Artificial intelligence (AI) and machine learning technologies have been powering some cybersecurity capabilities for decades. Anti-virus, spam-filtering, and phishing-detection tools are just a few examples.
However, the recent advances in AI have led to an explosion in interest around AI-powered cybersecurity capabilities. This has resulted in an unprecedented amount of product releases, investment, and discourse around AI in cybersecurity.
To understand how AI has already and will continue to shape cybersecurity, we’ll explain how AI is used in cybersecurity, starting with more established use cases as well as some of the latest developments.
Artificial intelligence (AI) has made remarkable progress in recent years and has proved its value in various fields, including cybersecurity. With the rise of cyber threats and the increasing complexity of cyberattacks, AI has become a central tool for protecting against cybercrime.
Integrated artificial intelligence systems have the potential to be trained for the automatic identification of cyber threats, alerting users, and safeguarding sensitive information of businesses.
Cyber crimes such as phishing, scams, and data theft are increasing, putting organizations at risk. To combat these threats, organizations are turning to qualified cybersecurity teams equipped with cutting-edge technologies, including artificial intelligence (AI), that swiftly detect and counter malicious activities, fortifying networks against threats.
The recognition of AI’s potential has led 76% of enterprises to prioritize AI and machine learning in their IT budgets, driven by the immense volume of data that necessitates analysis to identify and combat security threats effectively.
With connected devices projected to generate a staggering 79 zettabytes of data by 2025, human manual analysis becomes impractical, making AI an indispensable tool in the fight against cybercrime.
In the wake of artificial intelligence (AI) becoming more commonplace, it’s no surprise to see that threat actors are also adopting the use of AI in their attacks at an accelerated pace. AI enables augmentation of complex tasks such as spear-phishing, deep fakes, polymorphic malware generation, and advanced persistent threat (APT) campaigns, which significantly enhances the sophistication and scale of their operations. This has put security professionals in a reactive state, struggling to keep pace with the proliferation of threats.
As AI reshapes the future of cyber threats, defenders are also looking to integrate AI technologies into their security stack. Adopting AI-powered solutions in cybersecurity enables security teams to detect and respond to these advanced threats more quickly and accurately as well as automate traditionally manual and routine tasks. According to research done by Darktrace in the 2024 State of AI Cybersecurity Report improving threat detection, identifying exploitable vulnerabilities, and automating low level security tasks were the top three ways practitioners saw AI enhancing their security team’s capabilities [1], underscoring the wide-ranging capabilities of AI in cyber.
In this blog, we will discuss how AI has impacted the threat landscape, the rise of generative AI and AI adoption in security tools, and the importance of using multiple types of AI in cybersecurity solutions for a holistic and proactive approach to keeping your organization safe.
What is AI in Cybersecurity?
AI in cybersecurity integrates artificial intelligence technologies, such as machine learning and neural networks, into security frameworks. These technologies enable cybersecurity systems to analyze vast amounts of data, recognize patterns, and adapt to new and evolving threats with minimal human intervention.
Unlike traditional cybersecurity tools, which rely on predefined rules to detect threats, AI-driven systems learn from experience, allowing them to predict, detect, and respond more effectively to known and unknown threats. By doing so, AI empowers organizations to enhance their cybersecurity posture and reduce the likelihood of breaches.
AI in cybersecurity involves technologies that can understand, learn, and act based on data. AI is evolving in three main stages:
- Assisted intelligence: Enhances what people and organizations already do today.
- Augmented intelligence: Enables new capabilities, allowing people to perform tasks they couldn’t do before.
- Autonomous intelligence: Future technology where machines will act independently, like self-driving cars.
Benefits of AI in Cybersecurity
Cybersecurity presents unique challenges, including a constantly evolving threat landscape, vast attack surface, and significant talent shortage.
Since AI can analyze massive volumes of data, identify patterns that humans might miss, and adapt and improve its capabilities over time, it has significant benefits when applied to cybersecurity, including:
- Improving the efficiency of cybersecurity analysts
- Identifying and preventing cyber threats more quickly
- Effectively responding to cyber attacks
- Reducing cybersecurity costs
Consider the impact of security AI and automation on average data breach costs and breach lifecycles alone. According to a survey by IBM, organizations that use security AI and automation extensively report an average cost of a data breach at $3.60 million, which was $1.76 million less than breaches at organizations that didn’t use security AI and automation capabilities. This is a 39.3% difference in average breach cost. Organizations with fully deployed security AI and automation were also able to identify and contain a data breach 108 days faster than companies with no security AI and automation deployed.
