IBM丨AI in cybersecurity: The promise of yesteryear is now reality

Written by: Sridhar Muppidi, IBM Fellow and Chief Technology Officer, IBM Security

Source: MIT

We've been debating the benefits of artificial intelligence (AI) to society for years, but it's only now that people are finally seeing its day-to-day impact. But why now? What will make AI in 2023 more impactful than ever?

First, consumer exposure to emerging AI innovations increases acceptance. From songwriting and image synthesis that were previously only imaginable, to writing university-level dissertations, generative AI has entered our everyday lives. Second, we have also reached an inflection point on the enterprise AI innovation maturity curve—and in the cybersecurity industry, this progress can come much faster.

The consumerization of AI and its application in security is creating the level of trust and effectiveness it needs to have real impact in security operations centers (SOCs). To shed more light on this evolution, let's take a closer look at how AI-driven technologies are finding their way into the hands of cybersecurity analysts.

Advancing speed and precision in cybersecurity through artificial intelligence

After years of experimenting and refining with real-world users, coupled with continuous advancements in AI models themselves, AI-driven cybersecurity capabilities are no longer just early adopter buzzwords, or simple patterns and rules-based capabilities. Data has exploded, and so have signals and unique insights. Algorithms have matured and become better able to contextualize all the information ingested -- from different use cases to unbiased raw data. For years, we've been waiting for the promise of artificial intelligence to arrive.

For cybersecurity teams, this means the ability to drive game-changing speed and accuracy in their defenses—and perhaps, ultimately, gain an edge in the fight against cybercriminals. Cybersecurity is an industry that inherently relies on speed and precision, both of which are inherent characteristics of artificial intelligence. Security teams need to know exactly where to look and what to look for. They depend on the ability to move quickly. In the world of cybersecurity, however, speed and precision are not guaranteed, mainly plagued by two challenges in the industry: a skills shortage and an explosion of data due to the complexity of the infrastructure.

The reality is that the finite number of people working in cybersecurity today carry an infinite number of cyberthreats. According to an IBM study, defenders far outnumber responders to cybersecurity incidents—68 percent of cybersecurity incident responders said it is common to respond to multiple incidents at once. In addition, more data than ever flows through enterprises, and enterprises are becoming more complex. Edge computing, IoT, and remote requirements are changing modern business architectures, creating a maze of significant blind spots for security teams. If these teams can't "see," then their security operations can't be precise.

Today's sophisticated artificial intelligence can help address these barriers. But to be effective, AI must earn trust—so we must put guardrails around it to ensure reliable safety outcomes. For example, when you go too fast for the sake of speed, the result is a runaway speed that leads to chaos. But when AI is trusted (i.e., the data we train our models on is unbiased, the AI models are transparent, not cheap, and explainable), it can drive reliable speed. When it's combined with automation, it can greatly improve our defense posture -- taking action automatically throughout the lifecycle of incident detection, investigation, and response without relying on human intervention.

The "right-hand man" of the network security team

A common and well-established use case in cybersecurity today is threat detection, where AI brings additional context from large and diverse data sets, or detects anomalies in user behavior patterns. Let's look at an example:

Imagine an employee mistakenly clicks on a phishing email, triggering a malicious download to their system, allowing the threat actor to move laterally and operate stealthily within the victim environment. This threat actor attempts to bypass all existing security tools in the environment while looking for monetizable weaknesses. For example, they may be looking for broken ciphers or open protocols to exploit and deploy ransomware, allowing them to seize critical systems as leverage against the enterprise.

Now let's put AI on top of this general scenario: the AI will notice that the user who clicked on that email is now behaving differently. For example, it detects changes in the user flow, and its interactions with systems it doesn't normally interact with. Looking at the various processes, signals and interactions that take place, AI will analyze this behavior and put it into context, which static security functions cannot.

Because threat actors cannot imitate digital behavior as easily as they can imitate static characteristics, such as someone's credentials, the behavioral advantages that AI and automation give defenders make these security capabilities even more powerful.

Now imagine that example multiplied by a hundred, or a thousand, or tens of thousands and hundreds of thousands, because that's roughly the number of potential threats a particular business faces in a given day. When you compare these numbers to today's average SOC team of 3 to 5 people, attackers naturally have an advantage. But with AI supporting SOC teams with risk-driven prioritization, those teams can now focus on the real threats amidst the noise. In addition, AI can help them expedite investigation and response -- for example, automatically mining data across systems for additional evidence related to an incident, or providing automated workflows for response actions.

IBM is bringing AI capabilities like these natively into its threat detection and response technology through the QRadar suite. A game-changing factor is that these key AI capabilities are now brought together by a unified analytics experience, spanning all core SOC technologies, making them easier to use across the entire event lifecycle. Additionally, these AI capabilities have been refined to the point where they can be trusted and act automatically with coordinated responses, without human intervention. For example, IBM's Managed Security Services team used these AI capabilities to automatically close 70 percent of alerts within the first year of use and accelerated their threat management timeline by more than 50 percent.

The combination of artificial intelligence and automation brings tangible benefits in speed and efficiency that today's SOCs desperately need. After years of testing, and as it matures, AI innovations can optimize defenders' use of time through precise and accelerated action. The more AI is leveraged across the security landscape, the sooner it will drive the ability of security teams to execute and the cybersecurity industry to be resilient and ready to adapt to whatever the future holds.