AI-powered threat detection: Opportunities and limitations in modern cyber defense

 Corresponding author: Kenechukwu Ikenna Nnaka Copyright © 2025 Author(s) retain the copyright of this article. This article is published under the terms of the Creative Commons Attribution License 4.0. AI-powered threat detection: Opportunities and limitations in modern cyber defense Kenechukwu Ikenna Nnaka 1, *, Paul Oluchukwu Mbamalu 2, John Cherechim Nwaigbo 3, Peter Chika Ozoogueji 4, Victor Ifeanyi Njoku 5 and Chijioke Cyriacus Ekechi 6 1 Department of Chemical Engineering, University of Benin. 2 Department of Project Management Technology, Federal University of Technology Owerri, Nigeria. 3 Department of Mechanical Engineering/University of Nigeria, Nsukka. 4 Department of Mathematics and Statistics (Data Science) CAS, American University, Washington, DC. 5 Cybersecurity Professional, Department of Business Management,Miva Open University. 6 Department of Electrical and Computer Engineering, Tennessee Technological University. World Journal of Advanced Research and Reviews, 2025, 27(02), 210-223 Publication history: Received on 25 June 2025; revised on 30 July 2025; accepted on 02 August 2025 Article DOI: https://doi.org/10.30574/wjarr.2025.27.2.2854 Abstract Artificial intelligence (AI) and machine learning (ML) have become critical components of modern cybersecurity strategies, offering dynamic capabilities for detecting, analyzing, and mitigating cyber threats. This review synthesizes existing literature to explore how AI and ML technologies are being applied in cyber threat detection, focusing on their operational integration, effectiveness, and limitations. The study draws on 43 referenced sources, including peerreviewed journal articles, technical whitepapers, vendor documentation, and authoritative blogs, to provide a comprehensive overview of the field. Findings highlight that AI enhances threat detection through real-time data analysis, reduces false positives, and uses predictive modeling and adaptive learning. These technologies enable more proactive and scalable defense mechanisms compared to traditional rule-based systems. However, challenges persist, including the opacity of black-box models, vulnerability to adversarial attacks, data quality issues, and the lack of standard evaluation frameworks. Regulatory concerns and the need for human oversight further complicate widespread deployment. The review concludes that while AI significantly augments cyber defense capabilities, it is not a standalone solution. For AI to be effectively and ethically integrated into cybersecurity, it must be transparent, explainable, and aligned with organizational and regulatory goals. The study emphasizes the importance of explainable AI, robust datasets, and interdisciplinary collaboration in shaping the next generation of secure and trustworthy AIdriven defense systems. Keywords: AI; Machine Learning; Cybersecurity; Threat Detection; SIEM; SOAR; XDR; Anomaly Detection; Adversarial AI 1. Introduction The advent of artificial intelligence (AI) in cybersecurity is a decisive change when it comes to identifying, examining, and protecting threats [1], [2]. Initially limited to basic rule-based enhancements in intrusion detection systems, AI integration became more relevant in the middle of the 2010s when machine learning (ML) algorithms were applied to intrusion detection to detect anomalies, classify malware, and analyze user behavior [3], [15]. This evolution accelerated between 2017 and 2022 such that security-focused platforms have begun integrating AI-powered functionality into SIEM (e.g., Splunk, IBM QRadar), SOAR (e.g., Cortex XSOAR), and more recently XDR systems which combine endpoint and network telemetry to give a panoramic view of the threat [4], [5]. These platforms use AI in order to match the events, find patterns in streams of massive amounts of data, and even allow automating the incident response [6]. The technological growth has seen adoption in different areas of the industry though the effects are not even as better- World Journal of Advanced Research and Reviews, 2025, 27(02), 210-223 211 established organizations enjoy sophisticated implementations. Simultaneously, a lot of small businesses experience obstacles caused by finances, specialized knowledge, and their complexity in terms of integration [7]. However, AI solutions have become even the focal point of contemporary cybersecurity today, capable of providing their scalable approach to covering the diverse and changing threat environments [8]. Cybersecurity has increased significantly in its level of complexity over the last decade and the threats have not only multiplied but also increased in nature [9]. Advanced persistent threats (APTs), APTs, zero-day exploits, fileless malware, and multi-stage ransomware attacks now routinely bypass conventional perimeter defenses [10], [11]. Conventional rule-based and signature-driven intrusion detection systems (IDS) have trouble tracking these changing methods of attack, and they tend to produce a high false-positive rate and miss new or obfuscated attacks [12]. Further, the volume of log data created in endpoints, networks, and cloud environments has made manual processing of threats too cumbersome [13]. This puts into perspective the intensity of finding smarter, more scalable and adaptive solutions, to support or boost the existence of static security frameworks [14]. 