Even organizations with limited use of security AI and automation reported an average cost of a data breach of $4.04 million, which was $1.32 million less or a 28.1% difference compared to no use. Organizations with limited use also saw a significant acceleration in the time to identify and contain a breach, with an average of 88 days faster than organizations with no use of security AI and automation.
How is AI used in cybersecurity?
Artificial intelligence combines large data sets and uses them with intuitive processing algorithms. As the scope of networks and systems expands, AI in cybersecurity helps to automate operations by processing large amounts of data much faster than a human ever could. For this reason, most cybersecurity tools integrate deep learning and other capabilities intended to work with big data. Here are the main ways in which AI is used in cybersecurity:
-
Threat detection. AI can act as a filter for analyzing files and software code to identify potential malware threats while avoiding false positives. Machine learning algorithms can be trained for threat detection to recognize patterns and characteristics of known malware and flag any new code that matches these patterns.
-
Network security. AI algorithms can analyze network traffic data to detect patterns and anomalies indicating an attempted intrusion or attack. AI can flag any deviations from this baseline as potential threats by learning what normal network traffic patterns look like.
-
Behavioral analysis. AI can be used to analyze user behavior and detect anomalies that may indicate unauthorized access or malicious activity using machine learning. This allows for more effective user activity monitoring and detection of potential threats while limiting false positives.
-
Automated incident response. AI-based systems can be used to automatically respond to detected threats, like shutting down connections, quarantining infected machines, and disabling user accounts. Advanced machine learning models help to contain hacking attempts and minimize potential damage.
-
Vulnerability assessment. AI can identify potential vulnerabilities in systems and networks. This allows for proactive measures to be taken to mitigate potential threats before they can be exploited.
AI can be a powerful tool that can contribute in real-time, which can be essential in today’s rapidly evolving cyber threat landscape and lowers the odds that an organization will be affected by a data breach.
Why exactly is AI Important for Cybersecurity?
The escalating complexity of cybersecurity threats, including social engineering and ransomware, poses challenges for conventional defenses in effectively detecting and preventing such attacks. As organizations confront an overwhelming volume of data requiring analysis for potential risks, strengthening cybersecurity becomes crucial. Adopting innovative solutions is imperative to effectively combat these threats.
Let’s have a look at key reasons why AI is important for cybersecurity:
Cost reduction
AI-driven automation leads to cost reductions in various areas of cybersecurity operations. By automating routine tasks such as log analysis, vulnerability assessments, and patch management, AI minimizes the need for manual intervention, saving valuable time and human resources.
AI’s ability to improve threat detection accuracy also contributes to cost reduction. Traditional security approaches may generate false positives or miss certain threats, leading to wasted time and resources investigating non-existent issues or overlooking actual security incidents.
Improved scalability
Traditional cybersecurity approaches often struggle to handle the vast volumes of data generated in complex and interconnected environments. AI excels in scalability, processing and analyzing massive amounts of data from various sources simultaneously.
AI algorithms can effectively analyze network traffic logs, system logs, user behaviors, and threat intelligence feeds. This scalability allows AI to detect subtle indicators of threats that may escape human analysts, ensuring a proactive defense posture.
A generation of generative AI in cybersecurity
When the topic of AI in cybersecurity comes up, it’s typically in reference to generative AI, which became popularized in 2023. While it does not solely encapsulate what AI cybersecurity is or what AI can do in this space, it’s important to understand what generative AI is and how it can be implemented to help organizations get ahead of today’s threats.
Generative AI (e.g., ChatGPT or Microsoft Copilot) is a type of AI that creates new or original content. It has the capability to generate images, videos, or text based on information it learns from large datasets. These systems use advanced algorithms and deep learning techniques to understand patterns and structures within the data they are trained on, enabling them to generate outputs that are coherent, contextually relevant, and often indistinguishable from human-created content.
For security professionals, generative AI offers some valuable applications. Primarily, it’s used to transform complex security data into clear and concise summaries. By analyzing vast amounts of security logs, alerts, and technical data, it can contextualize critical information quickly and present findings in natural, comprehensible language. This makes it easier for security teams to understand critical information quickly and improves communication with non-technical stakeholders. Generative AI can also automate the creation of realistic simulations for training purposes, helping security teams prepare for various cyberattack scenarios and improve their response strategies.
Despite its advantages, generative AI also has limitations that organizations must consider. One challenge is the potential for generating false positives, where benign activities are mistakenly flagged as threats, which can overwhelm security teams with unnecessary alerts. Moreover, implementing generative AI requires significant computational resources and expertise, which may be a barrier for some organizations. It can also be susceptible to prompt injection attacks and there are risks with intellectual property or sensitive data being leaked when using publicly available generative AI tools. In fact, according to the MIT AI Risk Registry, there are potentially over 700 risks that need to be mitigated with the use of generative AI.
