"Nothing that was deployed seven or ten years ago is prepared or ready to handle AI at machine speed."

Nikesh Arora didn't mince words on CNBC's Mad Money recently. The Palo Alto Networks CEO told Jim Cramer that roughly a trillion dollars in cybersecurity infrastructure deployed across corporate America is effectively obsolete against the threats it now faces. "Nothing that was deployed seven or 10 years ago is prepared or ready to handle AI at machine speed," Arora said. "You have to rethink your cyber architecture."

That's a big claim from the CEO of one of the largest cybersecurity companies in the world, with an obvious incentive to say it. But the underlying point is hard to argue with, and it applies well beyond the Fortune 500 companies buying Palo Alto's platform. Attackers already use AI to write phishing lures, probe for vulnerabilities, and chain exploits together faster than a human analyst can read an alert, let alone respond to one. A security stack built around a person triaging alerts during business hours, on tools bought when "cloud" was a buzzword, was never designed for that pace.

The harder question is what "rethink your cyber architecture" actually means when you're not the CEO of a cybersecurity vendor with a platform to sell.

What rethinking cyber architecture actually requires

Set the marketing language aside. In practice, rethinking architecture comes down to three key shifts.  

Shift 1 - Detection and response have to run at a speed no human team can sustain unassisted, meaning AI helps monitor and respond, not just attacks.  

Shift 2 - Design must center on identity and access rather than a hardened perimeter, because AI-driven attacks don't wait at the firewall; they look for the exposed credential, the API key, or the auto-approved agent action.  

Shift 3 - Every AI tool the organization has adopted, from chatbots to coding assistants to agentic workflows, is now part of the expanded attack surface. This can’t be treated as a productivity add-on happening outside security's view. That creates vulnerable blind spots.

We covered this recently in Your AI Security Stack Just Created a New Single Point of Failure.

None of the above is optional forever. But how an organization prioritizes how they’ll get there can look very different depending on its size.

Enterprise vs. mid-market: same problem, different math

Enterprises like the ones Arora is selling to have the budget, and often the mandate, to retire a decade-old SIEM and stand up a full AI-native security operations platform as a single initiative, running parallel stacks through a multi-year migration. That's realistic with large engineering teams and a nine-figure budget.

Most organizations in the US are squarely in the mid-market, including many hospitals, utilities, and manufacturers serving the Defense Industrial Base (DIB). They simply don't have the manpower or budget for this type of investment. A regional healthcare system or a water utility with a five-person IT team can't rip and replace its way to an AI-ready architecture, and a vendor pitching that as the only path sets it up to overspend, stall out, and likely, both.

So, where can mid-market security and IT leaders begin? Start with what's already owned: most mid-market organizations sit on unused detection capability inside licenses they already pay for, Microsoft E5 being the most common example we see, rather than needing an entirely new platform, an idea we covered in Stop Paying for Security Twice.  

Buy for the environment actually being run, not the biggest name on the RFP. Hardware or software that isn't hardened for machine-speed monitoring on day one is a cost paid twice, once at purchase and again when it's fixed later. Get eyes on the environment around the clock without hiring a 24/7 team a smaller organization can't staff or retain; a managed SOC or MDR partner solves the "AI moves faster than my team" problem without a hiring plan that never gets funded.  

And where operational technology is part of the environment, extend the rethink there deliberately: attacks don't stop at the plant floor door, and OT security can't simply inherit IT's playbook, a point covered further in The Path to OT Resiliency.

Enterprises are largely rethinking architecture as a technology-replacement problem. Mid-market and public-sector organizations are better served treating it as a prioritization problem: figure out which gap costs the most if it's left alone and start there.

Where to start: a 30-day plan

Whether an organization is rethinking architecture because a CEO said so on CNBC or because it has been on the list for a while, the most common mistake is trying to solve all of it at once. This is a marathon. Treat the first 30 days as getting one real thing done, not solving cybersecurity for the year.

Days 1 through 10: Get an honest assessment. It's hard to decide where to invest without first knowing where the real gaps are, measured against how the environment would hold up against an automated, AI-driven attack rather than a generic checklist.  

This is exactly what our Gap Assessment Checklist is built to help with.

Days 11 through 20: Pick the single highest leverage fix the assessment surfaces, usually identity and access controls or a monitoring blind spot, and scope it as something the team, or a partner, can finish, not just start, in the following ten days.

Days 21 through 30: implement it, document what changed, and set the next 30-day priority. Momentum compounds. A program that ships something real every month outpaces one waiting on the budget to do everything at once.

Arora is right that infrastructure built a decade ago wasn't built for this threat landscape, and that doing nothing is the worst option on the table. But "rethink your cyber architecture" doesn't have to mean a multi-year, multi-million-dollar overhaul for every organization that hears it. For most of the organizations we work with, it means an honest look at where things stand, a clear-eyed choice about what to fix first, and a partner who can help buy the right foundation, run it well, and defend it, without waiting on a budget cycle that never quite gets around to it.

Ready to see where your environment actually stands against AI-speed threats? Get the Gap Assessment Checklist, or let's talk.

Find the content useful? Subscribe to The Catch, our exclusive weekly LinkedIn newsletter focused on real-life experiences doing cyber right in the most highly regulated industries.