one, run it on your own data before believing any number.

Bio Jordan THEODORE:

A tech leader and defensive security specialist, I operate at the heart of critical infrastructure protection. My expertise centers on malware reverse engineering, digital forensics, and AI. Driven by a passion for knowledge-sharing and mentorship, I translate this hands-on, field-tested expertise into various podcasts and publications.

Sources:

FTC, "FTC Announces Crackdown on Deceptive AI Claims and Schemes", 25 September 2024: https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announcescrackdown-deceptive-ai-claims-schemes

FTC, "FTC Takes Action Against Evolv Technologies for Deceiving Users About its AI-Powered Security Screening Systems", 26 November 2024: https://www.ftc.gov/newsevents/news/press-releases/2024/11/ftc-takes-action-against-evolv-technologiesdeceiving-users-about-its-ai-powered-security-screening

The opinions reflected in this article are the author's own and do not reflect those of the FACC.