1.1. Problem Statement Despite the growing integration of AI into modern cybersecurity systems, there are still major loopholes in terms of performance, reliability, and transparency of these solutions. Although AI and machine learning have enabled an increase in the speed and scalability of detection of known threats, limitations to these abilities exist and can be attributed to imbalanced datasets, adversarial manipulation, and model interpretability, among other factors. Most AIbased systems are black boxes, giving minimal transparency about how decisions are arrived at, which is a problem because it is complicated in forensics analysis, compliance, and user assurance. Also, the use of AI may demand special skills, as well as high computational power, making a particular application less possible in numerous organizations. These loopholes demonstrate the issue that requires a critical evaluation of the existing artificial intelligence-based methods, their weaknesses in their functioning, and the new dangers that lie in excessive faith in automated detect systems. 1.2. Aim and Scope of the Review The objective of this review is to evaluate how artificial intelligence has been applied to cyber threat detection, particularly through platforms such as SIEM, SOAR, and XDR. It aims to: • Examine the types of AI and machine learning models used for threat detection • Analyze the strengths and limitations of these models in real-world scenarios • Compare leading AI-powered security tools and their practical integration • Identify ongoing technical, operational, and ethical challenges • Offer recommendations for improving the transparency, scalability, and effectiveness of AI-based cybersecurity systems 2. Materials and Methods 2.1. Study Design This paper adopts a structured narrative review methodology to evaluate the application of artificial intelligence (AI) and machine learning (ML) in cyber threat detection. Unlike systematic reviews, which require meta-analytical synthesis and strict protocol registration, a structured narrative review is appropriate for emerging and multidisciplinary fields such as AI in cybersecurity, where heterogeneity in study designs, technologies, and evaluation metrics limits quantitative aggregation. The study design follows a transparent and replicable protocol, emphasizing thematic categorization, tool-based comparisons, and critical analysis of trends. 2.2. Data Sources and Search Strategy Literature was retrieved from a combination of academic databases and authoritative industry sources to ensure a comprehensive review of both theoretical advances and real-world applications. The primary academic databases consulted included IEEE Xplore, ACM Digital Library, Elsevier ScienceDirect, SpringerLink, and Wiley Online Library. In addition, technical whitepapers, vendor documentation, and threat intelligence reports were sourced from major cybersecurity firms such as IBM, Palo Alto Networks, Microsoft, and CrowdStrike, capturing tool-specific developments and applied insights. World Journal of Advanced Research and Reviews, 2025, 27(02), 210-223 212 A structured search strategy was employed using Boolean combinations of keywords related to AI and cybersecurity. Search terms included: “artificial intelligence” or “AI” combined with “cybersecurity” or “threat detection”; “machine learning” or “deep learning” combined with terms such as “intrusion detection system,” “SIEM,” “SOAR,” or “XDR”; “anomaly detection” in conjunction with “cyber defense” or “incident response”; and finally, “adversarial AI” or “explainable AI” with “network security.” These queries were designed to capture literature at the intersection of AI technologies and cyber defense mechanisms. Searches were limited to the period from January 2017 to July 2025 to focus on the most recent and relevant developments. Only English-language publications were considered to ensure consistency in evaluation and interpretation across all sources. 2.3. Inclusion and Exclusion Criteria Sources were selected based on their direct relevance to the application of AI and machine learning in cyber threat detection. Eligible studies included those that examined deployed tools, real-world system architectures, or documented case studies. Priority was given to literature that offered performance analysis of AI models, discussed practical benefits and limitations, or referenced widely adopted industry frameworks such as MITRE ATT&CK or NIST SP 800-53. Only sources that were peer-reviewed or published by technically credible vendors were included to ensure academic and practical reliability. Studies were excluded if they focused exclusively on theoretical aspects of AI without linking to cybersecurity applications, lacked methodological transparency, or were classified as duplicates, opinion pieces, or editorial commentaries. Publications that did not address detection or defense-related use cases were also excluded from the final synthesis. 