Former CIA leader: AI raises the stakes, but cyber defense still depends on people

Artificial intelligence is accelerating cyber conflict, but former CIA technology leader Chris Jones says the most important lesson for defenders may be an old one: technology only matters when people know how to use it.

Jones, now chief technology officer at Nightwing, spent more than two decades at the Central Intelligence Agency, where his work sat at the intersection of technology, operations and national security. In a new episode of the McCrary Institute’s Cyber Focus podcast, Jones said that experience shaped how he sees today’s cyber challenge: even the most advanced tools still depend on human access, judgment and expertise.

He described CIA’s distinctive cyber role as the “human enabled part of technical collection” and said that, even as frontier models change the threat environment, people still have to understand the target, gain access and apply the technology in the right way.

The same principle, Jones argued, applies to defense.

“Human-enabled defense is absolutely mandatory for cyber defense and cybersecurity,” Jones said.

That view comes at a moment when AI is changing the speed and scale of cyber operations. Jones said attackers already have an asymmetric advantage because they only need one successful path into a system, while defenders have to protect complex environments all the time.

“The time cycle between identifying vulnerabilities and then building exploits and then deploying them is going to get tighter and shorter for them and defenders are going to struggle to catch up,” Jones said.

But Jones warned against treating AI as either the whole problem or the whole solution. Many damaging incidents still involve known vulnerabilities, he said, which means organizations cannot neglect basic defensive discipline while chasing the newest technology.

That discipline also depends on people. Jones said the most impressive uses of AI and advanced algorithms are not happening in isolation. They are being used by people with deep technical knowledge, subject-matter expertise and experience in the work itself.

“In order to be really effective, it’s not just the application of advanced technology,” Jones said. “It’s the application of advanced technology by really well-trained and experienced operators of that technology.”

That makes workforce development more than an internal business concern. It is central to national security. AI may help defenders move faster, analyze more data and find weaknesses sooner. But it does not replace the need for people who understand adversaries, ask better questions and know when technology is being applied well.

Jones said that kind of workforce cannot be built by technical training alone. It also requires people who can challenge assumptions about how systems are designed and defended.

“We also need people who are looking at how the systems are engineered today and asking the contrarian questions on why they exist the way they do,” Jones said.

That may be the larger lesson from Jones’s move from CIA technology leader to cyber executive: as the tools become more powerful, the premium on human judgment rises with them. The organizations best positioned for the next phase of cyber conflict will be the ones that invest in advanced technology and in the people capable of questioning it, applying it and defending against its misuse.