AI IN CYBERSECURITY EVOLUTION
Security communities have been using AI for cybersecurity since at least the late 1980s, beginning with rules-based systems that triggered alerts based on predefined parameters. From the early 2000s, advances in machine learning – a subset of AI that analyses and learns from large data sets – enabled operations teams to better understand typical traffic patterns and user behaviour across organisations, helping them to detect and respond to unusual activity. The most recent development in AI is generative AI, which creates new content based on the structure of existing data. These systems can be interacted with through natural language, allowing security professionals to explore specific questions without needing to use a query language. However, AI is not used exclusively by security teams. Cyber attackers, including nation-state actors, large criminal enterprises, and individuals, are also exploiting AI for their own gain. Malicious actors may infect AI systems, use AI to impersonate legitimate users, automate cyberattacks, and employ AI to research and identify potential targets. Additionally, there is a growing risk of individuals unintentionally leaking sensitive data by pasting it into AI prompts.
HOW DOES IT WORK?
AI for cybersecurity functions by analysing vast amounts of data from multiple sources to detect patterns of activity within an organisation, such as user sign-in times and locations, traffic volumes, and the devices and cloud applications employees use. Once the system has a clear understanding of what constitutes typical behaviour, it can identify anomalies that may warrant further investigation. To protect privacy, the data from one organisation is not used to inform AI outputs at another; instead, AI relies on global threat intelligence aggregated from numerous organisations. Machine learning algorithms enable the system to learn continuously from the data it processes. When generative AI recognises known cyberthreats, such as malware, it can help to contextualise threat analysis, making the information more accessible by generating explanatory text or images. While human expertise remains essential in cybersecurity, AI enhances the capabilities of professionals, enabling them to detect and address threats more swiftly.
USE CASES
- Identity and access management
AI supports identity and access management (IAM) by analysing user sign-in patterns to detect and highlight anomalous behaviour for security professionals to investigate. It can automatically enforce two-factor authentication or prompt a password reset when specific conditions are met. In cases of suspected compromise, AI can block sign-in attempts to protect the account. - Endpoint security and management
AI assists security teams in identifying all endpoints in use across an organisation and ensures they remain up to date with the latest operating systems and security measures. It can also detect malware and other signs of cyberattacks targeting organisational devices. - Cloud security
With many organisations relying heavily on cloud infrastructure and applications from various providers, AI provides visibility into vulnerabilities and risks across multi-cloud environments. This enables teams to manage and secure their cloud assets more effectively. - Cyberthreat detection
AI is central to both extended detection and response (XDR) and security information and event management (SIEM) solutions. XDR monitors endpoints, emails, identities, and cloud apps for unusual activity and can either alert security teams or initiate automated responses based on pre-set rules. SIEM aggregates security signals across the enterprise, using AI to enhance visibility and support threat detection. - Information protection
AI helps security teams locate and classify sensitive data throughout an organisation’s infrastructure, whether on-premises or in the cloud. It can detect attempts to exfiltrate data and either block these actions or alert the security team for further investigation. - Incident investigation and response
In the event of a security incident, AI helps professionals sift through vast amounts of data to pinpoint relevant events and connections, significantly reducing the time needed for analysis. Generative AI further aids investigations by summarising findings in natural language and responding to questions in a human-readable format.
BENEFITS OF AI SECURITY
With the increasing volume of cyberthreats, growing data sets, and a constantly expanding attack surface, AI offers numerous benefits that enhance the effectiveness of security operations teams. It significantly improves the speed and accuracy of detecting critical cyberthreats by filtering through the thousands of logged events in tools like SIEM or XDR to identify those that genuinely pose a risk, especially those that may appear harmless in isolation but reveal threats when correlated with other activities. AI also simplifies reporting, with generative AI pulling information from multiple data sources to generate clear, concise reports that security professionals can easily share. Additionally, AI helps uncover vulnerabilities such as unknown devices, outdated systems, and unprotected sensitive data. By translating complex threat data into natural language, generative AI allows analysts with varying levels of technical expertise to understand threats more easily and respond effectively, supporting skill development across the team. Moreover, AI provides valuable cyberthreat insights by analysing behaviour across identities, devices, applications, and infrastructure, helping professionals prioritise the most pressing threats and respond with greater precision.
