AI-enabled cyber attacks will become far more widespread and sophisticated as models become increasingly capable. So says an open letter signed by household business, tech and IT names such as Cisco, Adobe, GitHub, Google, IBM and Open AI.
It warns that longstanding bugs, excessive permissions, misconfigurations, insecure and unpatched software, weak authentication, and technical debt in legacy systems have left systems exposed. โSecurity teams, particularly for critical infrastructure, have been historically under-resourced and need a surge in tools and resources,โ the letter adds.
Among cyber firms that have put their name to the letter are Darktrace; HackerOne, a platform for bug bounty researchers; Sophos, and Tenable; besides insurers such as Zurich, and the audit firm KPMG.
Comment
According toย AJ Thompson, Chief Commercial Officer at the IT services firm Northdoor plc, the technology industryโs warning comes with some irony. He said: โThere is a slightly surreal situation developing where AI companies are warning us that we need to bolt and padlock the stable door, while at the same time telling us they are about to open it.
โThe potential benefits of AI are enormous, but so is the potential for unintended consequences or the technology being used by cybercriminals. We are rapidly moving towards a world in which automated systems can act at machine speed, interact with multiple systems and potentially identify weaknesses far faster than a human attacker ever could.
โMost organisations still do not take data security as seriously as they should. Too often, security is only revisited after an incident, rather than being treated as a fundamental part of how the organisation operates.โ
โFor those who are looking at security carefully there remains a major issue that acts as a barrier to implementation. The fact is that security technology is still expensive to acquire and extremely complex to manage. The result is often a patchwork of security tools that are difficult to operate effectively, leaving already stretched IT teams trying to make sense of an ever-growing number of risks and alerts.โ
As AI advances, Thompson says you need to focus less on adding technology for technology’s sake and more on understanding what data is held, where it is, who can access it and how that access is monitored.
โThere is no single product that can solve the security challenge. Organisations need a layered approach that considers people, processes and technology, and focuses on protecting the data that really matters.
โAI may create extraordinary opportunities, but it is also increasing the speed and complexity of the threat landscape. The question is not whether organisations should use AI, but whether their security foundations are strong enough for the world they are moving into,โ Thompson added.
