AI vs. AI – the cybersecurity race. How artificial intelligence is being used by both hackers and IT departments

IT environments, although highly advanced and complex today, are enthusiastic about emerging new technologies that can revolutionize the way we manage resources. While the history of IT development provides many examples of innovative products and services failing to meet market needs, there are also examples like virtualization and the cloud, which have sparked a global revolution and today constitute the essential foundation of every infrastructure.

Artificial intelligence is a technology whose widespread applications and popularity have led many experts to speak not only of evolution or revolution, but even of a new era – the era of AI. Machine learning, inference systems, and neural networks have been known and used for years, but it was generative AI that made it possible for almost every new product to incorporate AI-based functionalities. While the broad potential of AI in security systems is certainly encouraging, it's also worth remembering that AI is a powerful tool in the hands of cybercriminals.

Artificial intelligence against as

The foundation of every cyberthreat is reconnaissance. A hacker must accurately target their potential victim and select an attack method that will prove effective. In currently observed incidents, the first phase typically involves a chosen type of social engineering. Phishing, vishing, baiting, and spearphishing are increasingly automated and supported by AI not only to increase throughput but also to achieve maximum effectiveness. A system that instantly analyzes an organization based on publicly available information, selects the appropriate method, and conducts a multi-threaded attack proves to be much more effective and faster than traditional methods. The quality of content generation engines is now so high that distinguishing written content from generated content is nearly impossible.

Another area worth noting is deepfakes. The development of generative AI means that a short voice sample and a few photos can be used to create a video recording in which a specific person utters a programmed phrase in their own voice. In recent years, we have seen a significant increase in the popularity of this technology, also based on AI. It poses a significant threat on a local scale, for example, when a cybercriminal impersonates a company CEO, and on a global scale, for example, as a result of a widespread disinformation campaign related to a topic of public concern.

AI is also widely used in activities that do not necessarily target humans. In recent months, new forms of attacks have been revealed, in which the malware mechanism generates a script that encrypts data and sends it to a specified address only after detecting direct access to relevant and valuable information. This form of attack can be particularly difficult to detect, as the threat itself is created only after a certain period of time, once security systems have confirmed that the infected file is trusted.

AI in the service of security departments

Just as artificial intelligence has become an extremely popular technology in cybercriminals, we are also seeing its widespread use in security systems. While the use of AI to counteract incidents is not currently standard, the use of inference mechanisms is now the basis for detecting anomalies and events in most Detection and Response solutions (such as XDR/EDR/NDR). Detecting deviant behavior and automating the first response can be effectively achieved by AI algorithms.

Another area worth considering is incident analysis itself. Multithreaded operation and the correlation of events from different areas of the IT environment allow for faster and more accurate determination of the origin of a threat or attack scenario, knowledge of which is essential for defining its potential effects. In the future, we can likely expect a significant increase in AI applications in analytical processes, cybercriminal analysis, and global operations targeting cybercriminal and cyberterrorist groups.

Summary

Artificial intelligence can be seen in almost every area of ​​the virtual world today; unfortunately, it also finds its niche in areas that serve cybercriminals. This does not mean, however, that we should cease its use or consider it a threat. It is worth remembering, however, that, as with any other technology, selecting the right tools, methods, and standards can have a huge impact on our security and the integrity of our resources.


Norbert Nowak, Cybersecurity Leader

He gained experience implementing projects in networking, storage, virtualization, and security systems for clients across a wide range of industries. He currently advises, designs, and builds comprehensive systems focused on data and system protection. Information security and cybersecurity are areas in which he continually develops and shares his knowledge through numerous lectures and publications.


Powiązane artykuły