2.4. Screening and Data Extraction An initial pool of 96 records was identified through structured searches across academic databases and industry sources. After removing duplicates and screening titles and abstracts for relevance, 66 records remained. Full texts of 34 of these were assessed based on inclusion and exclusion criteria. In addition, 9 more sources were included through manual reference checks, expert recommendations, and grey literature tracking, bringing the total to 43 sources for the final qualitative synthesis. These comprised 25 peer-reviewed journal articles, 2 peer-reviewed conference papers, 7 industry whitepapers and technical documentation, 7 authoritative blog posts and vendor-authored web articles, and 2 documents reflecting government or standards-related cybersecurity frameworks. The entire screening and inclusion workflow is summarized in Figure 1, a PRISMA-style flow diagram adapted for this narrative review. Data were manually extracted using a standardized form capturing AI/ML model type (e.g., supervised, unsupervised, deep learning), application domain (e.g., SIEM, SOAR, anomaly detection), key metrics (e.g., mean time to detect, false positive rate), integration notes, and reported advantages or challenges. Thematic categorization was applied to support structured comparison across tools and approaches. World Journal of Advanced Research and Reviews, 2025, 27(02), 210-223 213 Figure 1 PRISMA flow diagram illustrating the literature screening and selection process for this structured narrative review on AI in cybersecurity [44] World Journal of Advanced Research and Reviews, 2025, 27(02), 210-223 214 3. Discussion 3.1. AI Models Used in Threat Detection Artificial intelligence (AI) and machine learning (ML) have transformed the field of cyber threat detection by enabling systems to identify malicious behaviors, adapt to evolving threats, and operate at scale [2], [8]. These capabilities are driven by a range of algorithmic models that can be broadly categorized into supervised, unsupervised, and reinforcement learning approaches [16]. A comparative summary of these AI models, their cybersecurity use cases, and associated trade-offs is presented in Table 1 Supervised learning models are trained on labeled datasets that distinguish between benign and malicious activities. Common algorithms include support vector machines (SVMs), decision trees, and random forests, which are frequently applied in malware classification, spam filtering, and phishing detection [18]. For example, Fatima et al. showed that the optimized ensemble and linear classifiers like SGD, Extra Trees, Random Forest, and MLP had very high accuracy and F1-scores when used on spam email detection on three benchmarked datasets [17]. These models do very well in situations where the threat is known but may perform poorly when a new or obfuscated attack is detected because of the situations where models rely on historical data [18]. In contrast, unsupervised learning algorithms do not require labeled information and are particularly effective in identifying anomalies or deviations from expected behavior that may signal emerging or novel threats [19]. Common techniques used for detecting lateral movements, insider threats, and zero-day attacks include clustering algorithms such as K-means and DBSCAN, as well as autoencoders [1], [20]. Although these models offer greater flexibility, they often suffer from high false positive rates when not properly calibrated [21]. The distinct workflows of supervised and unsupervised learning models for cybersecurity threat detection are illustrated in Figure 2, highlighting differences in data requirements, processing stages, and detection outputs. The figure offers valuable insight into their respective implementation logic and operational distinctions [45] Figure 2 Comparison of supervised and unsupervised learning pipelines for cybersecurity threat detection [45]. (A) Supervised models rely on labeled historical data and involve model training, validation, and testing to classify inputs as attacks or normal. (B) Unsupervised models operate on unlabeled data, identifying patterns or anomalies through interpretation without prior labeling. Both approaches include optimization processes and yield detection results for threat identification World Journal of Advanced Research and Reviews, 2025, 27(02), 210-223 215 Deep learning techniques, particularly convolutional neural networks (CNNs) and recurrent neural networks (RNNs), have been adopted for both supervised and unsupervised tasks due to their ability to learn complex patterns in highdimensional data [22]. Recent studies have also explored graph neural networks (GNNs) for modeling relational data in network topologies and transformer-based architectures for log analysis and sequential prediction [23], [24]. Reinforcement learning (RL) is an emerging paradigm that allows detection systems to learn optimal responses to threats through interaction with the environment [25]. While RL has shown promise in dynamic defense scenarios such as honeypot adaptation and deception-based strategies, its application remains limited due to challenges in environment modeling, reward specification, and computational cost [26]. A critical distinction in AI-powered detection lies between anomaly-based and signature-based models. The former identifies deviations from normal patterns, enabling the discovery of novel threats but often at the expense of increased false positives [28]. The latter, though effective in recognizing known threats, fails to generalize across emerging attack vectors [1]. Contemporary detection frameworks increasingly adopt hybrid models that combine the strengths of both approaches to enhance detection precision and reduce alert fatigue [29]. As shown in Figure 3, the majority of AI/ML applications in cybersecurity are concentrated in intrusion detection and threat intelligence, each accounting for 25% of documented use cases [1]. This distribution reflects the prioritization of real-time attack detection and contextual analysis in modern security strategies. Notable real-world deployments include IBM Watson for Cybersecurity, which leverages natural language processing to correlate threat data [30], and Darktrace’s Enterprise Immune System, which uses unsupervised learning to detect behavioral