Why CISOs Are Investing in AI-Native Cybersecurity

Originally published by Abnormal Security.

Written by Mick Leach.

Artificial intelligence is full of promise. By leveraging machine learning to replicate human intelligence, AI has considerable potential to make our lives easier by empowering us to simplify and even automate complex tasks.

But as with every technology, AI is a double-edged sword. What can be used for good can also be used with malicious intent.

Chief information security officers (CISOs) recognize how attackers use AI for malicious purposes and are investing in AI-native cybersecurity to protect themselves in this evolving threat landscape. By adopting good AI to protect organizations, CISOs can keep a step ahead of threat actors and their bad AI.

Here’s a look at the various applications of AI and why CISOs across the globe are implementing AI-native security solutions.

The Dark Side of AI Exploits the Human Element

AI tools have skyrocketed in popularity and availability over the past year. This is an exciting time for people and businesses who are finding all sorts of interesting use cases for the technology. Unfortunately, bad actors have their own ideas. In fact, 91% of cybersecurity professionals report that they’re already experiencing AI-powered cyberattacks.

Legitimate AI tools have built-in safeguards to prevent the technologies from being used for malicious purposes. But these barriers are easy to circumvent by simply rewording the prompt. And several AI tools—such as WormGPT and FraudGPT—have emerged for the express purpose of cyberattacks.

Threat actors are now able to craft high-quality and convincing email attacks in a matter of minutes. These AI-generated phishing attempts and social engineering scams easily bypass traditional secure email gateways (SEGs), which means in organizations using a SEG, employees are the last line of defense.

This is bad news since humans are the weakest link in the security chain. Indeed, a staggering 74% of breaches involve the human element. This includes clicking on malicious links, falling for social engineering scams, using weak passwords, and opening suspicious attachments.

The fact is that people make mistakes, and enterprising attackers know how to exploit human psychology for their own ends. Even if employees are trained to spot common red flags like misspellings, grammatical errors, or inappropriate tone, threat actors can use generative AI to produce error-free copy that is almost indistinguishable from legitimate communications.

Taking Attack Sophistication to the Next Level

Attackers can also quickly research a company, its workforce, and professional relationships through an AI-powered search engine like Google Bard and then input the results into a generative AI tool. If the attacker has access to previous content written by an employee, they can draft an email that mimics that specific individual’s tone nearly flawlessly.

In light of this, it’s no wonder why AI-powered phishing attacks have increased by 47%.

“Generative AI poses a remarkable threat to email security,” says Karl Mattson, CISO at Noname Security. “The degree of attack sophistication will significantly increase as bad actors leverage generative AI to create novel campaigns.”

Generative AI tools help attackers research targets and craft messages quickly, which means they can rapidly scale their attacks like never before. Clearly, organizations need to confront these challenges head-on and fight fire with fire.

In other words, security leaders need to leverage good AI to stop bad AI.

Using Good AI to Combat Bad AI

The rules- and policies-based system employed by SEGs is only triggered by known indicators of compromise like suspicious URLs and malicious attachments. With the rise of both social engineering tactics and the use of generative AI, it is now nearly impossible for traditional solutions to stop modern threats.

If cybercriminals are using AI to launch more sophisticated attacks, it only makes sense to incorporate AI into cybersecurity. “The bad guys are innovating, so we have to be at the forefront of security to mitigate our risks and prevent these advanced attacks,” says John Mendoza, CISO at Technologent.

AI-native cybersecurity solutions utilize a powerful approach to addressing evolving threats. Sophisticated email security solutions leverage machine learning and behavioral AI to baseline known-good behavior and identify anomalies. By employing identity modeling, behavioral and relationship graphs, and in-depth content analysis, the system can automatically detect and flag emails that seem suspicious.

This innovative technology takes into account a wide range of factors—including internal and cross-organizational relationships, geolocation, device usage, and login patterns—in order to detect malicious activity, even in cases where traditional indicators of compromise are absent.

AI-native solutions proactively identify, flag, and remediate threats before they hit employee inboxes. This significantly enhances the security of organizations that would otherwise rely on SEGs or the employees themselves to prevent attacks—both of which fall short of adequately defending against bad actors.

“We needed something that will not only use machine learning to detect these advanced attacks but also use content and behavioral-based modeling of AI and some recognition patterns that can be used to trace advanced attacks,” says Tas Jalali, Head of Cybersecurity at AC Transit.

Navigating the Evolving Threat Landscape with AI

Since email is one of the primary channels for business communication and accessing other accounts, it will continue to be a popular target for threat actors.

Additionally, most organizations rely on cloud-based email platforms that integrate with a high number of third-party applications. This massively expands the attack surface area security teams need to defend. AI is the super-powered sidekick helping security teams do what they do best.

The threat landscape is constantly evolving, and the popularity of AI is a paradigm shift in how cybercriminals and cybersecurity professionals operate in this space. AI-native email security proactively detects malicious emails, improves the speed of remediation, and shifts the responsibility of identifying suspicious messages away from employees.

AI might be a dangerous tool in the hands of threat actors, but it’s an even more powerful tool for CISOs working to protect their organizations. Thus, adopting AI-native solutions to stay ahead of the bad guys is imperative for every organization.