How Cybersecurity Teams Use AI to Work Smarter, Not Harder
Tom D'Agustino
A worker bee, working harder and not smarter
In 2008, Heartland Payment Systems experienced a significant security breach due to an SQL injection, which led to massive data exposure and sent shockwaves through the financial sector.
Fast forward to today, and the cybersecurity landscape has evolved dramatically, thanks in large part to the arrival of AI.
If Heartland had access to today's AI-driven security tools, the story might have been different. AI's knack for spotting anomalies could have served as an early alarm, potentially nipping the breach by identifying suspicious activities before they escalated.
This doesn't mean AI is a silver bullet, though. The real strength comes from combining AI’s power with the expert judgment of cybersecurity professionals.
Below, we explore the ways AI supports cybersecurity teams, its impact on their key skills and responsibilities, and whether it’s becoming more than just a sidekick.
How AI Helps Cybersecurity Professionals Work Smarter
CISOs and their teams are on the front lines, battling to keep companies safe from a slew of ever-changing cyber threats – a hefty responsibility.
AI comes to their aid by automating tasks, providing rapid threat detection, and enabling proactive measures, allowing them to work smarter, not harder, in their high-stakes roles.
AI Reduces Pressure
In the first half of 2022, CISOs had to face an astounding 2.8 million malware attacks.
Though most of these turn out to be false leads, each incident must be taken seriously, lest a legitimate threat slip through unnoticed.
Not surprisingly, this massive workload can cause burnout, leading to productivity drops, increased errors, and project delays. AI serves as the safety net for CISOs, picking out threats that may have slipped past the human mind due to errors or stress-related factors.
Real-World Example: Snorkel Flow
Snorkel Flow helps cybersecurity teams create labeled machine learning (ML) training datasets for AI applications. These in-house, AI-powered models are adaptable to constantly changing threats and perfectly suited to an organization’s unique networks and policies.
By automating the tedious task of manually labeling training models, Snorkel significantly decreases the workload of cybersecurity professionals and:
Reduces the risk of employee burnout
Enhances operational efficiency
Prevents AI applications from relying on static rules
Avoids data breaches due to outsourced/crowdsourced labeling efforts
Increases ML models’ explainability and auditability
AI Increases Work Speed
McKinsey reported that AI can reduce data processing time by up to 60%.
AI boosts efficiency by automating compliance tasks and streamlining adherence to regulations like GDPR and HIPAA. This transition from manual checks to AI-driven systems reduces workload and enhances accuracy in meeting compliance requirements, freeing up teams to tackle more strategic challenges.
It also acts as a strategic enhancer, informing decision-making with its predictive and analytical prowess.
For example, AI analyzes network data and user behavior, quickly identifying emerging threats. This foresight enables cyber professionals to adjust security measures or redistribute resources to mitigate risks proactively.
Real-World Example: Vendict
Aidoc faced a snag as growing data regulations bogged down their sales team with compliance paperwork. Jason, the lead sales engineer, was overwhelmed by the sheer volume of security questionnaires.
Despite trying various automation tools, none seemed to ease the burden.
After a colleague suggested Vendict, Jason gave it a go, impressed by its organization and ease of use. Our AI platform delivered and significantly reduced their questionnaire processing time from nearly 100 days to just six, streamlining their sales cycle.
AI Enhances Remote Work Security
Remote work is an indispensable part of the modern work environment, especially in the cybersecurity industry, but it also opens up new vulnerabilities for organizations.
AI has proven an integral companion in the shift toward remote work by providing:
Secure access: AI-driven systems ensure that only approved users can access company networks remotely, reducing the risk of breaches.
Endpoint protection: AI offers instant threat detection and response for remote devices, protecting against malware and phishing outside the office network.
Behavioral analytics: By analyzing usage patterns, AI flags unusual activities among remote workers, helping to catch breaches early.
VPN efficiency: AI improves VPN connections for remote workers, boosting both the security and speed of their online communications.
Targeted training: AI tailors security training for remote employees, covering key risks like public Wi-Fi and secure video conferencing, keeping them aware of dangers.
