AI Is Coming for Cybersecurity

Episode transcript

Transcript provided for accessibility and search. Minor transcription errors may remain.

Opening

SPEAKER_00 0:00

We've spent quite a lot of time worrying about what AI is going to do to cybersecurity. AI-powered attacks, deep fakes, automated phishing, malware, autonomous agents, data leakage, prompt injection, and depending on which conference presentation you've attended recently, possibly the end of civilization sometime before lunch. All worth discussing, and we will. But there's another side to this. We've spent decades building cybersecurity environments that generate extraordinary

Maybe We Should Use Some of This Stuff

SPEAKER_00 0:32

amounts of information. Alerts, logs, vulnerabilities, threat intelligence, identity events, cloud findings, endpoint telemetry, emails, tickets, incidents, and dashboards. So many dashboards. Then we give all of that information to security teams and say, right, find the dangerous bit. Perhaps AI could help. Because before we spend an entire episode worrying about attackers using AI, I think we should ask a more useful question. What are we going to do with it? I'm Steve, and this is AI Security Multipliers. Today we're going to talk about how AI can actually make cybersecurity better. Not theoretically, not in a vendor demonstration where every alert is perfectly labeled and the attacker has thoughtfully left clues in the real world. Cybersecurity has always had a scale problem. The enterprise keeps getting bigger. More applications, more identities, more cloud services, more endpoints, more CIAs, more APIs, more third parties, more data, more vulnerabilities, more alerts. Unfortunately, the security team doesn't expand at quite the same rate. I've never attended a budget meeting where somebody said, cybersecurity

Cybersecurity Has a Scale Problem

SPEAKER_00 1:50

seems difficult, why don't we just double the team? If you have, I'd quite like an invitation to your next budget meeting. Instead, we've tried to solve the scale problem with technology. SIEM, SOAR, EDR, XDR, NDR, DSPM, CNAPP, and enough other acronyms to make cybersecurity increasingly resemble a particularly difficult game of Scrabble. All of those technologies can help, but they also generate information, and somebody still has to interpret it. That's where AI becomes interesting. Not because AI magically replaces the security team, but because it may allow the security team to operate at a scale humans simply can't. The opportunity isn't replacing expertise, it's multiplying it. If I were looking for places to introduce AI into a security organization, I wouldn't start with autonomous cyber defense. I'd start with the boring stuff. And I mean that as a compliment. Security teams spend enormous amounts of time doing work that is necessary but repetitive, summarizing incidents, reviewing alerts, collecting evidence,

Start With the Boring Work

SPEAKER_00 3:00

writing tickets, looking up assets, comparing configurations, reading vulnerability descriptions, creating reports, searching documentation, producing executive summaries, updating procedures, translating technical findings into language somebody outside cybersecurity might actually understand. AI can help with a lot of that today, and importantly, these are often relatively controlled use cases. A security analyst remains responsible for the decision. AI helps gather, summarize, and organize the information. Think of it as removing some of the administrative friction surrounding expertise. If a highly skilled security analyst spends 40 minutes assembling information that AI can assemble in 40 seconds, I'd rather have the analyst spend the other 39 minutes thinking. That's where the value starts. Not replacing the analyst, giving the analyst more time to be an analyst. The Security Operations Center is probably the most obvious example. A modern SOC can receive thousands, sometimes millions, of security signals. Obviously, not every signal is an incident. That's the problem. Something has to determine which ones matter. Traditional security automation has helped enormously

The SOC Is an Obvious Place to Start

SPEAKER_00 4:17

here. Rules, correlation, threat intelligence, behavioral analytics, machine learning. None of this suddenly appeared with generative AI, but generative AI adds another capability. It can help us reason across information. Imagine an analyst investigating a suspicious login. Instead of manually jumping between identity logs, endpoint telemetry, email security asset inventory, and threat intelligence, an AI assistant can help assemble the story. Who is the user? Is the device known? Where did the login originate? What happened immediately before it? What happened afterwards? Were there unusual mailbox rules? Was another identity involved? Is the IP associated with known malicious activity? Now give the analyst a timeline. That's useful. But there's an important distinction. I don't necessarily want the AI deciding that Steve is definitely compromised and immediately disabling everything I own, particularly on a Friday afternoon. I want AI helping the analyst get to a better decision faster. Assistance first. Autonomy later, where it makes sense. Threat hunting is another area I find genuinely interesting. Historically, threat hunting requires people who understand both the threat and the underlying query language. KQL, SQL,

