{"id":45504,"date":"2022-03-01T15:00:00","date_gmt":"2022-03-01T15:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/attacks-breaches\/beyond-the-hype-ai-s-future-in-defensive-cybersecurity"},"modified":"2022-03-01T15:00:00","modified_gmt":"2022-03-01T15:00:00","slug":"beyond-the-hype-ais-future-in-defensive-cybersecurity","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/beyond-the-hype-ais-future-in-defensive-cybersecurity\/","title":{"rendered":"Beyond the Hype: AI’s Future in Defensive Cybersecurity"},"content":{"rendered":"
<\/div>\n

AI is a buzzword that gets thrown around a lot in cybersecurity \u2014 often, it seems, to obscure and impress, rather than to clarify how products and services work. This is unfortunate, because beyond the hype, artificial intelligence’s role in cybersecurity is becoming increasingly indispensable. While AI won’t solve all problems, it provides a growing toolbox for accelerating security workflows and better detecting threats. In fact, there are several ways in which AI is already revolutionizing cybersecurity.<\/p>\n

Pattern Matching and Threat Detection
<\/strong>Until the past half decade or so, most cyber-threat detection was performed using small, handwritten pattern-matching programs (called signatures, rules, or indicators of compromise). The widespread adoption of AI has changed this. Now, security vendors are on a long march to augment signature-based detection technology with AI in every context for making detections: detecting phishing emails, malicious mobile apps, malicious command executions, and the like.<\/p>\n

AI won’t replace signatures, nor should it, because these technologies complement each other. Whereas signatures are good at detecting known threat artifacts, AI algorithms \u2014 trained on vast threat databases that cybersecurity companies have accumulated over the years, are better at detecting previously unseen artifacts. Whereas signatures can be written and deployed quickly, AI technologies take a lot longer to train and deploy. And while signature authors can control precisely what threats their signatures will and won’t detect, AI is fundamentally probabilistic and harder to control.<\/p>\n

Security marketing copy often contrasts AI-based detection approaches to signature approaches, but behind the scenes, good security product architects have come to understand that these methods complement each other quite elegantly. The good news here is that hybridizing signatures with AI is making a significant difference in our ability to detect cyberattacks, including ransomware, which was responsible for some of the biggest cyberattacks of the past year, including Colonial Pipeline<\/a>, Kaseya<\/a>, and Kronos<\/a>.<\/p>\n

AI’s Future in Cybersecurity
<\/strong>Unfortunately, much of the security community is not exploring applications of AI beyond the narrow attack-detection use case. To keep pace with threats, it will be necessary to explore new application areas of AI that can augment the human operators who are the last and most important line of defense against cyberattacks. <\/p>\n

This is challenging because it requires that cybersecurity leaders keep track of the rapidly evolving AI research and development space just as we track trends in cybersecurity practice and cybersecurity threats. But it’s too important a priority to forsake.<\/p>\n

Some areas that the defensive cybersecurity community needs, urgently, to focus on, include:<\/p>\n