Cybersecurity and AI: Algorithmic Attacks and Defenses

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Artificial intelligence has transformed the cybersecurity landscape, creating both unprecedented threats and sophisticated defense mechanisms that call for specific, up-to-date legal regulation.

The New Cybersecurity Paradigm Driven by Artificial Intelligence

We are living through a profound transformation in digital security. Building artificial intelligence algorithms into cyberattack and cyberdefense systems has fundamentally changed the dynamic between attackers and defenders. Looking at the current landscape, threats are no longer static and predictable. They have become adaptive and polymorphic, and they can learn from every failed attempt. This evolution is not merely technical: it raises complex regulatory challenges that the Brazilian legal system is only beginning to confront.

The race between algorithmic attacks and algorithmic defenses requires the law to abandon its reactive stance and develop flexible regulatory frameworks, ones that can keep pace with technological innovation without stifling the development of legitimate cybersecurity solutions.

Algorithmic attacks use machine learning techniques to identify vulnerabilities in systems, automate phishing campaigns with personalization at scale, and even generate convincing deepfakes for social engineering. On the defensive side, AI-based systems monitor networks in real time, detect behavioral anomalies, and respond to incidents at a speed no human team could match. This digital arms race creates an ecosystem in which technological sophistication grows exponentially, and regulation has to keep up to protect citizens, businesses, and public institutions.

In Brazil, the Lei Geral de Proteção de Dados (LGPD, Brazil’s General Data Protection Law) laid important foundations for protecting personal data, but it does not specifically address the challenges of using AI in cyberattacks. The Marco Civil da Internet (Brazil’s Internet Civil Rights Framework), for its part, sets out general principles for governing the internet without getting into the particulars of algorithmic systems. The result is a significant regulatory gap, one that must be closed to give both victims and developers of defensive solutions legal certainty.

This topic is directly related to cybersecurity at the INSS (Brazil’s National Social Security Institute), which we cover in a separate article.

Algorithmic Attacks: Types and Legal Implications

Adaptive Phishing and Automated Social Engineering

Natural language processing algorithms make it possible to create highly personalized phishing messages. They analyze the victim’s social media profile, adapt the tone of the communication, and simulate legitimate interactions with alarming precision. Unlike traditional attacks (easily spotted by grammatical errors and sloppy formatting), these automated campaigns produce messages that are practically indistinguishable from authentic ones. From a legal standpoint, criminal liability for these attacks finds support in Articles 154-A and 171 of the Penal Code, but identifying those responsible becomes exponentially harder when autonomous algorithms run the operations.

Adversarial Attacks Against AI Systems

One particularly sophisticated category involves so-called adversarial attacks, in which algorithms are designed to fool other artificial intelligence systems. Small perturbations in input data (imperceptible to humans) can cause facial recognition systems to fail, security filters to be bypassed, or malware classifiers to overlook real threats. Considering how many financial institutions, government agencies, and health care systems rely on AI for security, the seriousness of these vulnerabilities becomes clear. Civil liability for failures in defensive AI systems attacked this way remains an open legal question in Brazil.

Deepfakes and the Manipulation of Digital Evidence

The ability to generate highly realistic synthetic video, audio, and images threatens not only cybersecurity but the integrity of the justice system itself. Deepfakes can be used to forge evidence, damage individuals’ reputations, and manipulate decision-making processes within organizations. The chain of custody for digital evidence, already challenging in traditional contexts, becomes even more complicated when algorithms can produce forgeries that withstand superficial analysis. The Brazilian judiciary has sought to adapt to this reality, but the pace of technological change consistently outstrips the capacity of the rules to keep up.

Algorithmic Defenses and the Brazilian Regulatory Framework

If artificial intelligence amplifies threats, it also offers the most promising tools for protecting systems, networks, and data. Here we look at how AI-based defenses work and at the regulatory limits and possibilities for deploying them in Brazil.