AI Can Make Threat Hunting Conversational

SPEAKER_00 5:47

Splunk, SPL, whatever your environment uses. That's fine if you're a specialist, but natural language interfaces can dramatically lower that barrier. Instead of starting with syntax, an analyst might start with show me users who authenticated from two countries within an unrealistic period of time and then accessed sensitive applications. The AI can help translate that intent into the appropriate query. Now does that mean we blindly trust the query? No, we validate it because AI can produce very confident nonsense. Something cybersecurity professionals will recognize immediately, because we've been receiving very confident nonsense from humans for years. But think about what this does. A junior analyst can explore more sophisticated questions. A senior analyst can move faster. An incident responder can interrogate unfamiliar data sets. And specialists can spend less time remembering precisely where the bracket goes. That's a genuine productivity multiplier. Vulnerability management desperately needs this kind of thinking. Many organizations have tens of thousands of vulnerabilities. Large organizations

Vulnerability Management Needs Help

SPEAKER_00 7:03

can have vastly more. So what do we traditionally do? We assign severity, critical, high, medium, low. And then somebody produces a report explaining that we have 17,000 critical and high vulnerabilities. Excellent. What would you like me to do first? CVSS is useful, but severity isn't the same thing as risk. Is the asset exposed to the internet? Is exploitation occurring? Does the vulnerability affect something critical? Are compensating controls present? What privileges would an attacker gain? Is the vulnerable system actually reachable? Who owns it? What's the business impact? Now imagine AI helping combine vulnerability information with asset context, threat intelligence, exposure, identity, and business criticality. Suddenly vulnerability management becomes less about how many red things are on the dashboard, and more about which ten things should we fix today. That is enormously valuable. Security has never really had an information shortage. We've had a prioritization problem. AI may be very good at helping with that. Identity security is another fascinating opportunity. Think about the amount of identity information in a large

Identity Is Another Gold Mine

SPEAKER_00 8:22

enterprise. Users, groups, roles, entitlements, applications, service accounts, privileged accounts, authentication events, access requests, joiners, movers, levers, and increasingly non-human identities. We discussed in episode four how AI agents themselves need identities, but AI can also help us understand the identities we already have. Who has unusual access? Which permissions haven't been used? Which privileged accounts behave differently from their peers, which access combinations create risk, which service accounts appear to have no meaningful owner. Why does Bob in accounting apparently have administrative access to a development environment in Singapore? Maybe there's a perfectly good reason. There usually is. Well, sometimes there is. AI can help security teams navigate these enormous entitlement graphs and identify patterns that deserve human attention. Again, the important word is help. Identity decisions affect people's ability to do their jobs. We shouldn't remove access simply because a language model thought Bob looked suspicious. Poor Bob. But finding the question worth asking, that's exactly where AI can be useful. Now consider an actual incident. The first part of incident response is often an information problem. What happened? When?

Incident Response Gets Faster

SPEAKER_00 9:53

Which systems are involved? Which identities? What changed? What's the blast radius? What should we contain? What evidence do we need? And while all of this is happening, leadership understandably wants an update. Usually every 14 minutes, AI can help assemble timelines, summarize evidence, correlate events, suggest investigative questions, search previous incidents, draft status updates, map observed behavior to known attack techniques, identify gaps in the investigation, even help responders ask, what haven't we looked at yet? That's powerful, particularly under pressure. Because during a serious incident, the scarce resource isn't usually data, it's attention. If AI can reduce cognitive load and allow responders to concentrate on judgment, containment, and recovery, that's a significant improvement. But I'd still keep consequential actions controlled. AI can recommend isolating a server. A human may need to decide whether taking that server offline also stops payroll. Context matters. It always does. There's another use case that's less glamorous but potentially very valuable. Detection engineering. Security

