I lately gave a presentation at SecTor on proactive risk searching, which sparked some meaty conversations afterward on the present flooring. On the expo flooring, surrounded by “AI-first” security distributors, the CISOs and risk hunters I spoke with had been apprehensive. They’re apprehensive as a result of AI can elevate script kiddies into elite hackers with superior capabilities and legions of adversarial AI bots and we’re not ready for that — at the least, not but.
Whereas there’s little question AI holds nice potential for cybersecurity, in observe, it’s primarily getting used to automate what we’re already doing. For corporations to face an opportunity, we want new approaches to AI-powered protection, not optimized ones.
The asymmetry downside
Attackers have already got systemic benefits that AI amplifies dramatically. Whereas there are some nice examples of how AI can be utilized for protection, these strategies, if used in opposition to us, could possibly be devastating. For instance, XBOW is an autonomous pen-testing bot, created by a startup of the identical title. It’s a security product and a powerful one at that. This summer season, for the primary time in bug bounty historical past, XBOW’s autonomous penetration tester reached the highest spot on the HackerOne leaderboard for a number of months operating.