Real-Time Threat Detection

Machine learning-based intrusion detection systems simultaneously analyze network traffic patterns, user behavior, and system integrity, identifying anomalies that signal attacks in progress. These tools process volumes of data that human teams could never monitor, dramatically reducing the time it takes to detect and respond to incidents. However, operating these systems involves processing data on a massive scale (potentially including personal data), which triggers regulatory obligations under the LGPD. The legal basis for this processing generally falls under the controller’s legitimate interest, pursuant to Article 7, item IX, but the precise boundaries of that interest in cybersecurity contexts still lack specific guidance from the Autoridade Nacional de Proteção de Dados (ANPD, Brazil’s National Data Protection Authority).

Automated Incident Response

Beyond detection, AI systems can carry out automated responses to threats: isolating compromised machines, blocking suspicious IP addresses, revoking credentials, and starting containment procedures without human intervention. This automation is essential for dealing with the speed of modern attacks, but it raises significant legal questions. When an autonomous system blocks a legitimate user’s access because of a false positive, who is responsible? The Código de Defesa do Consumidor (Consumer Protection Code), the LGPD, and the Civil Code itself offer interpretive paths, but none of them was designed to address liability for automated decisions in cybersecurity contexts.

Predictive Threat Intelligence

Predictive algorithms analyze global threat trends, newly discovered vulnerabilities, and emerging attack patterns to anticipate risks before they materialize. This predictive capability is valuable, but it can also conflict with fundamental legal principles. If an AI system flags an employee as a potential insider threat based on behavioral analysis, what limits apply to the organization’s preventive action? The balance between security and fundamental rights (privacy, presumption of innocence, dignity) is the central challenge in regulating algorithmic defenses.

The Artificial Intelligence Bill and Its Impact on Cybersecurity

Brazil has been debating the regulation of artificial intelligence intensely, with legislative proposals that seek to establish principles, rights, and obligations for the development and use of AI systems. Viewed through a cybersecurity lens, these proposals raise several points that deserve attention.

Classifying AI systems by risk level, inspired by the European AI Act, has direct implications for cybersecurity tools. Algorithmic defense systems used in critical infrastructure (energy, telecommunications, the financial system, health care) tend to be classified as high-risk, which subjects them to stricter requirements for transparency, auditability, and governance. On the other hand, offensive tools used in legitimate penetration testing (a practice essential to security) need regulatory treatment that does not criminalize authorized vulnerability assessments.

The algorithmic explainability requirement found in the legislative proposals creates particular tension in cybersecurity. Revealing in detail how a defense system works can give attackers valuable information. At the same time, total opacity makes auditing and accountability impossible. We believe the balance lies in selective transparency mechanisms, in which independent audits evaluate the systems without sensitive technical details being made public.

Another relevant aspect is international cooperation. Cyberattacks often cross jurisdictional borders, and the effectiveness of algorithmic defenses depends on organizations and countries sharing threat information. Brazilian regulation needs to align with international standards to allow that cooperation without compromising digital sovereignty or the protection of Brazilian citizens’ data.

Civil and Criminal Liability in AI-Related Incidents

Assigning responsibility in cyber incidents mediated by artificial intelligence poses challenges that test the limits of traditional legal categories. When an autonomous algorithm carries out an attack, the causal chain between the initial human act (developing or activating the system) and the resulting harm can be long and complex.

On the civil liability side, the theory of activity-based risk, enshrined in the sole paragraph of Article 927 of the Civil Code, offers a path to strict liability for those who develop or operate AI systems used in attacks. For algorithmic defenses, liability for failures may fall on the solution’s provider (when the product is defective), on the operator (when it is implemented improperly), or on both, depending on the circumstances of the case.

On the criminal side, the Cybercrime Law (Law No. 12.737/2012) and its later amendments define offenses such as unauthorized access to computer devices and disruption of services, but using AI as a tool for these acts makes investigation and prosecution even harder. Digital forensics must evolve to handle attacks that erase their own tracks, alter logs, and use decentralized networks to make tracing difficult.

It is also worth noting that organizations that suffer cyberattacks have regulatory notification obligations. The LGPD requires that security incidents that may cause relevant risk or harm to data subjects be reported to the ANPD and to the affected individuals. Failing to do so can result in significant administrative sanctions, no matter how sophisticated the attack was.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.