Top Benefits of AI in Cybersecurity
1. Improved Threat Intelligence
AI enhances threat intelligence by analyzing large datasets in real time and providing predictive insights. This capability allows cybersecurity teams to anticipate attacks before they occur and take proactive measures to defend against them.
2. Faster Incident Response Times
Speed is crucial during a cyberattack, and AI enhances incident response by automating threat detection, analysis, and mitigation. Thus, the time from detection to action is reduced, and potential breach impacts are minimized. AI-powered systems provide improved context for prioritizing security alerts, enable rapid incident response, and identify root causes to mitigate vulnerabilities and prevent future issues.
4. Better Vulnerability Management
AI’s ability to identify vulnerabilities in networks and systems is another significant advantage. AI-powered vulnerability scanners can prioritize risks based on reachability, exploitability, and business criticality, helping organizations address the most pressing issues first. This reduces false positives and ensures that security teams are working efficiently.
5. More Accurate Breach Risk Predictions
Accounting for IT asset inventory, threat exposure, and security controls effectiveness, AI-based systems can predict how and where you are most likely to be breached so that you can plan for resource and tool allocation toward areas of weakness. Prescriptive insights derived from AI analysis can help you configure and enhance controls and processes to improve your organization’s cyber resilience most effectively.
6. Automated Recommendations
Another key to harnessing AI to augment human infosec teams is the explainability of recommendations and analysis. This is important in getting buy-in from stakeholders across the organization, understanding the impact of various infosec programs, and reporting relevant information to all stakeholders, including end users, security operations, CISO, auditors, CIO, CEO and board of directors.
Key AI Technologies in Cybersecurity
Machine Learning (ML)
Machine learning (ML) is a form of AI that enables systems to learn from data and improve without explicit programming. In cybersecurity, a typical application of ML is User and Entity Behavior Analytics (UEBA), which analyzes patterns and behaviors to detect threats.
For example, UEBA can flag unusual login activity by identifying anomalies in user behavior, such as abnormal login times or locations, which may signal a security breach and enable faster responses. ML excels in tasks like identifying network traffic anomalies and helping prevent attacks by recognizing irregular behavior before they escalate.
Deep Learning
Deep learning, a subset of ML, uses neural networks to analyze complex data and is highly effective in detecting advanced cybersecurity threats, such as evolving malware strains. In cybersecurity, Deep Learning is used to detect polymorphic malware, which constantly changes its code to evade traditional detection methods.
Deep learning models can analyze vast amounts of data and recognize underlying patterns in malware behavior, even when the code differs. For example, deep learning can identify anomalies in how files interact with a system, flagging malicious intent even if the malware has never been encountered before.
This ability to learn from subtle behavioral patterns significantly improves detection and response times to previously unseen threats, making deep learning essential in staying ahead of sophisticated cyberattacks.
Neural Networks
Neural networks are AI models inspired by the human brain’s structure. In them, nodes process data through weighted inputs. Each node evaluates its input, adjusting weights to improve accuracy. The final result is based on the sum of these evaluations. In cybersecurity, neural networks help analyze vast amounts of data, such as firewall logs, to identify patterns and predict potential threats, making them a powerful tool for threat detection.
Large Language Models (LLMs)
Large Language Models (LLMs), such as GPT-4, represent another significant AI technology in cybersecurity. LLMs specialize in processing and understanding human language, making them highly useful for automating threat analysis and improving security responses. These models can sift through vast amounts of text data—such as threat reports, logs, and documentation—to identify potential risks and patterns that could signal an attack.
LLMs also help with tasks like phishing detection, generating human-readable threat reports, and automating responses to security incidents. By understanding the context of language, they can enhance cybersecurity tools, enabling faster and more accurate decision-making.
Malware and phishing detection
AI-based cybersecurity systems demonstrate showcasing enhanced efficacy. Deep Instinct’s Chuck Everette reveals that AI models boast security rates of 80% to 92%, surpassing the 30% to 60% achieved by legacy signature-based malware detection systems.
AI analyzes email content and context to differentiate between spam, phishing attempts, and legitimate messages. Machine learning algorithms and their enhanced threat intelligence enable AI to evolve and adapt to new threats, recognizing signs of sophisticated attacks like spear phishing. Intercepting suspicious activities before they harm corporate networks is paramount.
AI technologies excel at detecting phishing traps, thus thwarting potential threats. Researchers from the University of North Dakota proposed a machine learning-based phishing detection technique, achieving an impressive 94% accuracy in classifying emails as legitimate or phishing.
