AI As A Standalone Cybersecurity Solution 

AI is a hot topic. Set to revolutionise the way we live, work and interact with technology, it is shaping our future extensively. In almost every industry sector AI is altering processes, driving innovation, and transforming business models, ushering in a new era of efficiency and opportunity. And the world of cybersecurity is no exception. 

Presenting somewhat of a double-edged sword, AI is tipped to make cybersecurity more challenging by empowering threat actors to be more sophisticated, effective and believable on the one hand, whilst also offering improvements in defence mechanisms, leading to huge accelerations in the capability of threat detection.

There’s a lot of noise about how we can leverage AI in security and, whilst I agree its use will be beneficial, what concerns me is the inference that AI, like some of the security products and services hailed before it, could become a standalone solution which will somehow negate the requirement for an effective Security Operations Center (SOC). 

In my opinion, this is what the threat actors want. For us to absolve ourselves of responsibility, accountability and judgement and put our trust in a tech solution. 

The reality is that the same reasons that make AI a compelling threat are the very reasons that should make us pause and proceed with a good deal of caution and scepticism when considering AI as a security solution.  
AI models are fed by data and their reliability is dependent on the quality of the data they ingest.  If the data is contaminated or unreliable, the results can be biased and can even create a new attack surface for threat actors to exploit. AI models also make decisions in ways that humans can't easily understand and are readily open to manipulation.

A potential attacker for example, could trick the machine learning model into misclassifying threats to enable them to make breaches undetected thus posing a significant risk to cybersecurity.  

Whilst not a cybersecurity issue, Amazon’s attempt to lead the world in AI driven recruitment is a great example of this. Trained to find applicants by following patterns in resumes/CVs that had been received over the preceding decade, the high numbers of men in tech meant that the AI ‘learned’ that males were a preference for the company and started to penalise any reference to women or female. Amazon thought it was giving the AI the responsibility, but it didn’t, it gave it the authority to act on its behalf. The result almost managed to set the company’s diversity objectives back decades and was a huge problem to fix.

AI’s inability to contextualise is another reason why it shouldn’t be relied upon as a sole cybersecurity solution. It doesn’t have human-like situational awareness, judgment, or prioritisation abilities. It doesn’t understand the nuances of the wider environment it’s being used in, the industry or market context. Human intuition is essential in cybersecurity, enabling threat levels to be assessed in context, prioritised based on risk, and adjusted accordingly. Without it, AI may misinterpret situations, leading to ineffective responses and increased vulnerability to evolving threats.

Behind every cyber attack is a human ready to adapt; to change their method and evolve their approach. Relying solely on AI tools and removing the human element risks facing adversaries that outpace the machine's capabilities.

That human expertise is also the reason why a SOC centre is essential. Yes, an AI security model may well be able to process massive amounts of data and flag threats with amazing speed. But then what? Most IT teams are already drowning in alarms and alerts, they need guidance and support from other human experts, not another data source without direction.

Just as threat actors try to rush, distract and manipulate their victims, we shouldn’t be distracted from our security goals by the shiny thing that is AI. The risk hasn’t changed. The threat is just faster, stronger and harder and a standalone AI cybersecurity solution won’t suffice in beating it.

Image: Ideogram

Chris Stouff is Chief Security Officer at Armor

You Might Also Read:

AI-Driven Cyber Security Is Booming:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« A Deep Dive Into Deepfakes & The Threat To Digital Identity Verification
2024 & Beyond: Top Six Cloud Security Trends: »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

British Assessment Bureau

British Assessment Bureau

The British Assessment Bureau is an ISO certification body. We check conformity and compliance of companies to recognised ISO standards including ISO 27001.

Norwegian Information Security laboratory (NISlab)

Norwegian Information Security laboratory (NISlab)

NISlab conducts international competitive research in information and cyber security and operates study programs in this area.

MBL Technologies

MBL Technologies

MBL Technologies specializes in information assurance, enterprise security, privacy, and program/project management.

J2 Software

J2 Software

J2 Software is a leading African Information Security and ICT business providing information security, governance, risk and compliance solutions.

Hexnode MDM

Hexnode MDM

Hexnode MDM is an award winning Enterprise Mobility Management vendor which helps businesses to secure and manage BYOD, COPE, apps and content.

Recruit.net

Recruit.net

Recruit.net allows job seekers to instantly find millions of jobs from thousands of web sites with a single search.

VIBE Cybersecurity International

VIBE Cybersecurity International

VIBE’s certificate-less authenticated encryption enables scalable, flexible key exchange, and other advanced cryptographic functions using identity-based elliptic curve cryptosystems (ECC).

ThriveDX

ThriveDX

ThriveDX, the world’s premier EdTech provider (formerly HackerU), champions digital transformation training as a means of empowering individuals to thrive in the age of digital disruption.

GoVanguard

GoVanguard

GoVanguard is an boutique information security team delivering robust, business-focused information security solutions.

Strike Security

Strike Security

Strike Security offers a continuous penetration testing platform that combines automation with ethical hackers.

RapidSpike

RapidSpike

RapidSpike is the only website monitoring solution that focuses all three key aspects of website health: performance, reliability AND security.

SecureWeb3

SecureWeb3

SecureWeb3 helps businesses and brands to secure their Web3 presence by offering a full suite of security services including training, consultancy & brand protection solutions.

nodeQ

nodeQ

At nodeQ, we are pioneering the future of computer networks, leveraging our deep expertise in quantum communication, artificial intelligence, and software-defined networking.

HYCU

HYCU

HYCU was born of the need to simplify data protection and provide equivalent levels of backup and recovery support across on premises, public cloud, and SaaS workloads.

Surf Security

Surf Security

SURF Security has transformed the browser into your strongest security asset while providing complete end-user privacy – all with full compliance.

Stack Overflow

Stack Overflow

Founded in 2008, Stack Overflow’s public platform is used by nearly everyone who codes to learn, share their knowledge, collaborate, and build their careers.