Are Businesses Ready to Defend Against AI-Powered Cyberattacks?

BIZTECH: IDC predicts that soon, detection and response playbooks will be generated dynamically at the time an alert created. How will that work?

When you’re talking about the dynamic playbooks, that is forward-looking. It’s happening now, but not yet in a personalized way. In the next iteration, I would say in the next three years, we’re going to see personalized playbooks based on telemetry from that organization’s existing environment captured on the fly, in real time.

Right now, playbooks aren't updated as frequently as they should be. It may be a once-a-year project, if that. Well-resourced organizations probably set aside dedicated time to review and update playbooks. But for the most part, they languish until they’re updated on an as-needed basis.

The hope is that for dynamically updated playbooks, first there’s going to be real-time identification of a vulnerability or exploit. And that’s pretty cool because the exploits are always changing and advancing. We have new ones all the time. By collecting telemetry, AI helps define what a healthy environment should be.  Any deviation from that healthy environment is then picked up. So, you’re layering algorithmic statistical modeling on top of the security posture.

The dynamic playbook in its envisioned state doesn’t exist at this moment in time. We do have remediation playbooks that come up as suggestions, but they’re not tailored to the organization. So, right now, if you’re using Google, if you’re using CrowdStrike, if you’re using Palo Alto, they’ll present you with a vulnerability and then present you with suggested steps for remediation. The future, based on discussions we’ve had with IT companies and security companies, is that the playbook will be tailored to your specific environment and exactly what parameters you need to best address and your business priorities.

EXPLORE: Learn about these threat and vulnerability management solutions.

BIZTECH: These AI systems know everything about your business once they’re embedded. They really are able to say, “Oh, this is what you should be doing.”

We’re not quite there yet. That’s the desired state: “The AI knows my whole enterprise, and we’ve mapped out all of our protocols to this existing AI platform. We’ve got guardrails. We’ve got policies in place that the AI is honoring.” All of that is still very nascent. I don’t know any organization that I would say they’re a standout example of AI integrated throughout the enterprise.

Security posture and telemetry will be dependent on how integrated AI is in your systems. If you’ve left out shadow data repositories or if you don’t even know where they are or you’ve got shadow AI still in your environment? Executing on this assumes that you’ve done due diligence on securing the enterprise first and then securing AI second. And that you have a robust identity management too.