anomalies in corporate networks [31]. These examples underscore the diversity of AI models currently used in threat detection and highlight ongoing tradeoffs between accuracy, interpretability, and adaptability in dynamic threat landscapes. Table 1 Comparison of AI Models and Their Applications in Cybersecurity Threat AI Model Type Key Algorithms Primary Applications Strengths Limitations Supervised Learning SVM, Decision Trees, Random Forest, MLP Malware classification, spam/phishing detection High accuracy on known threats; fast classification Requires large labeled datasets; poor at novel attack detection Unsupervised Learning K-Means, DBSCAN, Autoencoders Anomaly detection, insider threats, and zero-day attacks Can detect unknown threats; no need for labeled data High false positives; requires tuning of anomaly thresholds Deep Learning CNN, RNN, GNN, Transformer Models Log analysis, behavioral modeling, image-based IDS Learns complex patterns; adaptable to high-dimensional data Computationally intensive; lacks interpretability ("black box") Reinforcement Learning Q-learning, DQN, Policy Gradient Methods Dynamic defense, deception systems, and honeypot control Learns optimal responses; suitable for adaptive defense scenarios Sparse real-world deployment; reward modeling is complex Hybrid Models Combined supervised + unsupervised or DL models Behavioral analysis, threat correlation, alert tuning Improved generalization; balances precision and recall Integration complexity requires constant retraining Note: Adapted from sources including [1], [17]–[18], [20]–[26], [29]. World Journal of Advanced Research and Reviews, 2025, 27(02), 210-223 216 Figure 3 Key functional areas of AI/ML application in cybersecurity[1]. Intrusion detection and threat intelligence represent the largest focus areas (25% each), followed by malware classification (20%), behavioral analysis (15%), and automated response (15%) 3.2. Integrated Security Platforms The integration of artificial intelligence into cybersecurity operations has extended beyond standalone detection models to comprehensive platforms that unify data collection, analysis, and automated response. Some of the latter include Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), and Extended Detection and Response (XDR) systems, which are becoming the central architectural frameworks by which AI-guided threat detection and incident management is being actualized [32]. SIEM platforms, such as Splunk Enterprise Security and IBM QRadar act as a centralized location where logging data can be ingested, aggregated and correlated, all among various sources, including firewalls, intrusion detection systems, endpoint agents and cloud workloads [33]. Historically rule-driven, new SIEMs integrate machine learning and behavioral analytics to detect the odd exceptions, raise red flags’ suspicious mode and rank alerts according to contextual risk score. For example, the Adaptive Response Framework by Splunk uses AI to streamline the process of enriching the threats, as well as auto-initiating dynamic response actions among the integrated tools. These improvements suppress analyst fatigue and false alarms and allow the detection of the stealthy multi-stage attacks that would increasingly elude fixed correlation rules. SOAR platforms including Cortex XSOAR by Palo Alto Networks and Microsoft Sentinel are aimed at automating and orchestrating the incident response processes in a heterogeneous security setting [34]. AI plays a crucial role by enabling context-aware playbook selection, intelligent alert prioritization, and adaptive remediation strategies. For example, Cortex XSOAR includes supervised learning model integration to correlate the alerts with the previous case data, and Microsoft Sentinel employs natural language processing (NLP) to break down threat intelligence feeds and prescribe the necessary actions. This automation helps not only promote faster response times and consistency in incident processing procedure but can also help minimize human error and relieve the pressure on manual input of analysts. Extended Detection and Response (XDR) solutions that are the next evolution in detection and response platforms and will enable the elimination of the operational silos between endpoint, network, cloud and identity telemetry that have traditionally existed. XDR platforms provide a more contextual and correlated threat detection capability by joining visibility across these areas and subjecting high-volume security information to AI-driven analytics in an effort to World Journal of Advanced Research and Reviews, 2025, 27(02), 210-223 217 normalize it and contextualize and interpret boxes of data beyond the capacity of security teams in real-time. Premier vendors, including CrowdStrike Falcon XDR, Palo Alto Networks Cortex XDR and Trend Micro Vision One, use tricks like escort learning, behavior analytics and automation correlation engines to follow advanced attack chains that can slip detection in silos [35]. Such convergence minimizes alert and investigation cycle times collaborative proactive containment of advanced persistent threats (APTs) and lateral movement along the hybrid environment. The integration of modern security platforms to external threat intelligence frameworks and APIs, including MITRE ATT&CK, STIX/TAXII, as well as commercial threat feeds, is one of the major strengths of such platforms. AI models are employed to continuously ingest, analyze, and learn from these external sources, enabling dynamic updates to risk scoring algorithms, alert enrichment, and adaptive tuning