Real-World Example: Amazon Web Services
Amazon enhances remote work cybersecurity through AWS services like GuardDuty, Inspector, and Macie.
GuardDuty detects unusual activities, such as abnormal API usage and odd network traffic, indicating potential breaches. AWS Inspector continuously monitors for vulnerabilities in AWS infrastructure, while AWS Macie uses ML to identify and protect sensitive data, including financial information, ensuring comprehensive security for remote work environments.
AI Promotes Adaptability
"Cybersecurity has always been a cat-and-mouse game, but the mice keep getting bigger and are becoming increasingly harder to hunt," says Dipti Parmar of cio.com.
However, as these adversaries evolve, AI is accelerating our ability to keep up.
Harold Rivas from Trellix points out that AI helps us gather critical information quickly, allowing CISOs to move from a reactive to a more adaptive, risk-based approach. The new Trellix GenAI is a prime example – it can spotlight weak spots by looking at cyberattacks that have occurred outside your company.
Beyond identifying weaknesses, GenAI also monitors user behavior, distinguishing between normal activities and outliers to spot potential security threats.
Real-World Example: Darktrace HEAL
Darktrace offers automated incident response plans through HEAL.
HEAL enables security teams to simulate real attacks, putting their playbook into action to test its efficacy. HEAL’s AI gives the team feedback on their response, helping them better prioritize tasks and develop a more thorough plan of defense. The AI also provides automated reports during the incident, saving valuable time in critical moments.
Darktrace HEAL showcases how AI enhances each of the four phases of incident response: detection, prevention, response, and recovery.
What These Changes Mean for Cybersecurity Professionals
The jobs of cybersecurity professionals have undergone a significant makeover.
Thanks to the integration of AI, they aren't just brushing up on old skills; they're completely reshaping their roles.
In this section, we dive into how AI is shaking things up for CISOs, their internal cyber teams, and their external partnerships.
How Smarter Working with AI Impacts Cybersecurity Skill Sets
AI isn't just tweaking the nuts and bolts of cybersecurity; it's fundamentally transforming the CISO role into a strategic business advisor.
With AI managing repetitive tasks, CISOs can zoom out to focus on the bigger picture, blending technical know-how with leadership and strategic insights.
Jason Witty from JPMorgan Chase points out an essential shift: it's not enough to just keep up with AI advancements; modern CISOs must understand their broader business impact. This involves interpreting AI insights and making decisions that align with the organization's goals:
“Being a successful CISO these days involves wearing many hats, from business to risk to technology to software engineer. You must be aware of the threat landscape and understand human behavior. You also have to know how to […] gain trust from multiple stakeholders.”
Given the rapid pace of AI-powered threats, CISOs are also tasked with staying agile, embracing continuous learning to adapt quickly to new challenges.
Training platforms like Immersive Labs are stepping up, offering courses that cultivate strategic thinking and crisis management skills in a dynamic, engaging format.
So, the ripple effect of AI on cybersecurity extends beyond technical skills, pushing CISOs towards a more holistic skill set that marries technical proficiency with strategic acumen, underscoring the critical role of continuous education in navigating this evolving landscape.
How Smarter Working with AI Impacts Cybersecurity Responsibilities
The expansion of cybersecurity professionals’ skill sets has seen their responsibilities shift toward much more active and broader roles within their companies.
With AI, these responsibilities come in the following forms:
Strategic planning: CISOs must develop a strategic roadmap for integrating AI into the cybersecurity framework, ensuring it complements the organization's overall objectives.
Risk assessment and management: Cybersecurity professionals are responsible for identifying and mitigating potential AI vulnerabilities and privacy concerns.
Compliance and regulation: Cybersecurity teams need to stay updated on evolving compliance requirements and adapt AI strategies accordingly.
Vendor management: CISOs play a crucial role in selecting and managing AI vendors and solutions, including evaluating the security posture of AI providers, negotiating contracts, and overseeing vendor relationships to ensure compliance and data security.
Employee training and awareness: CISOs must develop training programs and awareness campaigns to ensure that the workforce understands the role of AI in maintaining security.
