Key Takeaways
- According to Capgemini’s 2019 report titled “Reinventing Cybersecurity with Artificial Intelligence”, network security is the most common use of AI in cybersecurity. 75% of the executives surveyed for this report said they used AI for network security purposes.
- Over 2/3 of the surveyed executives reported using AI to improve data security or endpoint security.
- The two most common benefits organizations experienced when using AI-driven cybersecurity tools were faster responses to breaches and higher breach detection accuracies.
Overview
A growing trend in cybersecurity is the incorporation of artificial intelligence and machine learning into products that detect and respond to threats. With AI and ML, large volumes of data can be analyzed quickly, allowing cyber threats to be identified and addressed in a timely manner, before they escalate into more serious issues. Given the cybersecurity job shortage, AI-powered cybersecurity tools are particularly useful for easing the workload off of cybersecurity teams, many of which are understaffed.Capgemini’s 2019 report titled “Reinventing Cybersecurity with Artificial Intelligence” describes current uses of AI in cybersecurity among organizations. The report contains survey results from 850 senior executives from American, Asian, European, and Australian companies in the consumer products, retail, banking, insurance, automotive, utilities, and telecom sectors.
Organizations’ Uses of AI for Cybersecurity-Related Purposes
The executives reported using AI for several aspects of their organizations’ computer system security. The various areas in which these executives have used AI for cybersecurity purposes are shown in the graph below:
75% of senior executives reported using AI for network security in their organizations for purposes such as network threat detection and response. For example, AI-powered intrusion detection systems (IDSs) generate alerts upon the identification of potential threats. Signature-based IDSs flag suspicious activity using known indicators of compromise (IOC). Behavior-based IDSs are trained on “normal” network traffic, and traffic that deviates significantly from this “normal” traffic is flagged as suspicious. AI-based security monitoring allows for efficient responses to malicious bots, malware, and other malicious activity.
Another widespread use of AI in cybersecurity is for data security, a use case reported by 71% of the senior executives surveyed. Several recent high-profile ransomware attacks and other cyberattacks involving the destruction and/or exfiltration of data have wreaked havoc for organizations. AI-driven cybersecurity tools can detect zero-day exploits, as well as ransomware and other forms of malware, allowing for swift responses to these threats before they result in the compromise of sensitive data.
68% of the senior executives surveyed reported using AI for endpoint security. Due to factors such as the increase in remote working and the widespread deployment of IoT devices, endpoint security has become a high priority for organizations. These AI-driven endpoint security platforms detect threats, gather information about them, respond to them in an automated manner, and provide guidance for users on how to address threats and prevent them from posing significant risks in the future. These tools can also provide recommendations on how to prioritize steps in the incident response process, as well as how to allocate resources and deploy staff members to carry out these remediation steps.
Between 1/2 and 2/3 of the executives reported using AI for identity and access security, application security, cloud security, and IoT security. AI-powered tools can use information about past user behavior to help prevent unauthorized access to user accounts, as well as assign the minimum privileges necessary for users to reduce the likelihood of attackers successfully moving through a network in the event that they successfully compromise user accounts. AI is also used to identify, respond to, and mitigate threats and vulnerabilities in applications, IoT devices, and cloud storage systems.
Benefits of Using AI-Powered Cybersecurity Products
Organizations reap multiple benefits from using AI-driven cybersecurity tools, as shown in the graph below:
The most commonly reported advantage of using AI in cybersecurity was the faster response to data breaches, which 74% of executives experienced, according to the Capgemini report. Timely responses to breaches and other cyberattacks are highly important for minimizing damage. For example, if a cyberattack is detected soon after it is initiated, the attack can be stopped before adversaries succeed in exfiltrating data, deploying malware, or conducting other malicious operations. As a result, sensitive data may remain protected, and organizations may avoid costs and reputation damages associated with large-scale cyberattacks. In fact, according to the Capgemini report, the cost reduction of breach detection and response was also a widespread advantage of AI-powered cybersecurity tools, with 64% of executives considering it to be a benefit.
The second most commonly reported positive effect of AI in cybersecurity was higher breach detection accuracy, which 69% of executives reported. Advanced AI tools with the ability to identify patterns in large amounts of data are able to distinguish between normal and suspicious network behavior with a relatively high accuracy.
60% of executives considered AI’s ability to improve cybersecurity analysts’ efficiency as a major benefit. By automating time-consuming tasks, AI-driven cybersecurity tools can ease the workload off of cybersecurity professionals, allowing them to allocate more time to other essential tasks that help keep organizations’ networks and data secure. With the use of AI platforms such as endpoint security solutions, cybersecurity analysts no longer need to examine vast amounts of data to detect evidence of threats. Instead, they can review these tools’ findings and use their skills and experience to make decisions based on these cybersecurity tools’ findings.
The Future of Cybersecurity in AI
AI has been used in multiple ways to improve cybersecurity, which has resulted in several benefits for organizations. Although we will likely continue to see adversaries devise novel types of malware and attack strategies, we can expect cybersecurity companies to continue to develop new cybersecurity products and improve existing ones. For example, with advances in machine learning, the accuracy and the quality of endpoint security platforms’ threat detection capabilities will likely improve. We will also likely see these cybersecurity products continue to adapt to the latest threats and cyberattacks so that they are better prepared to address them.
