The impact of AI and ML on cybersecurity
Visit BSI's Experts Corner: Home for insights from BSI’s practice directors and industry experts on digital trust, environmental, health, safety, security, and sustainability.
July 13, 2023 - Artificial intelligence (AI) and machine learning (ML) go hand-in-hand, with ML being a fundamental tool used for developing AI systems to make them smarter, adaptive, and capable of managing complex tasks. The technologies are having a significant impact on cybersecurity, allowing faster detection of threats, automated incident responses, and better protection against malicious attacks.
AI is currently generating over £3B to the UK economy, and globally the AI in cybersecurity market is predicted to grow at a compound annual growth rate (CAGR) of 21.63%, reaching a value of more than $79B by 2029. There are great opportunities for organizations to bolster their security measures using AI and ML, particularly in the areas of:
Defensive security
Unlike traditional systems, AI can detect and analyze vast amounts of data in real-time and identify abnormalities that could signify a cyber threat. AI-based security systems use ML algorithms to identify malicious activity such as phishing attempts or unrecognized malware, notifying security teams and systems, which can then respond quickly to mitigate the threat. A cyber threat response could involve shutting down entire systems, giving security teams time to rectify the issue without fear of data theft or network damage.
Vulnerability prediction
Vulnerability prediction systems use AI and ML to detect potential breaches and prioritize them based on risk severity. Unlike real-time tracking of sources and intelligence in defensive security, vulnerability prediction involves understanding the weaknesses before they occur.
A platform such as HackerOne, alerts security researchers about specific vulnerabilities in specific systems. Through ongoing data collection and analysis of submitted reports, the platform can identify resemblances of assets that are present in different bug bounty programs and can exhibit the same vulnerabilities. By identifying these assets, researchers can easily prove the existence of vulnerabilities across different programs, allowing businesses to proactively prepare for potential attacks and fortify systems accordingly. These systems have proven effective in uncovering vulnerabilities that potentially could have stayed unnoticed for a long time and show an interesting use case of how to apply AI from an offensive perspective.
Incident response
By leveraging AI and ML, incident response teams can enhance their capabilities to detect, respond, and recover from security incidents more efficiently. These tools automate incident triage processes, where incident data is categorized, and prioritized based on potential impact and urgency. This allows security teams to focus on critical incidents and allocate resources effectively. Certain incident response actions such as isolating affected systems or blocking malicious traffic can be automated, lessening the potential for human error and accelerating response times on other incidents.
It's important to note that as security teams innovate, so do cyber criminals. To stay one step ahead, continuous updates and AI model refinement will pave the way for a smarter, safer cybersecurity sector.
For more on this topic, download Alessandro’s SASIG webinar recording. For more insights on other EHS and Digital Trust topics, visit BSI’s Experts Corner.
