AI becoming an SOC imperative for curtailing emerging cyber threats

The cybersecurity profession is on the verge of a sea change, and security pros must begin to master AI tools to combat emerging threats by building more autonomous, real-time protections.

Expert panelists at a recent DTX conference session in Manchester, titled “Bot vs Bot: Surviving the Era of Autonomous Cyber Warfare,” highlighted how bringing AI into the security stack without weakening security fundamentals as become a security operations centre (SOC) essential. They also stressed the importance of maintaining human oversight over such systems.

While powerful, AI technologies are no panacea for immature enterprise security architectures, and they can only be applied successfully after the fundamentals of cyber defence are well covered, multiple security practitioner panellists argued. This ground layer, they said, includes system hardening, patching, access control, monitoring, and the like.

Darren Kimuli, information security lead at reinsurance firm Canopius Group, told delegates that AI deployments need to match the expectations of the business — including how an organisation meets its regulatory obligations.

“I’m more concerned about what AI fits rather than what it replaces,” Kimuli said.

Changing roles

Divine Uzodinma, cybersecurity analyst at managed services and telecom vendor Radius, said AI systems help security analysts correlate and triage security logs, a traditionally labour-intensive task.

“AI can analyse and correlate logs and triage alerts while analysts continue with their investigation,” Uzodinma said.

Muhammad Khan, head of cybersecurity at Bridgewater Finance Group, added that AI-based security tools minimise alert fatigue — a perennial problem in the industry and a leading cause of staff burnout.

The more widespread use of AI systems has meant that the role of security analysts has evolved beyond monitoring and response to “validating inputs” and assessing the risk of AI model hallucination.

Enterprises need to test the resilience of AI-based security systems against modern attack paths, such as those found waged against applications and the cloud, as well as supplier access and phishing, according to cybersecurity consultancy Secarma.

George Rees, senior cybersecurity consultant at Secarma, noted that AI is already redefining cyber rules in areas such as risk management and resilience.

Cyber battle ground redrawn

The DTX conference panel also discussed how autonomous attacker tooling is changing the threat landscape.

The enterprise threat environment is evolving into a machine-versus-machine battle ground, meaning that CISOs and other security professionals need to drive change across their organizations or risk becoming hopelessly outflanked by adversaries who are making greater use of AI technologies to mount attacks.

Moreover, there needs to be clarity on cyber team roles and oversight when automation is used to make decisions.

Cyber job roles must be redefined to ensure humans can interpret and oversee autonomous security decisions, according to the panellists.

These changing roles mean that skills such as prompt engineering and risk analysis are becoming more important for security professionals and hiring managers, according to Rees.

“AI is creating opportunities for more GRC [governance, risk, and compliance] hires” because the skillset is well-suited to the new threat environment, Rees added.

Rees compared the scope and pace of change heralded by AI to the period in the 1970s and 1980s when enterprises moved from reliance on typewriters to running a business using computers.

The discussion was timely because enterprises are increasingly dealing with AI-accelerated reconnaissance, phishing, and malware development rather than purely human-led attacks.

The debate has moved from whether to use AI in security to how to use it safely without losing oversight and control. Many of the responses by the DTX conference panellists showed an evolution in thinking since CSO polled security practitioners they are applying AI for security functions last September.

Lessons from Microsoft’s war against scammers

Kelly Bissell, a former corporate VP of product abuse and risk at Microsoft, who gave a keynote on cyber resilience and AI at the start of the DTX conference, told CSO after the show that an arms race is under way between cybersecurity professionals and attackers.

“Early adopters — in general — have the advantage,” Bissell said.

Here, according to Bissell, cybersecurity attackers gain an upper hand because they can ignore rules and regulations such as privacy laws, but defenders can claw back an edge on other fronts.

“Because of the scale of data we handled at Microsoft we could use machine learning techniques to see behavioural trends,” Bissell explained.

For example, Microsoft developed a neural network that was capable of identifying typosquatted domains being set up prior to impersonation attacks with very low false positive rates. “Our mission was to apply pressure to bot gangs” and frustrate their activity, Bissell said.

According to Bissell, CISOs fall into one of three camps: compliance-orientated, package-focused, or elite practitioners.

“Elite practitioners will love to use AI to improve their operations,” said Bissell, adding that AI technologies should be introduced through a process akin to a software development life cycle with extensive pen testing and guardrails prior to being left anywhere near production systems.