New research has shown that while chief information security officers (CISOs) are proactively embracing artificial intelligence (AI) within their own cyber functions, they are not, to a large extent, helping fellow business departments embed similar measures.
Combining cyber security and AI provides an opportunity to improve decision making across everything from acquisitions to supply chain governance. According to EY, in its study on global cybersecurity leadership, while businesses are enthusiastic when it comes to implementing AI in their cybersecurity systems, on the whole they are still at the early stages of making this a reality. In essence, cybersecurity is designed to defend computers, servers, mobile devices, electronic systems, networks and data from malicious attacks.
New research has shown that while chief information security officers (CISOs) are proactively embracing artificial intelligence (AI) within their own cyber functions, they are not, to a large extent, helping fellow business departments embed similar measures. While the sensors put in place by the Internet of Things – augmented with reality devices, autonomous vehicles and drones – can improve the efficiencies of projects like mining operations, they are equally capable of halting activities if attacked.
The operational technology networks of miners are particularly vulnerable to cyber attacks due to their lower security maturity. EY believes that while AI has great potential to ease cybersecurity workloads and the global skills shortage by expanding the scope of task automation, shortening response time and optimising visibility across the attack surface, using Generative AI (or GenAI, which focuses on creating new content instead of just analysing and interpreting data) across a business is opening new vulnerabilities that many cyber functions are not currently positioned to address.
This might also help improve explainability (which, according to IBM, involves the processes and methods that allow human users to comprehend and trust the results and output created by machine-learning algorithms) – a key challenge for many AI-driven cyber tools today. “Its (GenAI) ability to act as a co-pilot that performs summarisation and answers questions could help professionals rapidly distinguish between a real threat and a false positive,” EY team leaders Richard Watson and Richard Bergman explained.
“Striking the right balance between AI-enabled automation and people control will be crucially important for organisations’ accountability to shareholders, boards and regulators. “The key for CISOs is to identify the areas where AI-enabled automation is most suited to replace manual processes.” There are, Watson and Bergman said, a number of actions security officers could take to improve the dissemination of electronic information throughout an operation.
They include expanding the scope of automation by producing a detailed audit of its cyber team’s automatable tasks and considering where personal insight and observation is best focused, while ensuring attention to explainability and making sure the appropriate thresholds are set. Automation capabilities of third-party vendor products could also be accessed, which would prioritise the implementation of functionality within vendor-partner software above custom automation use.
Moreover, CISOs should consider the entire enterprise when evaluating AI for cybersecurity, including corporate environments, plants and field-level assets. Additionally, they must stay up-to-date with emerging applications of artificial intelligence in threat detection and recovery. “Considerations should be given to applications in these areas, such as recovery planning, analysis of incident reports and prevention of zero-day attacks,” Watson and Bergman noted. Furthermore, CISOs must follow the data.
“AI and machine learning (ML) investments are going to be most profitable where there is cyber data density,” they said. “Focus on areas such as identity management, threat and vulnerability, and security operations where large scale data is difficult to manage.” Building for reuse is also useful as certain functions have broad applicability within cybersecurity and across the enterprise, effectively allowing CISOs to avoid development and maintenance duplication by centrally managing intake and development.
“For example, context-based prioritisation of event, incident, threat, risk, vulnerability and any other remediation activity should be standardised, built once and used many times,” Watson and Bergman advised. The EY team said there are a number of opportunities for cybersecurity to improve AI implementation within different domains.
In the supply chain, for instance, vulnerabilities have seen department leaders start to leverage AI in areas like planning, purchasing, manufacturing, logistics and sales. In this instance, four out of five supply chain proponents believe increased cybersecurity vulnerability is a moderate or major threat, topping the list of GenAI supply chain implementation risks.
“Cyber leaders should prioritise more engagement with, and continuous monitoring of, the supply chain to ensure that this already vulnerable attack surface is protected with broader AI adoption,” the EY team leaders advised. Meanwhile, smart energy service networks are already utilising AI and ML to maximise solutions for energy production and consumption, demand response as well as grid self diagnosis.
“Cyber leaders have an opportunity to leverage existing AI-powered smart grid analytics to build real-time cyber threat assessments,” they said. Furthermore, autonomous vehicles, which use embedded AI systems that sense their environment to make decisions, create a delicate cyber-physical system which could, if not secured adequately, lead to potentially fatal consequences.
Under this scenario, cyber attacks could take on many forms, including assaults on AI-powered control systems, driving components and risk assessment elements. Fortunately, cybersecurity leaders are getting a handle on these issues, with some building on-board intrusion AI detection systems that carefully monitor the vehicle’s operation for any anomalous behaviour.
In the future, EY said, CISOs could adopt a number of practices which would deliver more business value. For a start, they should embed cyber professionals with the AI methodology being used at the top, thus improving identification, intake and governance processes. This early-stage intervention would allow for cyber integration commensurate with the sensitivity of the data and business function. Second, CISOs should consider publishing and governing acceptable AI operational standards across the business while outlining the guardrails and guidance under which the organisation designs and builds AI solutions.
Adopting a set of technical cyber controls that align to emerging AI industry standards frameworks would also be advantageous. Finally, the implementation of AI-specific risk mitigation should be considered, taking into account a slew of challenges relating to complexity, adversarial attacks, lack of interpretability, continuous learning and ethical considerations. “CISOs have a near-term opportunity to become a trusted partner, helping teams maximise the value creation potential from the AI tools they look to implement,” Watson and Bergman added.
“Helping the business confidently deploy AI can shift the perception of cybersecurity from a team that slows things down to one that enables confident technology adoption at an accelerated pace. “By setting up processes that incorporate cyber early, other functions will gain efficiencies by minimising budget issues or delays. “Integrating cyber into AI initiatives is an opportunity for cyber functions to expand their influence across the organisation.”
