Using AI In Cybersecurity: Exploring The Advantages And Risks

Recently, research firm Cybersecurity Ventures shared its “Top 10 Cybersecurity Predictions And Statistics For 2023 ,” which unveiled the alarming fact that global cybercrime financial damage will reach $8 trillion in 2023 and $10.5 trillion by 2025. These figures, if viewed as a country, “would be the world’s third-largest economy after the U.S. and China.”

Although these and other cybercrime statistics cited in the article are staggering, the organizations and individuals fighting cybercrime now have an ally that offers ever-increasing capabilities: artificial intelligence (AI).

Of course, cybercriminals often use AI for their own purposes, including creating new malware and hacking tools, automating phishing attacks, searching for loopholes in security, and using deepfake technology and malicious bots to impersonate people. But at the same time, AI enables us to fight back better than ever before.

How AI Works To Fight Cybercrime

AI uses four main abilities to combat cybercrime in real time:

1. Monitoring And Analyzing Behavior Patterns

AI monitors and analyzes behavior patterns in its assigned areas and identifies anomalies, including new users, unusual login activity and IP addresses, permission changes on files, folders and other resources, and copying or deleting large volumes of data.

2. Predicting The Outcomes Of Unusual Behavior

AI compares the anomalies it detects to its knowledge base and predicts the potential next steps and likely outcomes of the unusual behavior.

3. Preventing Bad Actions And Outcomes

Once AI identifies a potential threat, it can take prescribed actions such as preventing deletions, logging off suspicious users and notifying operators of the suspected malicious activity. Administrators can then review the findings and take further action if needed.

4. Training And Machine Learning

AI can be trained to monitor and act against new vulnerabilities, and it can train itself through machine learning (ML) to “remember” previous incidents and actions, thereby improving its ability to identify suspicious activity, predict outcomes and prevent criminal initiatives.

The Advantages Of Using AI In Cybersecurity Over Traditional Systems

There are many potential advantages of using AI in cybersecurity over traditional systems. ML is one of the most important advantages because the AI systems train themselves and learn from past “experiences” while predicting and preparing for possible future scenarios. With ML, AI learns as humans learn but without time-consuming human input. The ML capabilities of AI will only improve as developers continually enhance them.

ML and human training also enable AI to better analyze activity and identify false positives so that the cybersecurity system presents to humans only those issues that require human review. This helps avoid and correct the common problem of bombarding operators with so many unnecessary alerts that they're unable to review them all. As a result, they may miss the important ones and generally burn out on reviewing alerts .

Another important advantage of using AI in cybersecurity is the automation of time-consuming and repetitive tasks, such as monitoring and analyzing events, predicting outcomes, taking preventive actions and generating alerts of suspicious behaviors for human review, all of which can be done continuously in real time. Penetration testing also can be automated with AI , enabling it to be performed daily, rather than once or twice each year .

AI also helps fill the gaps in the human cybersecurity labor force, which will include 3.5 million unfilled positions in 2023 . The shortage of human cybersecurity specialists can be mitigated by implementing AI-powered tools like endpoint detection and response (EDR), extended detection and response (XDR), network detection and response (NDR), managed detection and response (MDR), security information and event management (SIEM) and security orchestration, automation and response (SOAR).

Using AI in cybersecurity can also help free your cybersecurity team from mundane initial event monitoring and analysis and allow them to apply their creativity to learning, strategy and decision-making, which adds more value from each employee to the business as a whole and its bottom line. Organizations can realize benefits in productivity, utilization, job satisfaction and threat mitigation when they deploy the optimal mix of AI and human occupation.

Room For Improvement

Despite the potential advantages, there are several areas in which AI in cybersecurity can improve. Like humans, AI can be tricked by those who study and test its vulnerabilities by crafting data, communications or events that fool the system and its users or by modeling their behavior on a network to appear normal to mask harmful activities. Like cybersecurity itself, this is an ongoing battle of exposing, exploiting, reducing and patching vulnerabilities that likely will never end.

Although it’s better to err on the side of caution, generating false positives is another area in which cybersecurity systems can improve. However, the ML layer of AI-powered cybersecurity systems helps reduce the number of false positives through self-training, and humans can help train the system to recognize positives and false positives.

Like all products that humans create, AI algorithms are susceptible to human error or oversight, which could include unintentional vulnerabilities, bugs and biases. Even with ML, AI thus far can learn and function only as well as it’s programmed to do so. Nonetheless, I believe that the advantages and benefits of AI in cybersecurity far outweigh the risks and inaccuracies

Srajan Dubey

Rajeev K Singh

Ashwini Singh