1.5 Leveraging AI in Cyber Defense

Every login, file download, web request and connection on a network creates a digital event, and a busy network logs millions of events every day. Hidden somewhere in that pile may be the handful that show an adversary at work. No team of humans can read every event carefully, so attacks can slip by unnoticed.

This is where AI helps. AI-powered tools can be trained on examples of normal and malicious activity, then quickly sort new events into likely malicious and likely harmless. Sorting events by how urgent they are is called triage, the same word hospitals use for deciding which patients to see first.

Once an AI tool flags something as likely malicious, it can be set up to do one of two things:

• Alert a person. The tool notifies the security team, who investigate and decide what to do.
• Take corrective action on its own, based on the type of activity. For example, it might lock an account after a burst of suspicious logins, or cut a laptop off from the network if it starts behaving like ransomware.

The faster defenders spot an attack, the less damage it can do. An attacker who goes unnoticed for weeks has time to steal data or spread to more devices. One caught in minutes may be stopped before they reach anything valuable. By shrinking the time between the attack and the response, AI tools help prevent loss, harm and destruction to systems and data.

Defenders also use AI to improve their defenses before an attack happens:

• Checking how things are set up, such as firewall rules and who has access to what, and suggesting safer settings. Before any change goes in, a security technician who knows the system should look it over.
• Reading through an app's code to find weak spots and proposing fixes. A programmer who understands the code should approve each fix first.
• Drafting new rules for automated detection tools. A detection engineer should check each rule before it goes live.

AI can be wrong in confident-sounding ways. A suggested firewall rule might block a service the business depends on, or open a hole the AI didn't notice. A suggested code fix might break the program or add a new bug. A badly written detection rule might flood the team with false alarms. Human review catches these mistakes before they cause harm.