We’ve seen industries turned upside down with the emergence of generative AI (GenAI), and the mad dash companies have taken to leverage its powers continues over a year after ChatGPT’s debut to the public. Furthermore, since the advent of publicly available GenAI tools like ChatGPT, security professionals have become well aware of the cybersecurity risks associated with this technology.
While the National Institute of Standards and Technology (NIST) has provided its initial frameworks for AI in the past, via the “Artificial Intelligence Risk Management Framework (AI RMF 1.0),” emphasizing the crucial intersection of AI and cybersecurity, enterprises are currently fighting to achieve a workable synergy between the two concepts. The White House’s Executive Order around artificial intelligence (AI) in late 2023 raised more questions on how these enterprises can safely deploy and utilize AI. Still, there are avenues for business leaders today to achieve this synergy, formulate comprehensive defensive strategies and acquire business growth.
The Cybersecurity Playbook’s New Chapter
In 2023, we saw many conversations around AI and its impact on businesses: How it can improve productivity and efficiency, streamline operations and generate supplemental content. While many leaders are rightfully wary of the technology’s potential cyber risks, there’s an opportunity for synergy to bolster cyber defenses.
By augmenting security strategies with GenAI, not only can new levels of defense be achieved, but they can also match the pace with evolving AI-driven cyberattacks. Security processes such as behavior monitoring, summarizing security events, identifying potential vulnerabilities and threats, and other day-to-day procedures no longer need to take time away from security professionals. Instead, GenAI can supplement risk management processes in industries that often see high numbers of breaches, such as health care, finance and manufacturing. Machine learning (ML) algorithms can even analyze data patterns identifying abnormal or risky behavior that often precludes data theft.
As of April 29 this year, the NIST has released a draft publication based on its AI Risk Management Framework (AI RMF) to help manage the risks of GenAI, such as the resiliency and security of AI models, privacy concerns and bias management.
The framework was developed from feedback collected from public comments, workshops and other opportunities where experts provided their thoughts after the White House Executive Order on sections such as:
- EO Section 4.1 focused on “Developing Guidelines, Standards, and Best Practices for Safety and Security.”
- EO Section 4.5 on “Reducing the Risk of Synthetic Content.”
- And EO Section 11 on “Advanc[ing] responsible global technical standards for AI development.”
AI-Driven Attacks: Building a Comprehensive Defense
Teams that lag on AI adoption and integration may also be at an increased risk of data breaches. IBM’s 2024 X-Force Threat Intelligence Index indicates that GenAI is already utilized among threat actors. According to the IBM report, AI and GPT mentions have been observed in over 800,000 dark web and illicit market online areas.
Cyberattack efforts such as ransomware and phishing campaigns also see a dangerous boost in credibility with AI’s help. One major AI-driven deep fake phishing scam already saw success earlier in 2024 as a finance employee at a multinational firm fell victim to threat actors deploying the technology, resulting in a 25 million dollar payout to the fraudsters.
Threat actors actively seek ways to abuse AI and overcome the current defenses, making it crucial that the foundations for a comprehensive defense with strong guardrails are set now.
Cybersecurity: GenAI Synergy
Strong foundations and guardrails to integrating GenAI will mean distinguishing between a strong defense and synergy or an easily penetrated network.
The cornerstones of the relationship between AI and cybersecurity must be built on core capabilities like forensics, AI governance and employee training. Organizations can lay this groundwork to improve internal AI monitoring, track and retain historical AI use for reporting purposes, and ensure employees have the tools and education to support responsible AI use.
Furthermore, the learned GenAI insights from this level of visibility will ultimately cultivate roles such as the chief artificial intelligence officer (CAIO). As organizations and their leaders move toward leveraging GenAI for their purposes, the CAIO will ensure the synergy flows appropriately and can be harnessed for innovation.
As both organizations and malicious actors race to implement GenAI into their workflows, it’s undeniable that enterprises must begin embracing the natural synergy between AI and cybersecurity. Augmenting security processes boosts security layers by streamlining arduous tasks and automating risk management, making AI the inevitable next chapter in any cybersecurity playbook. However, these same enterprises must lay the correct groundwork for GenAI to utilize this synergy appropriately.
