3 Recommendations for Adopting Generative AI for Cyber Defense
In the past eighteen months, generative AI (gen AI) has gone from being the source of jaw-dropping demos to a top strategic priority in nearly every industry. A majority of CEOs report feeling under pressure to invest in gen AI. Product teams are now scrambling to build gen AI into their solutions and services. The EU and US are beginning to put new regulatory frameworks in place to manage AI risks.
Amid all this commotion, hackers and other cybercriminals are hardly standing idly by. They’re looking into using gen AI for doing everything from improving the grammar of phishing messages to exploring ways of faking video and audio to trick or extort money from victims. They’re also looking for ways to attack the very AI models that businesses are busy investing in.
If you’re a CISO, or any security professional, the time to begin evaluating gen AI is now. In a recent white paper, IBM’s chief technology officer for security software, Sridhar Muppidi, outlined five key recommendations for evaluating gen AI’s use in defending against cyberattacks. Here’s a quick look at a few of those recommendations.
Use gen AI in threat hunting and response
As attackers increase their use of gen AI, Muppidi notes that their attacks will become pervasive, evasive, and adaptive. Security teams will need to adapt by using this technology for their own advantage. AI and machine learning can already make security teams more efficient.
For example, AI-powered security information and event management (SIEM) solutions can help analysts prioritize risks detected. They help minimize analysts’ focus on false positives and allow them to instead concentrate on the critical threats at hand. Gen AI-enabled solutions will do much more, including accelerating threat hunting through natural language searches, generating threat detection and response playbooks, and empowering analysts with natural language chatbots. All of these AI-driven solutions can alleviate human bottlenecks and make security far more efficient—responding faster and doing more with less.
Evaluate gen AI based on the time it saves defenders
CISOs and their teams can expect to be bombarded with a lot of product offers from security providers in the next year or two, all touting the advantages of their particular AI-powered technology. How do you sort through all these product descriptions and demos to zero in on what’s going to make the biggest impact for your Security Operations Center (SOC)?
We recommend focusing on time savings. Time is critical in every SOC. SOCs are famously understaffed. Analysts feel overworked and often frustrated. Anything that saves analysts time—whether it’s time spent manually investigating incidents, identifying false positives or writing incident reports—is worth moving to the top of your priority list.
Challenge gen AI providers on trust
When evaluating gen AI products, one aspect that is often not given enough attention is trust. Do you trust the provider selling you this cybersecurity solution? Does the provider have a framework for securing its AI data, model, and usage? Among the questions you should ask the provider:
- What data was your model trained on?
- How representative is that data of the data my SOC works with every day?
- Can I evaluate it in my own environment to see how it performs before I adopt it?
As impressive as gen AI products seem today, and as presence permeates nearly every topic of conversation, this technology is still in its infancy—especially in the field of cybersecurity. New models and techniques are being announced every month. For that reason, it’s crucial you ask the provider about their own product goals. You should ask, point blank:
- How much are you investing in the development of gen AI in your products?
- Do you have a dedicated team evaluating and developing AI for cybersecurity?
- Who else is using your TDIR solution?
As your organization adopts gen AI in its supply chain, customer service, marketing, HR, product development, and other operations, your attack surface will grow. So, you’ll need to use these same gen AI capabilities to secure your AI data, models, and usage.
The bottom line? When attackers are using gen AI, your best strategy is to fight fire with fire.
For a more in-depth look at Muppidi’s recommendations for adopting gen AI for cyber defense, download “5 criteria for evaluating generative AI in threat management.”