of detection thresholds. This continuous learning pipeline allows platforms to shift from static, signature-based defense models toward proactive, intelligence-driven threat detection. As threat landscapes evolve rapidly, such integrations ensure that detection systems remain current, contextaware, and resilient against both known and emerging attack techniques [36] and are supported by comprehensive cross-telemetry correlation engines typical of XDR solutions [5] Overall, the synergy between AI techniques and integrated security platforms has fundamentally reshaped modern cyber defense strategies. These systems now operate not merely as repositories of security telemetry, but as intelligent orchestration engines capable of autonomous decision-making, context-aware alerting, and rapid incident remediation. However, to fully realize their potential, successful deployment demands rigorous calibration, robust data governance, and seamless interoperability across heterogeneous environments. Table 2 Comparison of SIEM, SOAR, and XDR Platforms in AI-Powered Cyber Defense Platform Primary Function AI Integration Strengths Limitations Examples SIEM (Security Information and Event Management) Centralized log aggregation, event correlation, and alerting Machine learning for anomaly detection, adaptive correlation rules, threat scoring Broad visibility across infrastructure; supports compliance and forensic analysis High setup cost; noisy alerts; static rules require frequent tuning Splunk Enterprise Security, IBM QRadar SOAR (Security Orchestration, Automation, and Response) Automated incident response and workflow orchestration Context-aware playbooks, NLP for threat intel parsing, supervised models for alert triage Speeds up response time; standardizes remediation; reduces analyst workload Requires highquality integrations and rule engineering Cortex XSOAR, Microsoft Sentinel XDR (Extended Detection and Response) Unified detection across endpoint, network, cloud, and identity layers Ensemble learning, behavioral analytics, and real-time signal correlation Full-stack visibility; reduced alert fatigue; better detection of APTs Still evolving; vendor lock-in; integration complexity CrowdStrike Falcon XDR, Cortex XDR, Trend Micro Vision One Note: Table compiled by the author using information from [5], [32]–[36]. World Journal of Advanced Research and Reviews, 2025, 27(02), 210-223 218 Figure 4 Integration of SIEM, SOAR, and EDR components in a unified cybersecurity architecture [32]. Logs from endpoint detection and response (EDR) tools are centralized through the SIEM system, which feeds into SOAR for automated incident response 3.3. Advantages of AI in Cyber Defense With the use of artificial intelligence (AI) in cybersecurity activities, the possibilities of improving the identification, prioritization, and mitigation of threats is very promising. AI enhances both the speed and accuracy of cyber defense systems in several different ways by supplementing the effectiveness of more conventional detection mechanisms with learning-based systems and contextual scrutiny. The potential of AI, in terms of the actual-time analysis of huge amounts of log information that are created in endpoints, servers, cloud-based systems, and network gadgets, is one of the most critical advantages of AI. This is in contrast to rule-based systems, which may be based on known threat signatures and thus unable to identify anomalies or possible breaches with a minimal delay, since the AI models, especially when driven by streaming analytics and pattern recognition, can process the data generated by the events dynamically [37]. This is particularly useful to contemporary organizations that face a multi-vectoring attack and time oriented exploits. Another significant advantage is the lessened number of false positives, which is one of the difficulties of standard intrusion detection systems. By training on the typical behavior of their users, applications and systems, AI-based platforms can stop malicious deviations by using the baseline behavior as a filter. The effectiveness of such a behaviorbased method is that it drastically reduces the number of irrelevant alerts that the security analysts are shown which enhances operational capabilities and allows them to triage incidents much faster [8]. AI also enables the use of predictive analytics, allowing cybersecurity systems to proactively identify potential threats, and intervene against it before it happens. With the help of correlation between past threat patterns and the present level of activity in the system, predictive models are further able to point to indications of compromise (IoCs) as well as suspicious behavioural chains, even when no full attack signature is available. Such a proactive approach contributes to early containment and hinders the increase of damage [38]. In addition, AI has the potential to be adaptively learned entailing that its systems constantly improve with respect to new and unfolding patterns of threat. With attackers changing tactics in order to avoid detection, AI algorithms have the ability to retrain on newly updated datasets or integrate new threat intelligence providing them an opportunity to optimize their detection logic. Such flexibility minimizes the chances of model obsolescence and improves ability to withstand dynamism [37]. The advantages are also supported by the performance indicators that compare the AI-based detection system with the classical approaches to cybersecurity. In terms of the operational metrics, as illustrated in Figure 5, AI-based strategies