In the past eighteen months, generative AI (gen AI) has gone from being the source of jaw-dropping demos to a top strategic priority in nearly every industry. A majority of CEOs report feeling under pressure to invest in gen AI. Product teams are now scrambling to build gen AI into their solutions and services. The EU and US are beginning to put new regulatory frameworks in place to manage AI risks.

Amid all this commotion, hackers and other cybercriminals are hardly standing idly by. They’re looking into using gen AI for doing everything from improving the grammar of phishing messages to exploring ways of faking video and audio to trick or extort money from victims.  They’re also looking for ways to attack the very AI models that businesses are busy investing in.

If you’re a CISO, or any security professional, the time to begin evaluating gen AI is now. In a recent white paper, IBM’s chief technology officer for security software, Sridhar Muppidi, outlined five key recommendations for evaluating gen AI’s use in defending against cyberattacks. Here’s a quick look at a few of those recommendations.

Use gen AI in threat hunting and response

As attackers increase their use of gen AI, Muppidi notes that their attacks will become pervasive, evasive, and adaptive. Security teams will need to adapt by using this technology for their own advantage. AI and machine learning can already make security teams more efficient.

For example, AI-powered security information and event management (SIEM) solutions can help analysts prioritize risks detected. They help minimize analysts’ focus on false positives and allow them to instead concentrate on the critical threats at hand. Gen AI-enabled solutions will do much more, including accelerating threat hunting through natural language searches, generating threat detection and response playbooks, and empowering analysts with natural language chatbots. All of these AI-driven solutions can alleviate human bottlenecks and make security far more efficient—responding faster and doing more with less.

Download the paper

Evaluate gen AI based on the time it saves defenders

CISOs and their teams can expect to be bombarded with a lot of product offers from security providers in the next year or two, all touting the advantages of their particular AI-powered technology. How do you sort through all these product descriptions and demos to zero in on what’s going to make the biggest impact for your Security Operations Center (SOC)?

We recommend focusing on time savings. Time is critical in every SOC. SOCs are famously understaffed. Analysts feel overworked and often frustrated. Anything that saves analysts time—whether it’s time spent manually investigating incidents, identifying false positives or writing incident reports—is worth moving to the top of your priority list.

Challenge gen AI providers on trust

When evaluating gen AI products, one aspect that is often not given enough attention is trust. Do you trust the provider selling you this cybersecurity solution? Does the provider have a framework for securing its AI data, model, and usage? Among the questions you should ask the provider:

  • What data was your model trained on?
  • How representative is that data of the data my SOC works with every day?
  • Can I evaluate it in my own environment to see how it performs before I adopt it?

As impressive as gen AI products seem today, and as presence permeates nearly every topic of conversation, this technology is still in its infancy—especially in the field of cybersecurity. New models and techniques are being announced every month. For that reason, it’s crucial you ask the provider about their own product goals. You should ask, point blank:

  • How much are you investing in the development of gen AI in your products?
  • Do you have a dedicated team evaluating and developing AI for cybersecurity?
  • Who else is using your TDIR solution?

As your organization adopts gen AI in its supply chain, customer service, marketing, HR, product development, and other operations, your attack surface will grow. So, you’ll need to use these same gen AI capabilities to secure your AI data, models, and usage.

The bottom line? When attackers are using gen AI, your best strategy is to fight fire with fire.

For a more in-depth look at Muppidi’s recommendations for adopting gen AI for cyber defense, download “5 criteria for evaluating generative AI in threat management.”

More from Incident Response

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

Why federal agencies need a mission-centered cyber response

4 min read - Cybersecurity continues to be a top focus for government agencies with new cybersecurity requirements. Threats in recent years have crossed from the digital world to the physical and even involved critical infrastructure, such as the cyberattack on SolarWinds and the Colonial Pipeline ransomware attack. According to the IBM Cost of a Data Breach 2023 Report, a breach in the public sector, which includes government agencies, is up to $2.6 million from $2.07 million in 2022. Government agencies need to move…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today