DETECTION AND PREVENTION
One of the most vital applications of AI in cybersecurity is cyberthreat detection and prevention, where machine learning algorithms play a key role in identifying and mitigating potential threats. Supervised learning models rely on labelled and classified data, such as the unique signatures of known malware, to train systems to recognise specific types of attacks. In contrast, unsupervised learning identifies patterns in unlabelled data, allowing AI to detect advanced or emerging threats that lack known indicators by flagging behaviour that deviates from the norm or resembles previous attacks. User and entity behaviour analytics further enhance detection by monitoring traffic patterns to establish baseline behaviours, helping to spot unexpected or suspicious activity that may suggest an account has been compromised. Additionally, AI systems utilise natural language processing to analyse unstructured data sources, such as social media, to generate real-time threat intelligence and enhance situational awareness.
AI SECURITY TOOLS
AI has been integrated into numerous cybersecurity tools to enhance their effectiveness across various domains. Next-generation firewalls, unlike traditional ones that rely solely on administrator-defined rules, use AI to access and analyse threat intelligence data, enabling them to detect new and evolving cyberthreats. AI-enhanced endpoint security solutions help identify vulnerabilities such as outdated operating systems, detect malware, monitor unusual data transfers, and isolate compromised endpoints to prevent further damage. AI-driven network intrusion detection and prevention systems monitor network traffic to uncover and block unauthorised users before significant harm can occur, processing data more rapidly and accurately than traditional systems. In cloud environments, where tracking threats across multiple platforms can be complex, AI analyses data from various sources to detect vulnerabilities and cyberattacks across the multi-cloud landscape. AI also plays a crucial role in securing Internet of Things (IoT) devices by identifying threats to individual devices and recognising suspicious activity patterns across large IoT ecosystems. Additionally, extended detection and response (XDR) and security information and event management (SIEM) solutions rely on AI to aggregate and analyse information from diverse security tools, log files, and external sources, turning vast amounts of raw data into actionable insights for security analysts.
AI CYBERSECURITY BEST PRACTICES
- Develop a strategy
Not every AI solution will suit your organisation. Focus on your most pressing security challenges and choose AI tools that align with your existing systems. A clear integration plan will ensure the tools improve, rather than complicate, your operations. - Integrate your security tools
AI works best when it can analyse data across your entire environment. Avoid tool siloes by using integrated solutions like XDR and SIEM or invest time in connecting existing tools to achieve full visibility. - Manage data privacy and quality
AI relies on high-quality, accurate data. Ensure your systems include processes for cleaning data and protecting privacy, as poor data leads to poor insights and decisions. - Continuously test your AI systems
Regular testing helps uncover issues like bias or degraded performance as new data is introduced, keeping your AI systems effective over time. - Use AI ethically
AI can reflect outdated or biased data, and its decision-making process isn’t always transparent. Avoid relying on AI for final decisions in sensitive areas and prioritise fairness and accountability. - Define policies for generative AI
Clearly communicate policies for using generative AI, especially around data security. Employees and partners should avoid entering confidential or sensitive information into AI prompts to prevent accidental data exposure.
THE FUTURE
The role of AI in cybersecurity is set to expand significantly in the coming years. Security professionals can expect AI to become more accurate at detecting cyberthreats while generating fewer false positives. As AI continues to advance, security operations teams will increasingly automate routine tasks, allowing AI to handle a broader range of cyberattack types. Organisations will also leverage AI to identify vulnerabilities and strengthen their overall security posture. Despite these advances, security professionals will remain essential and in high demand, taking on more strategic responsibilities such as investigating complex incidents and proactively hunting for threats. However, the use of AI is not limited to defenders. Cyber attackers are also investing in this technology. They are likely to use AI to crack large volumes of passwords, craft highly convincing phishing campaigns, and create sophisticated malware that is difficult to detect. As threat actors incorporate more advanced AI into their tactics, it will be even more critical for the security community to adopt and evolve their own AI capabilities to stay ahead.
