Fighting Back Against Cyberattackers: How to Counter AI with AI

Cyberattackers are increasingly leveraging artificial intelligence (AI) and machine learning (ML) to execute more advanced and sophisticated threats, amplifying the scale and impact of their attacks. As a result, the perception among many organizations is that they see the scales tipping in favor of the attackers. In fact, a recent Enterprise Strategy Group survey noted a sobering statistic: 76% of organizations believe adversaries benefit the most from generative AI (GenAI), while only 24% think defenders have the upper hand.

To change this perception, organizations must adopt a proactive AI-driven defense strategy. This includes developing an AI-integrated cybersecurity plan and implementing business-aligned tactics to counter the growing AI-powered threats.

Strategies for Leveraging AI in Cybersecurity: Choosing the Right AI Models

Understanding and navigating the complexities of AI can be daunting even for seasoned IT professionals, security experts, and data scientists. The constant state of change in AI methodologies, technologies, risks, and requirements means that deeply specialized knowledge is essential to leverage AI’s full potential in cybersecurity.

GenAI stands out among the various forms of AI as the most-talked-about option as well as the most widely adopted in cybersecurity. GenAI’s ability to simulate and train on cyberattacks has captured significant attention, making it a crucial tool for enhancing cybersecurity measures. Predictive AI is another emerging approach, helping organizations pinpoint when and where attacks are most likely to happen due to its pattern recognition capabilities. Also, causal AI is gaining momentum because of its ability to map relational patterns between cyberattacks and responses; this allows security teams to anticipate and counter threats with unprecedented speed.

But perhaps the most exciting strategic AI commitment may be Precision AI^™. This framework helps create trustful AI outcomes empowering organizations to make mission-critical decisions with confidence. Precision AI uses rich data, honed from years of data capture and analysis by Palo Alto Networks tools and systems to create a security-specific model. This proprietary model is the key to automatically and intelligently detect, prevent, and remediate potential threats.

An important part of Precision AI is its ability to handle these requirements using contextually relevant data. This contextual relevance makes Precision AI a purpose-built AI model for cybersecurity. By combining generative AI, deep learning, and machine learning, Precision AI identifies and utilizes the right data for exactly the right use cases, including threat detection, anomalous behavior analysis, and Zero Trust implementations.

In addition to identifying and implementing the right AI model, an organization’s AI-powered cybersecurity strategy should include:

• Continuous monitoring and threat detection: Implement AI-driven tools that offer real-time monitoring and detection of emerging threats.
• AI-specific governance: Establish clear governance policies to manage AI applications, ensuring compliance and reducing risks.
• Data integrity and protection: Secure sensitive data used in AI training and operations against leaks, poisoning, and unauthorized access.
• Model auditing and validation: Regularly audit and validate AI models to ensure accuracy, fairness, and robustness against adversarial attacks.
• Human-AI collaboration: Foster a security culture that integrates human expertise with AI capabilities for more effective threat management.

Developing and implementing these strategic steps can’t be left solely to the chief information security officer (CISO) and their team. Cybersecurity is a collective effort, requiring vigilance and input across the organization, including even nontechnical stakeholders. Effective AI strategies for cybersecurity must have the unwavering support and active involvement of the C-suite and board members. Creating a collaborative approach ensures that decision-making is well rounded and not unduly influenced by any sole perspective; this is critical for ensuring a comprehensive cybersecurity approach.

Tactics for Using AI Against the Other Side: Use Cases That Make a Difference

Even when all sides come together, there still are many tactical questions that need to be answered. For instance:

• Should an organization build its own model using its own data, or is it more expeditious to use a third-party, off-the-shelf model?
• Which software tools, frameworks, and methodologies are best?
• Is the right AI infrastructure in place to support compute-intensive applications?
• Are budgets sufficient in size, scale, and flexibility (remember, new AI advances are appearing daily)?
• Does the cybersecurity team possess the appropriate experience and expertise to understand AI-powered threats and leverage AI for more efficient and effective cybersecurity?
• Is there a full understanding of where AI is already being used inside the organization, including “rogue AI” efforts that are surreptitiously launched without official knowledge, backing, and support?

