The cyber threat landscape has been evolving continuously. According to CNN, US banks reported more than $1 Billion in potential ransomware payments in 2021 (more than double the amount from the previous year). Another report by Statista says, "During the second quarter of 2022, internet users worldwide saw approximately 52 million data breaches". Advanced threats such as ransomware, coin miners, trojans, and zero-day and persistent threats are a reality today. More often, the attacks nowadays carry stamps of adversary nation-state-sponsored espionage and disruption over an extended time. The number of security events has also doubled quarter on quarter. 

COVID-19 worsened the already struggling security readiness and posture. In this pandemic-bolstered digitization, most organizations had to adopt cloud, BYOD, and VPN; in an accelerated manner. New perimeters of attack like endpoint security, Cloud, and identity-based breaches came into vogue. Cyber-attacks on enterprises have impacted the Brand, Compliance, Assets, and Business Continuity of the enterprise. Customers take a flight to the competitor's environment when they learn about the breaches. The company share takes a tumble in the markets leading to an erosion of shareholder value. The Denial- of-Services keep adding pressure to the enterprise operations as time passes.  

Multiple point products & technologies that are used currently (for detection, protection, and remediation) in cyber security are ineffective and messy, leading to these numerous attacks. Instead of a meshed architecture, ‘Security Mess’ prevails. Existing and evolving technologies generate security data in various structured and unstructured formats from multiple places. It leads to data sprawl. Lack of Enterprise-wide view of security, compliance, and response cause 'visibility mess'. If you look at the context of how enterprise function from their infrastructure perspective, variety, volume, and velocity along with dependence on traditional rules-based engines or analyst-driven incident detection, makes it extremely slow, leading to 'Poor and Ineffective Response'. According to the Ponemon Report, it takes over 270 days to identify a breach and over 90 days to respond.  

So, Is there a better way? 

 Attackers know how to use AI to get better at cyber-attacks. To counter an AI-based attack, enterprises need to augment or replace their legacy technologies with state-of-the-art AI-based platforms, products, and services to protect, prevent, detect, respond, and mitigate. 

What does AI in Cybersecurity do? 

Gartner mentioned that the solutions driven by AI integration, attack prioritization and remediation, and are the fastest-growing areas.  

Benefits of using Artificial Intelligence in Cybersecurity 

• Super quick processing of data (irrespective of the volume): CISOs can leverage the power of Cognitive AI to automatically investigate Indicators of compromise (IOC) and gain critical insights that can be seen by them on an interactive, real-time dashboard. 
• Identifying threats, known & unknown: The AI algorithms feature capabilities like self-analyzing attack behaviors and patterns to detect and thwart advanced threats. CISOs can get contextual analytics & benchmarking that makes sense.  
• Lesser false positives and white noise: The AI algorithms offer better accuracy and reduce the number of false positives. It helps combat alert fatigue within security teams, reduces analyst workload, and saves valuable time – improved Mean time to respond and resolve. 
• AI aids accurate Detection and faster Response times: Technologies like SOAR (Security Orchestration Automation & Response) which are mapped to MITRE ATT&CK framework that use TTP (Tactics, Techniques, and Procedures) ‘Orchestrates, Integrate, and Automate’ hundreds of time-consuming, repetitive and complicated response actions, that previously required human intervention.  
• Business Continuity: Use of Autonomous AI based Threat hunting capabilities ensures business continuity 

Cybersecurity and AI in 2023 

Cybercrime as a service will increase radically with “Developer-(using more sophisticated AI tools), Affiliate-Money Launderer” working as a consortium to attack the hapless victim with ransomware, stealing, exposing confidential data, and leveraging precious infrastructure for coin-miners.  

Pharma/Healthcare industries, BFSI, Manufacturing, Retail/Logistics, eCommerce, Education, IT & IT-enabled services will all be on the cyber attackers' RADAR in the coming year. 

According to PwC’s annual Global Digital Trust Insights – India edition, 82% of corporate leaders anticipate raising cybersecurity budgets in 2023 to counter the evolving threat landscape. The worldwide market for AI-based cybersecurity products is estimated to reach $133.8 billion by 2030, up from $14.9 billion last year.  

Conclusion 

As they say, ‘Prevention is better than cure’. AI will help 'shift left' the attack kill chain and avoid the irreversible impacts of cyber-attack through better prevention & protection-based solutions. Greater adoption and integration of AI-based technologies in a security meshed architecture will also lead to reduced TCO, increased ROI, and ensure compliance. No more is AI-based cybersecurity technology a nice-to-have solution, but it is an imperative must-have solution today failing, which enterprises will have to pay dearly.  

Photo by Jefferson Santos on Unsplash