We will discuss how the expansion of the attack surface and the escalation in severity and complexity of cyber threats are exacerbated by a chronic shortage of cybersecurity talent. Employment in this field is expected to grow by approximately 89 percent to fill the estimated global shortage of more than 3 million cybersecurity professionals.

Accelerated threat detection

Threat detection was one of the first applications of cyber AI. It can augment existing attack surface management techniques to reduce noise and allow scarce security professionals to focus on the strongest signals and indicators of compromise. It can also make decisions and take actions faster and focus on more strategic activities.

Advanced analytics and machine learning platforms can quickly sift through the high volume of data generated by security tools, identify deviations from the norm, evaluate data from the thousands of new connected assets flooding the network, and be trained to distinguish between legitimate and malicious files, connections, devices and users.

AI-driven network and asset mapping and visualization platforms can provide real-time insight into an expanding enterprise attack surface. They can identify and classify active assets, including containerized assets, which can provide visibility into malicious asset behavior. Supply chain risk management software incorporating AI and machine learning can automate processes to monitor physical and digital supply chain environments and track how assets are composed and connected.

Force multiplier in containment and response

AI can also serve as a force multiplier that helps security teams automate time-consuming activities and streamline containment and response. Consider machine learning, deep learning, natural language processing, reinforcement learning, knowledge representation and other AI approaches. Combined with automated assessment and decision making, AI can help analysts manage a growing number of increasingly complex security threats and achieve scale.

For example, like its predecessors, 5G is vulnerable to jamming attacks, in which attackers deliberately interfere with signal transfer. Researchers at Virginia Tech’s Commonwealth Cyber Initiatives, who are collaborating to understand the design and implementation of 5G network security, are working to identify low-level signal jamming before it brings down the network. By implementing an AI-based interference scheme and machine learning models, a real-time vulnerability assessment system has been developed that can detect the presence of low-level signal interference and classify interference patterns.

Automation can help maximize the impact of AI and reduce the time between detection and remediation. SOC automation platforms that incorporate AI and machine learning can take autonomous preventive actions – for example, blocking access to certain data – and forward issues to the SOC for further evaluation. When layered on top of API management solutions that control API access, machine learning models trained on user access patterns can inspect all API traffic to discover, report and act on anomalies in real time.

Proactive security posture

Properly trained AI can enable a more proactive security posture and promote cyber resilience, allowing organizations to remain operational even when attacked and reducing the time an adversary is in the environment.

For example, context-rich user behavior analysis can be combined with unsupervised machine learning algorithms to automatically examine user activity, recognize typical patterns of network activity or data access, identify, assess and report anomalies (and ignore false alarms), and decide whether a response or intervention is warranted. By providing intelligence to human security specialists and enabling them to actively engage in the pursuit of adversaries, AI enables proactive threat hunting.

Organizations can leverage AI and machine learning to automate areas such as security policy configuration, compliance monitoring, and threat and vulnerability detection and response. For example, machine learning-driven privileged access management platforms can automatically develop and maintain security policies that help enforce zero-trust security models. By analyzing network traffic patterns, these models can distinguish legitimate from malicious connections and make recommendations on how to segment the network to protect applications and workloads.

By combining vulnerability scanning and reinforcement learning, security specialists can generate attack graphs that model the structure of complex networks and reveal optimal attack routes, leading to a better understanding of network vulnerabilities and reducing the number of people needed to perform tests. Similarly, cyber attack simulation tools can continuously mimic advanced threat tactics and procedures to highlight infrastructure vulnerabilities and potential attack routes.

Evolving the role of human security analysts

In a survey of security analysts, 40 percent said their biggest challenge was too many alerts; 47 percent said it was difficult to know which alerts to prioritize for incident response. More than three-quarters of respondents reported analyst turnover of more than 10 percent, and nearly half said it was between 10 and 25 percent.

AI can’t replace security professionals, but it can improve their work and potentially lead to greater job satisfaction. In the average SOC, AI and automation could eliminate the tedious functions of Tier 1 and Tier 2 analysts (Tier 1 evaluates incoming data and decides to escalate issues, and Tier 2 responds to incident tickets, assesses the scope of each threat, determines response and remediation actions, and escalates if necessary). These analysts could be trained for more strategic roles that are harder to hire for, such as Tier 2 and Tier 3 analysts, who handle the most challenging security issues and focus on proactively identifying and monitoring threats and vulnerabilities.

Prevent the next Cyber Threat

Bfore.AI patented AI technology combined with hyperscale observation infrastructure and modern APIs augment our customers security postures with Predictions.

Discover Predictive Cyber-Security

Book a live demo with our specialist to discover how Bfore.AI helps organization fight cyber threats with their patented technology.