CONFERENCE On Demand: Cyber AI & Automation Summit - Watch Now
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Artificial Intelligence

Narrowing the Focus of AI in Security

AI can truly disrupt all elements of the SOC and provide an analyst with 10x more data and save 10x more time than what currently exists.

AI in Cybersecurity

Over the last few months, it has been hard to get away from the AI headlines. Amazon, Microsoft, Meta, Google and have been everywhere, and we have seen a huge influx of capital into the AI industry as a whole. Companies without a business plan or earnings call statement about AI often get noticed and punished for it. High priced acquisitions have investors salivating. Just take a look at some of the top acquisitions in the last 6 years.

I started to get familiar with machine learning in 2015, right when the industry was starting to grow and data science became its own field, separate and distinct from statistics and computer science. Universities quickly followed building programs, corporations starting investing in upgraded hardware such as GPUs, and now we have a whole industry well equipped for using machine learning models to build artificial intelligence.

As with many waves (Gartner uses the term “Hype Cycles”), we know that all things need to be actualized and refined over time, many of them into long term business strategies. Gartner thinks we are between 2-10 years from getting there, which I think is fairly realistic.

Source: Gartner

Similar to other waves in the past, there are numerous subcomponents of AI and I believe security is a small portion of it. If you do a quick search on the internet you will find various articles on the ways that AI will change the entire industry, such as threat detection, behavioral analysis, and natural language processing. I do believe these industries will be improved, we have already seen that AI can piece data together much faster and better than humans can, but I don’t think that’s going to completely change the function. Here are the two areas that I believe will completely change.

Automatic patching of vulnerabilities

For many CISOs, vulnerability management is the thorn in your side that never goes away. It’s an ongoing process that expands as the surface area with technology grows. But what if there was a way to automatically patch your systems as soon as a vulnerability was released?

To help me explain further, I want to draw on an example from Defcon in 2016. For those who are not familiar, DARPA unveiled their two year long contest championship known as the Cyber Grand Challenge. It was a historic event putting machines against machines, attacking zero day vulnerabilities based on real world vulnerabilities, as well as rebuilding and defending your systems at the same time. Scoring was simple, you were judged each round on the following concepts:

  • Availability – Is your program still working and available?
  • Defense (Security) – Did anyone exploit your program?
  • Offensive (Evaluation) – Did you get into someone else’s program?

The results were quite impressive, you can watch a full analysis on YouTube. However after the groundbreaking concepts, it seemed the traction faded shortly after. Voting machines and Autonomous driving took over the stage the next years, and we hadn’t seen a lot of traction in the industry since. The winner, ForAllSecure, did recently raise a series B round in 2022, but It seemed the overall concepts and technologies were poorly shared with industry or even implemented broadly at both the federal and private sector.

While the concept was novel, the technology was quite nascent. Fast forward to today and DARPA said they are doing it again at Defcon in 2024 and 2025, this time in partnership with Anthropic, Google, Microsoft and OpenAI and over $18 million USD in prizes. The results are bound to be stunning with over 8 years of improvements. With so many open source projects and the growing surface area of third party programs, I am a strong believer that the only way to fix vulnerability management is to have dynamic patching instead of traditional human-led patching. The registration is open here, I’m excited to see what’s in store next year.

Advertisement. Scroll to continue reading.

The SOC

The Security Operations Center, also known as the SOC, is one of the most human labor intensive units within the security umbrella. The SOC needs to be always on, staffed with playbooks, and ready to go for any type of security incident that an organization might face. This means you might need a global workforce, shift work, or an outsourced provider who can provide complete coverage that fits your needs. Another challenge is that keeping morale high within the SOC can be very difficult and burnout is common.

There can be hundreds of data sources connected to a SOC. Some to name a few are endpoint logs, network logs, Intrusion detection systems, application logs, third party vendor logs, identity logs, security access logs, email logs and more. Having a reliable timeline is the best way to stitch data together, but often an analyst needs to manually pull and verify logs, especially if they are not easily integrated into existing systems. The SOC playbooks are usually some form of tree and branch structure, which either leads to a resolution or escalation. The work can be tedious and means interacting with many forms of data to make informed decisions about the next step of the process. Parsing logs, indicators, and building timelines can take hours or days to do.

Although this is still fairly new, and training data is currently lacking, I believe that AI can truly disrupt all elements of the SOC and provide an analyst with 10x more data and save 10x more time than what currently exists. It will take a lot of corporate data consolidation, privacy boundaries, and processing power to put it together. We can already see the industry working on the start of this trend. Cisco is buying Splunk, Google bought Mandiant, Microsoft bought RiskIQ and CloudKnox and Miburo. Amazon and Meta are working on refining their own tools with internal investments.

It is hard to say where we will be in 10 years, but I picture a very different vulnerability management program and SOC, areas that I believe are underrepresented as a whole. Even though security is a small sliver of the AI wave, I am hopeful we will see big changes in these areas.

Written By

Matt is the current Head of Security and Compliance at Forward Networks. He is a security leader and has a background in the areas of threat intelligence, networking, system forensics and discovery, enterprise security auditing, malware analysis and physical security. He is an industry speaker, author, and frequent security podcast guest. Matt also holds a US granted patent, multiple US Government awards and was selected as a one of Silicon Valley Business Journal 40 under 40.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.

Register

As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.

Register

Expert Insights

Related Content

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Artificial Intelligence

ChatGPT is increasingly integrated into cybersecurity products and services as the industry is testing its capabilities and limitations.

Artificial Intelligence

The degree of danger that may be introduced when adversaries start to use AI as an effective weapon of attack rather than a tool...

Artificial Intelligence

Two of humanity’s greatest drivers, greed and curiosity, will push AI development forward. Our only hope is that we can control it.

Artificial Intelligence

Microsoft and Mitre release Arsenal plugin to help cybersecurity professionals emulate attacks on machine learning (ML) systems.

Application Security

Thinking through the good, the bad, and the ugly now is a process that affords us “the negative focus to survive, but a positive...

Artificial Intelligence

Two new surveys stress the need for automation and AI – but one survey raises the additional specter of the growing use of bring...