AI at Scale for Global Defense

Gene Sun views AI as a practical, necessary, and evolving capability that underpins defensive strategy in one of the world’s largest, most complex technology environments. 

As Vice President and Chief Information Security Officer at FedEx, a Fortune 50 company that moves millions of packages daily across the globe, Sun brings a unique operational view: AI is not just a tool for analysts, but a force multiplier essential to scaling security at the velocity of modern threats.

Sun outlined how FedEx approaches AI in cybersecurity, why the company views human behavior as the core attack vector, and how defenders must embrace both technology and organizational change to stay ahead.

Security at Global Scale

FedEx’s business spans millions of packages, hundreds of countries, and thousands of interconnected systems. Sun noted that the company’s scale is one of its defining operational challenges, not just logistically, but in terms of security visibility: “We have an organization that’s very large… many people… many systems… many processes… and it’s very difficult to have visibility.”

The bigger the enterprise, the more complex and distributed the attack surface becomes, and the more imperative it is to use technology that can synthesize and correlate signals across vectors that humans simply cannot process manually.

Sun described this scale not as an abstract management burden, but as a real defensive hurdle: traditional tools and manual analysis hit ceilings long before the volume of data does. Artificial intelligence becomes the only way to make sense of mountains of telemetry, alerts, and behavioral signals in real time.

AI as a Multiplier

Sun was adamant that AI isn’t a panacea, but it is a force multiplier that allows defenders to operate at the pace of data: “AI helps you scale to manage a much larger data set… allows you to use less people, or, more realistically, allows your people to focus on more complicated tasks.”

In his view, AI takes over repetitive, high-volume tasks, such as scanning logs, correlating alerts, and filtering noise, while humans focus on judgment, escalation, and strategic response.

This distinction (machines for scale, humans for insight) is a recurring theme in Sun’s thinking. AI helps detect patterns and anomalies across petabytes of data, but the interpretation, contextualization, and strategic prioritization remain human responsibilities.

Strategic Tool, Not a Buzzword

Sun’s perspective on AI is deeply practical. For him, deploying AI effectively means applying it where it solves actual business problems, rather than chasing every vendor’s shiny new feature. He emphasized the importance of clarity around use cases: “A lot of people talk about AI… but I want to know what problem you’re solving specifically… You need to know that before you deploy any kind of AI model.”

This grounded mindset shifts AI evaluation from “will this do cool things?” to “will this materially reduce risk or operational burden?” Accordingly, FedEx’s security team doesn’t chase AI for its own sake. It prioritizes assessment of risk, operational impact, and measurable outcomes as part of every decision.

The Core Attack Surface

A central part of Sun’s philosophy is that human behavior, not technology, is the primary attack vector. He argued that attackers will always look for the path of least resistance, often through people rather than systems: “The cyber adversary wants to do it the easiest way possible. It’s not really about the tool… it’s about human vulnerability.”

Because humans are the ultimate target of many attacks, from social engineering to credential theft, defensive strategies must align technology with awareness, training, and behavior analytics.

AI plays a role here as well. Sun sees generative and behavioral analysis tools as ways to detect anomalies in human patterns, not just malicious code or known signatures. This is a paradigm shift toward risk-behavior intelligence that can spot suspicious activity before brute force indicators appear.

Detect, Correlate, Prioritize

Sun described how AI helps FedEx augment three specific aspects of defense:

1. Detection at Volume: With millions of events per day, AI helps filter signals from noise, enabling teams to catch real threats earlier.
2. Correlation Across Silos: AI can link related alerts from disparate systems, turning isolated data points into meaningful insights.
3. Prioritization of Response: Rather than forcing analysts to triage every alert, AI can score and rank incidents, allowing teams to focus on what matters most.

In each case, the pattern is the same: AI amplifies human effectiveness rather than replacing it.

Security and Business Alignment

A recurring theme throughout Sun’s remarks was the need for security teams to be deeply aligned with the business they protect. He described how FedEx’s security leaders work with internal stakeholders: “You need to have that connection, the ability to speak the language of the business… to articulate risk, outcomes, and investment decisions.”

This alignment ensures that decisions about AI, tooling, and risk tolerance are not made in a vacuum but are linked to enterprise priorities, customer experience, and governance frameworks.

Furthermore, Sun emphasized that senior leaders must participate in risk conversations, rather than delegating them entirely to technology teams. AI, in this context, becomes a decision support engine, enabling clearer communication about trade-offs and strategic investments.

Vendor Evaluation and Proof of Value

Sun also stressed the importance of rigorous evaluation of AI technologies from third parties. In a landscape flooded with products claiming AI capabilities, he isn’t impressed with surface-level branding: “You need to know what the AI is actually doing… whether it’s contextual, whether it has meaning… versus it being used as an ad headline.”

In other words, defenders must look under the hood, asking what data the model uses, how it’s trained, and whether it handles FedEx’s specific context and risk profile. A successful AI deployment, in his view, delivers measurable improvement in detection, workflow efficiency, or risk reduction, not just impressive demos.

The Future of Cyber Defense

Looking ahead, Sun views AI not as a static deployment but as a continuously evolving capability. Threats will accelerate, data volumes will expand, and models will improve, but defenders who build robust, measurable, and business-aligned AI capabilities today will create enduring advantage: “AI will continue to change very rapidly… if you’re not thinking about what that means for risk and defense, you’ll be caught behind.”

His perspective reflects a broader truth in enterprise cybersecurity: adversary innovation won’t slow down, so defenders must accelerate faster.

Lessons Learned

Across the discussion, Gene Sun offered several key lessons for security leaders embracing AI in global enterprises:

• AI is not a magic bullet, but a multiplier. It scales human capability and frees analysts to focus on higher-value tasks.
• Human behavior remains the core risk vector. Defense must focus on behavioral signals as much as technical ones.
• Business alignment is essential. Security decisions must be linked to enterprise priorities and communicated in business terms.
• Rigorous evaluation matters. Don’t adopt AI based on hype, demand proof of value and measurable outcomes.
• Continuous evolution is non-negotiable. AI models and threat techniques will evolve,  defenders must adapt faster than attackers.

Conclusion

Sun’s view of AI is neither naïve nor alarmist. It’s practical, rooted in experience, and focused on outcomes: defenders must use AI to see farther, respond faster, and communicate risk more clearly. In a global enterprise like FedEx, where scale, velocity, and complexity are everyday realities, AI isn’t just a tool in the toolbox. It’s an operational and strategic imperative.

As Sun puts it, success in the next decade will go not to the defender who adopts AI first, but to the one who links it meaningfully to risk reduction, business context, and measurable improvement. And that is a challenge no enterprise can afford to ignore.