How Smarter Working with AI Impacts Internal Cybersecurity Workforces
Working smarter with AI has specific impacts on key roles within internal cyber workforces.
For example, AI automation reduces the manual workload of cybersecurity analysts, enabling them to spend more time on more strategic tasks such as advanced threat hunting and strategy development.
The University of Texas A&M System's security operations center (SOC), responsible for 11 universities and seven state agencies, faced the challenge of organizing security events in a risk-rich environment of 174,000 users.
With just seven full-time analysts, the workload was overwhelming. Security analysts followed a typical division of labor: Tier-1 analysts examined alerts, Tier-2 analysts pursued potential attacks, and a security engineer worked on enhancing infrastructure security.
However, it took a significant amount of time to connect disparate data points and build threat profiles. According to Dan Basile, SOC executive director, “The mean time to resolution – the point when you think there is an attacker in the system to remediation – used to be measured in hours, if not days, on average.”
To address this challenge, the university implemented a machine-learning-based security system for incident detection and triage. This AI system has dramatically improved incident resolution times, reducing them to an average of 10 to 20 minutes.
How Smarter Working with AI Impacts External Cybersecurity Workforces
AI has a profound impact on CISOs' external workforce, including vendors and MSSPs, transforming their collaboration into more efficient and secure working relationships.
AI-driven security solutions, such as threat detection and monitoring tools, enable the seamless sharing of real-time threat intelligence, empowering external security teams to identify and respond swiftly to emerging threats.
Tools like automated security questionnaires offer in-depth insights into vendors' security practices and potential vulnerabilities, equipping CISOs with the knowledge to make informed decisions about partnerships and elevate security standards.
Ido Jaffe, VP of Customer Success at SecuriThings, highlights how Vendict's solution notably streamlines the onboarding process for new clients, particularly benefiting CISOs, Sales Engineers, and Solution teams within the ICT sector.
He emphasizes the simplicity and efficiency of the process, stating that it requires minimal effort as Vendict handles the bulk of the work. This ease of integration not only enhanced operational efficiency and productivity but also allowed teams to redirect their focus to other critical tasks.
Boosting Efficiency: AI as a Co-pilot, an Auto-Pilot, or Both?
AI in cybersecurity is like having both a co-pilot and an auto-pilot.
As a co-pilot, it works right alongside your team, lending a hand in making smart decisions.
For instance, in threat detection, AI sifts through data, much like a co-pilot would help navigate through rough skies, helping to spot those hard-to-see threats. Google’s Duet AI in Security Operations lets you search your data in plain language, make refinements, and dig deeper. It also takes care of creating detailed queries and clear syntax. Plus, it helps you work smarter by summarizing case updates and suggesting next steps.
But AI is more than capable of turning into an auto-pilot, too.
For example, Samurai XDR SaaS keeps a vigilant watch over your digital environment around the clock. It collects data from diverse sources, conducts thorough analyses, and swiftly pinpoints potential threats. Upon detecting a threat, it promptly takes action to identify the problem and offers effective solutions for countering and neutralizing any unwelcome activity.
A Balancing Act: Human Insight and Cybersecurity AI
AI in cybersecurity is a powerful tool that lifts the burden off your security teams on a day-to-day basis, allowing them to focus on meaningful work rather than time-consuming, repetitive tasks.
However, it's crucial to manage this technology carefully. The cautionary tale of the ChatGPT data breach serves as a stark reminder that over-reliance on AI and open-source components can have unintended consequences.
There’s always the risk of AI accidentally leading to privacy breaches or unethical practices.
This underscores the need for cybersecurity leaders to:
Deploy AI tools strategically with human expertise and oversight underpinning the technology
Foster a culture of ongoing learning and flexibility to navigate evolving threats
Advocate for responsible, traceable AI usage
In the complex web of cybersecurity, striking the right balance between powerful automation and human judgment is the key to unlocking smarter, AI-driven working practices.
Like this project
Posted Apr 16, 2024
Learn how AI in cybersecurity enhances efficiency, focusing on real-world applications and striking the balance between automation and human insights.
