AI As A Standalone Cybersecurity Solution 

AI is a hot topic. Set to revolutionise the way we live, work and interact with technology, it is shaping our future extensively. In almost every industry sector AI is altering processes, driving innovation, and transforming business models, ushering in a new era of efficiency and opportunity. And the world of cybersecurity is no exception. 

Presenting somewhat of a double-edged sword, AI is tipped to make cybersecurity more challenging by empowering threat actors to be more sophisticated, effective and believable on the one hand, whilst also offering improvements in defence mechanisms, leading to huge accelerations in the capability of threat detection.

There’s a lot of noise about how we can leverage AI in security and, whilst I agree its use will be beneficial, what concerns me is the inference that AI, like some of the security products and services hailed before it, could become a standalone solution which will somehow negate the requirement for an effective Security Operations Center (SOC). 

In my opinion, this is what the threat actors want. For us to absolve ourselves of responsibility, accountability and judgement and put our trust in a tech solution. 

The reality is that the same reasons that make AI a compelling threat are the very reasons that should make us pause and proceed with a good deal of caution and scepticism when considering AI as a security solution.  
AI models are fed by data and their reliability is dependent on the quality of the data they ingest.  If the data is contaminated or unreliable, the results can be biased and can even create a new attack surface for threat actors to exploit. AI models also make decisions in ways that humans can't easily understand and are readily open to manipulation.

A potential attacker for example, could trick the machine learning model into misclassifying threats to enable them to make breaches undetected thus posing a significant risk to cybersecurity.  

Whilst not a cybersecurity issue, Amazon’s attempt to lead the world in AI driven recruitment is a great example of this. Trained to find applicants by following patterns in resumes/CVs that had been received over the preceding decade, the high numbers of men in tech meant that the AI ‘learned’ that males were a preference for the company and started to penalise any reference to women or female. Amazon thought it was giving the AI the responsibility, but it didn’t, it gave it the authority to act on its behalf. The result almost managed to set the company’s diversity objectives back decades and was a huge problem to fix.

AI’s inability to contextualise is another reason why it shouldn’t be relied upon as a sole cybersecurity solution. It doesn’t have human-like situational awareness, judgment, or prioritisation abilities. It doesn’t understand the nuances of the wider environment it’s being used in, the industry or market context. Human intuition is essential in cybersecurity, enabling threat levels to be assessed in context, prioritised based on risk, and adjusted accordingly. Without it, AI may misinterpret situations, leading to ineffective responses and increased vulnerability to evolving threats.

Behind every cyber attack is a human ready to adapt; to change their method and evolve their approach. Relying solely on AI tools and removing the human element risks facing adversaries that outpace the machine's capabilities.

That human expertise is also the reason why a SOC centre is essential. Yes, an AI security model may well be able to process massive amounts of data and flag threats with amazing speed. But then what? Most IT teams are already drowning in alarms and alerts, they need guidance and support from other human experts, not another data source without direction.

Just as threat actors try to rush, distract and manipulate their victims, we shouldn’t be distracted from our security goals by the shiny thing that is AI. The risk hasn’t changed. The threat is just faster, stronger and harder and a standalone AI cybersecurity solution won’t suffice in beating it.

Image: Ideogram

Chris Stouff is Chief Security Officer at Armor

You Might Also Read:

AI-Driven Cyber Security Is Booming:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« A Deep Dive Into Deepfakes & The Threat To Digital Identity Verification
2024 & Beyond: Top Six Cloud Security Trends: »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

Qualitèsoft Technology

Qualitèsoft Technology

Qualitèsoft Technology is a leading Software Development and Quality Assurance organization. We specialize in Custom Development, Mobile Application, Software Testing and Quality Assurance.

Kenexis

Kenexis

Kenexis is a consulting engineering firm providing services for process hazards analysis, fire and gas mapping, and industrial cybersecurity.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Maven Technologies

Maven Technologies

Maven Technologies specialize in secure data destruction, electronics recycling, asset management, and highly detailed reporting.

World Congress on Industrial Control Systems Security (WCICSS)

World Congress on Industrial Control Systems Security (WCICSS)

The World Congress on Industrial Control Systems Security (WCICSS) is focused on emerging trends in protection of industrial control systems.

Paladin Capital Group

Paladin Capital Group

Paladin is a leading global investor that supports and grows the world’s most innovative cyber companies.

C11 Cyber Security & Digital Innovation Centre

C11 Cyber Security & Digital Innovation Centre

C11 is working with local and national partners to develop talent and bring brilliant minds and brilliant businesses together.

Gytpol

Gytpol

Gytpol is a leader in Endpoint Configuration Security (ECS) solutions, providing validation, remediation & securing of IT Policies and IT Infrastructure on-premise and in the cloud.

GreyNoise Intelligence

GreyNoise Intelligence

GreyNoise Intelligence is a cyber security company that collects, labels, and analyzes Internet-wide scan and attack data.

FCI

FCI

FCI is a NIST-Based Managed Security Service Provider (MSSP) offering Cybersecurity Compliance Enablement Technologies & Services to Financial Services organizations.

Apollo Information Systems

Apollo Information Systems

Apollo is a value-added reseller that provides our clients with the complete set of cybersecurity and networking services and solutions.

Ostrich Cyber-Risk

Ostrich Cyber-Risk

Ostrich Cyber-Risk is a risk management company that helps organizations reduce the complexity of identifying financial and operational risks related to your cybersecurity posture.

CampusGuard

CampusGuard

CampusGuard focuses on the cybersecurity and compliance needs of campus-based organizations including higher education, healthcare, and state and local government.

Commission Nationale de l'Informatique et des Libertés (CNIL)

Commission Nationale de l'Informatique et des Libertés (CNIL)

The mission of CNIL is to protect personal data, support innovation, and preserve individual liberties.

Silk Security

Silk Security

Silk is the first platform that enables enterprises to take a strategic, sustainable approach to resolving code, infrastructure and application risk.

iomart Group

iomart Group

iomart is a cloud computing and IT managed services business providing secure hybrid cloud, network connectivity, data management, and digital workplace capability.