Industry executives and experts share their predictions for 2025. Read them in this 17th annual VMblog.com series exclusive.
By Alex Smith,
Vice President – Data and Analytics, Cloud Services at Intermedia
On November 30th, 2022, ChatGPT
was released, fundamentally changing the digital
world as we know it. Now, less than two years and millions of adopters later, a
recent survey revealed that 65 percent of respondents say their companies
are regularly using generative AI tools. While McKinsey predicts that generative AI can add
anywhere from $2.6 trillion to $4.4 trillion of value to the global economy, as
with any technology, it’s not without risk. The risk with generative AI is two
sides of the same coin: The very tool that is being used to identify cyber
threats is the same tool that is being used to create more sophisticated
cybersecurity attacks-and it’s happening across all communication channels. So
how can small-to-mid-sized businesses use the power of generative AI but
safeguard against potential attacks?
Here are the three biggest security
questions around generative AI and ways companies can thwart attacks.
How
generative AI mitigates threats-and poses new ones
As
generative AI adoption increases, inevitably so will the security threats. That
threat is real, and a whopping 93 percent of security decision-makers expect
AI to negatively impact cybersecurity. Here’s why: generative AI is as good at detecting threats as creating them.
While tools can scan large amounts of data to determine if a threat exists, it
also makes it easier to generate targeted, more sophisticated threats across
all channels, including AI-generated emails, phone calls, SMS, and more.
These targeted threats are much easier to
fall for because, unlike phishing, they’re more tailored to the individual.
Rather than a mass email, AI can generate a single threat designed for one
person based on public information, such as LinkedIn profiles. Why? Large
language model (LLM) creators wrap LLMs in what is essentially a guardrail to
help determine if the prompt sentiment is malicious. Unfortunately, there are
numerous examples where bad actors circumvent these guardrails, causing the LLM
to respond to the prompt with malicious intent.
Here’s an example:
AI can easily mimic voices, impersonating a real person to acquire private or
confidential information from consumers and colleagues alike. This method is
very prevalent, primarily because how easily bad actors can develop advanced
capabilities quickly and without huge budgets. Given the amount of funding that
is currently being directed into GenAI, this type of development is a huge
challenge in security.
Naturally, in this risky environment,
business have questions about how to best secure their information.
Question
1: How can businesses determine what’s a threat-and what’s not?
In
any attack, understanding intent is critical to identifying the threat level,
and intent can be determined by analyzing the communication streams. By using
natural language understanding (NLU), businesses can use AI to perform
sentiment analysis, which is a powerful counter-measure. Not only can AI
determine the intent, and coach the user accordingly, it can also reasonably
detect AI-generated content itself. Businesses can also establish awareness
training (SAT) that use AI tooling to train end-users to understand the
communication streams and identify threats.
Question
2: What are the top communication channels that are vulnerable to threats?
Email
is still the most prevalent channel for threats, but that dynamic is changing
due to effective SAT programs and an overall focus on email security. As a
result, attacks have evolved to deploy across communication channels. Often,
these threats don’t typically appear malicious because interactions are
analyzed in a vacuum. Now more than ever, businesses must pool intelligence
across channels to track the attack chain from its inception.
Question
3: How can businesses safeguard against generative AI threats?
Machine
learning (ML) tools can help businesses identify when customer or employees
might be compromised. These tools can map traditional behavior to current
behavior to uncover anomalies and determine where customers might be
compromised-often without them even knowing. Most businesses don’t have the
capability to develop and implement counter measures themselves, so it’s
important for organizations to identify the tooling and service providers that
provide these types of safeguards to prevent successful attacks.
AI, and GenAI in particular, are powerful
tools that are helping businesses accomplish things that would not have been
possible even a few short years ago. However, with these opportunities come the
need for enhanced security. By deploying the right AI-enabled tools with the
right providers, businesses can hedge against threats and ensure AI is used for
good.
##
ABOUT THE AUTHOR
With over 20 years of experience in leading security initiatives, Alex is a seasoned expert in the field of cybersecurity. Alex has successfully implemented comprehensive security strategies across various industries, ensuring robust protection against evolving threats. His extensive background and dedication to security make him a trusted authority in safeguarding digital landscapes.