AI Can Help Us Write Better Detection

SPEAKER_00 11:10

teams constantly need to create and improve detections. New attack techniques appear. Threat intelligence changes. Systems change. Cloud environments change. Attackers change their behavior. Writing high quality detections requires expertise and time. AI can help convert threat intelligence into candidate detection logic. It can explain unfamiliar detection rules, translate between query languages, identify potential gaps, suggest test cases, help document why a detection exists, and perhaps most importantly, help analysts understand what an existing rule is actually doing. Every mature security environment eventually acquires rules nobody wants to touch. The person who wrote it left three years ago. There's no documentation. The rule has a name like prod underscore final underscore final underscore v2 underscore do underscore not underscore delete. Nobody knows exactly what it does. But everybody knows that deleting it will somehow cause an outage in Belgium. AI won't solve organizational archaeology, but it might make it considerably faster. Email security is another obvious area. Attackers are already using AI to improve social engineering. We'll talk

Phishing Defense Gets Interesting

SPEAKER_00 12:32

about that properly in the next episode. But defenders have the same opportunity. AI can analyse language, context, sender behavior, conversation history, links, attachments, impersonation, business relationships. Imagine an email that looks perfectly legitimate in isolation. But the AI recognizes that the supposed CFO doesn't normally write that way. The request is unusual. The payment destination is new. The conversation thread has subtle inconsistencies. And the sender's infrastructure doesn't match previous communications. None of those signals individually proves an attack. Together they're interesting. This is where AI can add context that traditional filtering sometimes struggles with. And as synthetic voice and video improve, we'll increasingly need systems capable of evaluating more than whether something looks or sounds convincing. Because eventually, but it sounded exactly like the CEO, isn't going to be much of a security control. Here's one of my favorite uses: ask AI to criticize your own security architecture. Not literally

AI Can Attack Your Security Architecture

SPEAKER_00 13:45

attack production. Please don't email me afterwards saying Steve told us to let the chat bot loose on Active Directory. I did not. Given appropriately controlled AI system architecture diagrams, security standards, data flows, threat models, configurations, known risks. Then ask questions. Where are the trust boundaries? What assumptions are we making? What happens if this identity is compromised? What controls are missing? What paths might an attacker exploit? Which systems have excessive dependencies? What haven't we considered? This doesn't replace a security architect. It gives the architect another perspective. And unlike another architect, the AI doesn't become offended when you ask it to review the diagram for the seventh time. Although give it another couple of model releases. I'm not ruling anything out. Used properly, AI can become a very effective challenger. A second set of eyes, or perhaps several thousand sets of eyes compressed into a slightly overconfident assistant. Security awareness is another area ripe for improvement. Most organizations still give broadly the same training to everyone.

Security Awareness Could Finally Become Personal

SPEAKER_00 14:59

Here's phishing, here's passwords. Don't plug mysterious USB drives into your laptop. See you next year. But the risks faced by a software developer aren't identical to those faced by somebody in finance. An executive assistant faces different social engineering threats from a cloud administrator. AI makes personalized security education much more practical. Training could adapt to someone's role, the systems they use, the threats targeting their industry, even mistakes they're actually making. Imagine a short coaching moment immediately after someone reports a suspicious email, or contextual guidance when a developer is about to commit a secret, or targeted education when somebody receives a new privilege role. That seems much more useful than another 40-minute annual training video. And if we can finally retire the annual cybersecurity quiz asking employees whether they should send their password to a stranger, AI will already have made a significant contribution to civilization. Eventually we reach the harder question. How much should AI actually be allowed to do? We talked about this in episode 4.

What Should We Automate?

SPEAKER_00 16:10

There's a progression. Observe, analyze, recommend, assist, act with approval, act autonomously. Not every security process should stop at the same point. If AI identifies a known malicious file on an endpoint, perhaps automated containment is appropriate. If it wants to disable the CEO's account because of an unusual login, maybe let's have another look. The decision should depend on things like confidence, consequence, reversibility, and urgency. How confident are we? What's the potential damage if we do nothing? What's the potential damage if the AI is wrong? Can the action be reversed? How quickly does a human need to respond? This is where AI security becomes less about whether we trust AI and more about designing systems that don't require blind trust. That's a much healthier security model. There's something else we should probably say. AI isn't going to rescue a fundamentally broken security program. If