Addressing each of these questions from a tactical perspective is essential in using AI for good in cybersecurity. But perhaps the key tactical decisions to get the most from deploying AI for cybersecurity come down to selecting the most appropriate “high gain” use cases and applications. According to industry researcher Enterprise Strategy Group, AI already is invaluable in use cases that “improve security team productivity, accelerate threat detection, automate remediation actions, and guide incident response.”

One of the key benefits in using AI for a wide range of use cases is its ability to limit and even overcome the negative effects of both the cybersecurity skills gap and the AI skills gap. Each on its own has been a major drain on organizations’ efforts and a bottleneck in getting the job done right. Filling in those two gaps has created a challenge of Grand Canyon-esque proportions, requiring executive commitment to allocating the proper resources.

This doesn’t mean that organizations should jettison their hiring plans for both AI experts and cybersecurity engineers simply because AI adoption provides tangible benefits. Plenty of both will still be needed, but leveraging the key AI use cases for cybersecurity will rely heavily on the technology’s innate automation and contextual awareness.

Here are a few specific use cases where AI will make a big difference in cybersecurity effectiveness (getting the job done in any way possible) and, especially, efficiency (doing so as quickly, frictionlessly, and cost-efficiently as possible) that should be in the consideration set for your tactical plan:

• Advanced malware detection: Cybercriminals are getting more creative in their use of AI to create and launch malware attacks. Cyber defenders, on the other hand, can use signature-based detection to extend the capabilities of traditional antivirus software, using signature data that leverages data on emerging threats.
• Threat intelligence: Even though most organizations subscribe to one or more threat intelligence services, the impact of AI on hackers’ ability to introduce new threats faster than ever means threat intelligence tactics must similarly move ahead. AI provides more accurate and precise data analysis based on huge data volumes, as well as offering predictive analytics to spot problems before they emerge and to have the right response and remediation plans in place.
• Real-time threat monitoring: Continuous monitoring of system logs, network traffic behavior, user activity, and security infrastructure health is essential and AI makes that an integral part of overarching cybersecurity frameworks.
• Anomaly detection: AI algorithms—especially those with contextual awareness, such as Precision AI—are great at rooting out and surfacing abnormal, unexpected data or user behavior that could signal a vulnerability, threat, or active attack.

Next Steps Toward Successful Use of AI in Cyberdefense

While many organizations are already taking steps to use AI for cybersecurity-related use cases, the strategies and tactics are fluid, dynamic, and always changing. But here are a few tips to help you get started—or to improve your chances of success:

1. Cybersecurity is a strategic initiative, so AI-powered cybersecurity absolutely must be a critical aspect to an overarching cybersecurity framework.
2. Don’t wait to get started. If you haven’t put a plan in place, you’re already way behind the curve, and your risk profile is expanding by the minute. Conveying a sense of urgency is critical throughout the organization, including at the C-suite level and with the board of directors.
3. Make sure you have the right people on the strategy team. They should represent the full spectrum of the organization, not just the technical side. And strategy development must include representatives from business units, such as sales, marketing, legal/compliance, finance, and operations.
4. Your strategic plan for AI in cybersecurity should be a living document, evaluated and updated regularly and frequently to reflect the breakneck pace of technological improvements and the frightening speed with which new AI-powered attacks are launched.
5. Don’t try to boil the ocean when it comes to use cases. Especially in your early stages of introducing AI for cybersecurity, pick a few use cases that will be relatively easy to implement and learn from, balanced with a handful of more challenging but big-impact use cases that really move the needle toward cybersecurity resilience.

Learn more about how to fight AI with AI at paloaltonetworks.com/precision-ai-security.