2 (Realistic) Ways to Leverage AI In Cybersecurity

If you had to choose a security measure that would make the most difference to your cyber program right now, what would it be?

Maybe you’d like to get another person on your team? Someone who is a skilled analyst, happy to do routine work and incredibly reliable. Or perhaps you’d prefer an investment that would give your existing team members back more of their time without compromising your ability to find and fix threats?

What about human intelligence without human limitations? This is the promise of artificial intelligence (AI) in cyber security. And it’s something more security leaders are keen to achieve:

The market for cyber security tools that use AI is predicted to grow at 21% annually.
The cost benefits of deploying AI can be higher than those achieved by appointing a chief information security officer.

But effective use of AI in cyber security is not a given. Although more vendors use “AI” or “machine learning” to market their antivirus (AV), endpoint detection and response (EDR), and network detection and response (NDR) products, AI technology and AI systems are not a magic bullet. Buzzwords don’t solve cybersecurity problems or stop cyber attacks.

Research from the wider economy reflects this point. According to Accenture, only 12% of companies are AI “achievers,” i.e., gaining actual business results from using AI within their organisations.

Cybersecurity is no different. To add value to a cybersecurity use case, an AI algorithm must understand the problem it has to solve, receive high-quality data, and have enough connectivity to understand your network properly.

Here’s a short overview of two strong cybersecurity AI use cases where you can immediately find real benefits, the core challenges your AI cybersecurity deployment needs to overcome and how SenseOn uses AI to reduce cybercrime risk.

Use Case 1: Cyber Threat Detection

Machine learning-powered solutions like user and entity behaviour analytics (UEBA) can spot advanced and zero-day threats that signatures-based solutions miss.

This is important because more cybercriminals and hackers use polymorphic, evasive or signatureless malware. It’s not enough to use more rules or detection patterns.

With many alerts being false positives, it is already almost impossible for EDRs and security information and event management (SIEM) solutions to pick out adversarial and threat signatures from the “noise” of surrounding code and processes.

Fortunately for anyone responsible for IT security, even highly obfuscated threats still use recognisable techniques. UEBA and other AI-powered threat detection solutions can map user behaviour and network traffic to frameworks like MITRE ATT&CK to spot them (learn how you can automate the ATT&CK framework).

Instead of spotting malware hooks or relying on rules to see security threats, AI can notice suspicious behaviour such as large file uploads or strange command line arguments. This means that solutions like UEBA can stop advanced malware, file-less attacks, and insider threats that are otherwise impossible to detect.

Studies show that AI can increase detection rates to 95%, beyond the 90% typical of signature-based solutions.

Use Case 2: Incident Response Automation

Detection without response is only half the battle. Even if a security solution could detect every single incident of threat behaviour in a network, security teams still need to respond to incidents.

Learn more: Why your SOC needs an automated incident response

AI and machine learning can supercharge cybersecurity professionals’ incident response capabilities. AI can analyse millions of data points and provide security teams with two next-generation cybersecurity incident response capabilities.

Automated response

More complex networks and IT environments mean that even highly accurate threat detection solutions will highlight an increasing number of false or non-threatening behaviour as potential threats. Many of these alerts will require minimal investigation, but for the minority that doesn’t, time is of the essence.

During an attack chain (for example, a ransomware incident), the speed at which you can isolate a compromised endpoint or server is critical for reducing damage.

AI can sort time-critical scenarios from mundane alerts and respond accordingly. Machine learning algorithms can perform real-time actions to reduce the blast radius of genuine threats while minimising downtime during an investigation.

AI can automatically address time-consuming tickets and stop serious incidents without human intervention.

Detailed analysis

AI can gather information about malicious activity much faster than traditional solutions or human analysts.

An AI solution can correlate logs from across endpoints, network security systems, and servers into a format that is easier for security teams to understand. Delivering smart context can dramatically improve the mean time to respond (MTTR).

A 2019 survey by Oracle highlighted how over 80% of companies that use AI said their response time could be measured in hours or minutes. Only 60% of companies that do not use AI could say the same thing. Since then, AI technology has dramatically improved, and this response time gap is likely much larger.

Overcoming AI Cyber Security’s Biggest Limitation

An old saying goes, “Rubbish in, rubbish out.” Even the most incredible AI models and algorithms are only as good as the data sets they process.

Data quality, which generally means fitness for use (i.e., how well data serves the purposes of a user), can make or break an AI solution’s ability to improve a security posture. Poor quality data results in inaccurate results, slower response times and an overall loss of trust in an AI solution’s capability.

The quality of the data used by AI in cybersecurity applications is often compromised by factors like poor software implementation or gaps in data collection due to a lack of integration. These limitations are common in cybersecurity AI implementations that only cover small sections of an organisation’s digital estate or use data created by multiple-point sensors.

To overcome them, data must come in a universal format and be collected from across an organisation’s estate.

Getting Started with AI In Cyber Security

SenseOn’s unified cybersecurity solution uses AI to remove alert exhaustion, automate the process of identifying advanced malware and intrusion indicators, and accelerate incident response.

We know that implementing AI can be a minefield for security professionals. Security teams need solutions that collect high-quality data from their estates and use deep learning to make sense of it. This is what SenseOn does.

We built SenseOn as an AI solution from the ground up. The data SenseOn’s security platform uses come through a single Universal Sensor deployed across endpoints, servers and cloud environments. With a powerful AI algorithm and the ability to use deep learning processes, SenseOn can deliver incredible fidelity and telemetry.