AI Won’t Fix a Bad Security Program

SPEAKER_00 17:14

you don't know what assets you have, AI doesn't magically create asset management. If identities are badly governed, AI doesn't magically fix identity governance. If your data is everywhere, AI doesn't magically classify it. If nobody patches anything, AI can produce a beautifully written explanation of all the vulnerabilities you're still not fixing. Possibly with bullet points. AI amplifies capability, but amplification works in both directions. Give AI good data, good processes, and good security telemetry, and it can become extremely useful. Give it fragmented tools, poor data, and unclear ownership. And it can help you misunderstand the environment much faster. This connects directly back to episode three. Your data matters. Context matters. Integration matters. AI is only as useful as the environment we're asking it to reason about. So don't start with we need AI in the SOC. Start with which security problem are we trying to solve? So what do you do on Monday? Don't begin by buying an AI security platform. Begin with your security team's

What Do You Do on Monday?

SPEAKER_00 18:23

time. Where are people spending hours doing work that requires information but not necessarily human creativity? Alert investigation. Incident summaries, threat intelligence analysis, vulnerability prioritization, query creation, detection engineering, documentation, evidence gathering, reporting. Pick two or three. Then ask, could AI make this faster without taking the final decision away from the person accountable for it? Measure the baseline. How long does the task take today? How accurate is it? What's the backlog? Then introduce AI in a controlled way and measure again. Did the analyst get faster? Did quality improve? Did we reduce repetitive work? Did we introduce new errors? That's how I'd evaluate AI and cybersecurity. Not by asking whether the demo looks impressive. Ask whether it made the security team meaningfully better. Because that's the objective. And now this week's multiplier. Ask every person on your security team one question. What task do you repeatedly do that you wish

The Multiplier

SPEAKER_00 19:35

you didn't have to? Not where should we deploy AI? That's the wrong question. Find the friction first. Maybe it's summarizing incidents, maybe it's investigating repetitive alerts, maybe it's writing detection queries, maybe it's vulnerability analysis, maybe it's producing the weekly report that everybody receives and nobody admits to reading. Pick one task, measure how long it takes, then see whether AI can reduce that time while keeping a human responsible for the outcome. If it works, move to the next one. You don't need an AI transformation program to start. You need a problem worth solving. Because the best use of AI and cybersecurity isn't replacing the people who understand the risk, it's multiplying what those people can accomplish. That's this week's multiplier. Cybersecurity has spent years dealing with asymmetry. Attackers only need one path in. Defenders have to protect an enormous environment. Attackers choose when to act. Defenders have to be ready all the time. Attackers automate. So do we.

Give the Defenders the Advantage

SPEAKER_00 20:42

And now both sides have AI. We'll spend the next episode looking at what that means for attackers. Because there are real concerns. AI can improve social engineering, accelerate reconnaissance, help analyze vulnerabilities, generate convincing content, and increasingly automate parts of the attack life cycle. But I don't think the right response is to assume the attackers automatically win. Defenders have something attackers often don't. Enterprise context. We have identity telemetry, endpoint telemetry, network telemetry, email telemetry, cloud telemetry, asset information, threat intelligence, business context, and decades of security knowledge. The challenge has always been turning all of that into timely decisions. AI may help us do that, so yes, AI is coming for cybersecurity. Good, let's use it. Let's automate the repetitive work. Let's help analysts investigate faster. Let's prioritize better. Let's improve detection. Let's reduce cognitive load. Let's give experts more time to think. And let's be thoughtful about where we allow AI to act autonomously. The future of cybersecurity isn't humans or AI. It's going to be humans with AI competing against attackers with AI. And I'd quite like our side to be good at it. That's it for this episode of AI Security Multipliers. If you found this useful, follow or subscribe to the show and share it with somebody working in cybersecurity, particularly someone who's still being asked to manually assemble the same security report every Friday afternoon. I'd also like to hear how you're actually using AI and security, not the vendor demonstration, not the strategy deck. What's genuinely working, what's saving time, what's turned out to be completely useless, and what are you still trying to figure out? Those are the conversations I want this podcast to have. Next time we're going to turn the tables, because unfortunately we aren't the only people who've noticed AI might be useful. We're going to look at how attackers are using it too. I'm Steve, and I'll see you next time.