Security log analysis
AI transforms security log analysis by harnessing machine learning algorithms to analyze copious amounts of real-time log data. By detecting patterns and anomalies, even without known threat signatures, AI empowers organizations to identify and respond to potential security breaches swiftly. Moreover, AI excels at detecting potential insider threats through a comprehensive analysis of user activity across multiple systems and applications.
Endpoint security
As remote work becomes more prevalent, securing endpoints becomes paramount in maintaining robust cybersecurity. Traditional antivirus solutions and VPNs rely on signature-based detection, which may lag behind emerging threats, leaving endpoints vulnerable.
AI-driven endpoint protection takes a dynamic approach, establishing baselines of normal endpoint behavior and detecting deviations in real time. By continuously learning from network behavior, AI can identify potential threats, including zero-day attacks, without needing signature updates.
With AI, a security team can enhance password protection and user account security through advanced authentication methods. AI-driven solutions like CAPTCHA, facial recognition, and fingerprint scanners automatically detect genuine login attempts.
Encryption
But what about encryption, which keeps our data safe? Can AI break it? Well, that’s a complex question. Encrypted data is like a puzzle, and AI needs to figure out which pieces are good or bad. Breaking encryption is tough because it relies on complex math that even AI struggles with.
The good news is that encryption algorithms, like AES and SHA, are designed to be really tough to crack. They use security tools and tricks that make it hard for AI or any attacker to predict how they work. So, even though AI can do amazing things, breaking strong encryption is still a big challenge.
Threat detection in Honeywell
With the help of AI, Honeywell’s platform can swiftly analyze vast amounts of data from industrial control systems, identifying any unusual patterns or behaviors that might indicate a cyber threat. This enables the system to proactively detect and block malicious traffic attempting to breach the control systems.
Moreover, the AI-driven platform is designed to continuously learn from past incidents and adapt to new emerging threats. It can recognize patterns associated with unauthorized access attempts and promptly mitigate them before any significant damage occurs.
AI and cybercrime
While AI is being applied in many ways to improve cybersecurity, it is also being used by cyber criminals to launch increasingly sophisticated attacks at an unprecedented pace.
In fact, 85% of security professionals that witnessed an increase in cyber attacks over the past 12 months attribute the rise to bad actors using generative AI.
As a result of AI-driven cyber attacks as well as other factors, cybercrime is expected to cost $10.5 trillion globally by 2025.
Below are just a few ways that AI is being used in cybercrime:
- Social engineers are using ChatGPT to craft more believable and legitimate sounding phishing emails.
- Social engineers are also using machine-learning algorithms combined with facial-mapping software to create convincing deepfakes.
- Malicious actors are using AI to launch more machine-speed attacks, ie. ransomware and other automated attacks that propagate and/or mutate very quickly and are virtually impossible to neutralize using human-dependent response mechanisms.
- Hackers are using AI-supported password guessing and CAPTCHA cracking to gain unauthorized access to sensitive data.
- Threat actors are creating AI that can autonomously identify vulnerabilities, plan and carry out attack campaigns, use stealth to avoid defenses, and gather and mine data from infected systems and open-source intelligence.
How is cybersecurity AI being improved?
In response to these emerging threats, cybersecurity AI is being continuously improved to keep pace with cybercriminals and adapt its capabilities over time.
Below are key ways in which cybersecurity AI is being improved.
1. Better training for AI models
AI models are getting better training thanks to increased computation and training data size. As these models ingest greater amounts of data, they have more examples to learn from and can draw more accurate and nuanced conclusions from the examples it is shown.
As a result, cybersecurity AI tools are better at identifying patterns and anomalies in large datasets and learning from past incidents, which enables them to more accurately predict potential threats, among other cybersecurity use cases.
2. Advances in language processing technology
Thanks to increases in data resources and computing power, language processing technology has made significant advances in the past few years. These advances, including enhanced capabilities to learn from complex and context-sensitive data, will significantly improve cybersecurity AI tools that automatically generate step-by-step remediation instructions, threat intelligence, and other code or text.
3. Threat intelligence integration
Cybersecurity AI systems are being enhanced by integrating with threat intelligence feeds. This enables them to stay updated on the latest threat information and adjust their defenses accordingly.
4. Deep learning
A subset of machine learning, deep learning is a neural network with three or more layers. Simulating the behavior of the human brain, these neural networks attempt to learn from large amounts of data and make more accurate predictions than a neural network with a single layer.
Due to its ability to process vast amounts of data and recognize complex patterns, deep learning technology is helping contribute to more accurate threat hunting, management, and response.
5. More resources for AI development and use
As AI development and usage continue to skyrocket in cybersecurity and other industries, governments and other authoritative bodies like NIST, CISA, and OWASP are publishing resources to help individuals and businesses manage the risks while leveraging the benefits.
