AI-enabled cyber attacks will become far more widespread and sophisticated as models become increasingly capable. So says an open letter signed by household business, tech and IT names such as Cisco, Adobe, GitHub, Google, IBM and Open AI.
It warns that longstanding bugs, excessive permissions, misconfigurations, insecure and unpatched software, weak authentication, and technical debt in legacy systems have left systems exposed. โSecurity teams, particularly for critical infrastructure, have been historically under-resourced and need a surge in tools and resources,โ the letter adds.
Among cyber firms that have put their name to the letter are Darktrace; HackerOne, a platform for bug bounty researchers; Sophos, and Tenable; besides insurers such as Zurich, and the audit firm KPMG.
Comments
Evan Reiser, Founder and CEO at Abnormal AI said: “We have signed an OpenAI letter for collective action on cyber defence because no single company can solve this alone.ย Software vulnerabilities and malware are still real threats, but the most costly attacks now target people through compromised identities, account takeovers, and social engineering. Insider threats and nation-state infiltration now run through text, voice, and video deepfakes. They wear legitimate identities and behave in slightly wrong ways, so they slip right past tools built to catch known bad software. Those attacks deserve the same urgency as the vulnerabilities dominating the headlines.ย AI is lowering the barrier for attackers, raising their speed, and making deception easy to produce at scale. We can’t defend tomorrow’s attacks with yesterday’s assumptions.
“That’s why OpenAI’s call to collective action is so important and we at Abnormal AI are standing behind it. The security community has both the opportunity and the obligation to make defensive AI advance at least as fast as the offensive kind, which means building systems that learn continuously, turning new threat intelligence into stronger production defences, and treating defence as a shared effort.”
According toย AJ Thompson, Chief Commercial Officer at the IT services firm Northdoor plc, the technology industryโs warning comes with some irony. He said: โThere is a slightly surreal situation developing where AI companies are warning us that we need to bolt and padlock the stable door, while at the same time telling us they are about to open it.
โThe potential benefits of AI are enormous, but so is the potential for unintended consequences or the technology being used by cybercriminals. We are rapidly moving towards a world in which automated systems can act at machine speed, interact with multiple systems and potentially identify weaknesses far faster than a human attacker ever could.
โMost organisations still do not take data security as seriously as they should. Too often, security is only revisited after an incident, rather than being treated as a fundamental part of how the organisation operates.โ
โFor those who are looking at security carefully there remains a major issue that acts as a barrier to implementation. The fact is that security technology is still expensive to acquire and extremely complex to manage. The result is often a patchwork of security tools that are difficult to operate effectively, leaving already stretched IT teams trying to make sense of an ever-growing number of risks and alerts.โ
As AI advances, Thompson says you need to focus less on adding technology for technology’s sake and more on understanding what data is held, where it is, who can access it and how that access is monitored.
โThere is no single product that can solve the security challenge. Organisations need a layered approach that considers people, processes and technology, and focuses on protecting the data that really matters.
โAI may create extraordinary opportunities, but it is also increasing the speed and complexity of the threat landscape. The question is not whether organisations should use AI, but whether their security foundations are strong enough for the world they are moving into,โ Thompson added.
