Artificial Intelligence for Cybersecurity

Not all cybersecurity labeled as AI is created equal. Multiple technologies fall under this banner, including machine learning and neural networks. These systems look for patterns associated with malicious behavior but use different algorithmic methods. AI can be applied at the endpoint levels and track activity on known sources of threats such as hacker groups and the dark Web. It can protect from threats “live” or merely improve the speed of signature updates that are centrally distributed.

The key to all types of AI in cybersecurity is data. AI’s benefit comes from its ability to analyze vast amounts of information about behavior across multiple domains, including endpoints, networks, and shared services. Machine learning can be applied to build models of “normal” behavior and then use these to detect anomalies in real-time. However, these can employ human-designed algorithms or self-training neural networks, which build models using deep learning across layered analytical nodes.

AI can also be implemented in a variety of ways. The main algorithm could be static, with endpoints using AI locally to detect new threats. Or they could use a distributed model, where this approach is combined with the ability to upload results to a central repository and download regular updates based on combined learning. This approach evolves protection based on data from all cybersecurity system users.

Just as cybersecurity is harnessing AI, so are cybercriminals, making it even more critical that the technology is constantly improved. The latest innovations focus on leveraging data science to continually win the arms race against cyberthreats, leveraging AI to improve their effectiveness.

Cybercriminals use AI to hide their payloads more effectively and to mimic authentic communications and traffic more closely in phishing attacks. Cybersecurity AI must be able to react to these threats to second guess the signs to continue providing protection.

Cybersecurity AI can automate risk mitigation and detection, providing a seamless healing process in the event of a threat. The area of risk prediction has plenty of room for growth, where AI takes the role of “white hat” hackers, finding potential weaknesses before the cyber criminals do.

In the future, autonomous AI will play an increasing role, decreasing the need for human supervision. Deep learning is leveraged by the most advanced cybersecurity AI solutions, employing neural nets rather than human-designed algorithms. These produce their innovation automatically.

The best cybersecurity systems make AI central to their offering, rather than merely adding it as an extra or plug-in. AI should be a core component rather than bolted onto an existing, traditional product.

It is also crucial that the AI cybersecurity features provide clear benefits rather than merely marketing. Ensure that the AI product provides its benefits as seamlessly as possible without interfering with employee productivity. It also needs to protect all devices in the fleet, including mobile and IoT, without causing performance and resource issues.

Because AI for cybersecurity improves as it learns, the more mature provisions will be better able to detect threats than newcomers. Cylance^® AI is already on its seventh generation, giving it years of training across billions of diverse threat data sets. More recently introduced cybersecurity AI will not have had so much training, making it less effective.

If your organization has implemented Zero Trust Security, you want cybersecurity AI that will fit into this framework. For example, it needs to work alongside the heuristic of Zero Trust for access and permissions adjustments.

Connected to this, consider how the AI is maintained. Does it run locally on the endpoint or exclusively in the cloud? Does it just improve signatures, or does it work in real-time to prevent threats as they occur? Does it require employee training to deploy, or is it relatively seamless? Finally, how often is the AI itself retrained?

The true test is how a solution fits with your organization in real life. You need to find out if there are the proper levels of aggressiveness for different scenarios, which users might need to adjust, and if the cybersecurity AI is as effective in offline scenarios as online. If it is offline, can it prevent zero-day malware without needing connectivity? This is the true test for cybersecurity AI: how much does it enhance your organization’s protection?