The Rise of AI-Engineered Threats: Separating FUD from Reality

The Impact of AI on Cybercrime: Separating Hype from Reality

The Rise of AI in Enterprise Security

The introduction of generative AI applications to the market has revolutionized the business landscape, not only for security teams but also for cybercriminals. Embracing AI innovations is now essential for companies to remain competitive and protect themselves against AI-powered cyberattacks. However, it is crucial that we approach the impact of AI on cybercrime with pragmatism, avoiding sensationalism and science fiction-like scenarios.

The maturity and advancements in AI technology have significantly enhanced enterprise security. Cybercriminals find it increasingly challenging to match the resources, skills, and motivation of businesses, hindering their ability to keep up with the rapid pace of AI innovation. Private venture investment in AI reached $93.5 billion in 2021, a level of capital inaccessible to cybercriminals. Additionally, they lack the manpower, computing power, and innovative capabilities that commercial companies and governments possess, giving enterprises more time and opportunities to fail, learn, and improve.

However, it is important to acknowledge that cybercrime will eventually catch up. In the past, similarly, when defenders adopted endpoint detection and response technologies to combat ransomware, attackers needed time to figure out ways to evade detection. This “grace period” allowed businesses to strengthen their defenses. The same principle applies now: businesses must capitalize on their lead in the AI race, advancing their threat detection and response capabilities using the speed and precision that current AI innovations afford.

The Immediate Impact of AI on Cybercrime

Contrary to popular belief, AI is not likely to substantially alter cybercrime in the near future. However, it can scale certain malicious activities in specific instances. Let’s examine where AI may and may not have an immediate impact on cybercrime.

Fully Automated Malware Campaigns: FUD

While it is theoretically possible to leverage AI for fully automated malware campaigns, financially constrained cybercrime groups are unlikely to achieve this in the near term due to challenges faced even by leading tech companies in fully automating software development cycles. Partial automation, on the other hand, can facilitate the scaling of cybercrime, as we have witnessed in Bazar campaigns. Although not an innovation, this technique has proven effective for attackers, prompting defenders to adapt accordingly.

AI-Engineered Phishing: Reality (But Context Is Key)

AI-engineered phishing attacks are already a reality, and we have witnessed their emergence in recent times. These attacks possess the potential for higher persuasiveness and click-rates compared to human-engineered phishing attacks. However, it is important to note that the goal of both types of phishing attacks remains the same: to elicit a click. The detection and response readiness required to counter AI-engineered phishing attacks are comparable to their human-engineered counterparts. Nevertheless, the scale of AI-engineered phishing campaigns can be considerably larger, as AI acts as a force multiplier. Enterprises experiencing a surge in persuasive phishing emails are likely to face higher click-rate probabilities and an increased potential for compromise. AI models also enhance targeting efficacy, enabling attackers to identify the most susceptible targets within organizations, resulting in higher ROI from their campaigns. Given the historical success of phishing attacks, the scaling of this threat reinforces the crucial role played by technologies such as EDR, MDR, XDR, and IAM in detecting anomalous behavior before it can cause significant harm.

AI Poisoning Attacks: FUD-ish

AI poisoning attacks, which involve programmatically manipulating the code and data used to train AI models, can be compared to the “holy grail” of attacks for cybercriminals. Successful poisoning attacks can lead to a broad range of outcomes, from misinformation attempts to scenarios resembling the movie “Die Hard 4.0”. By tampering with the model’s training data, an attacker gains control over its behavior and functionality, making detection difficult. However, carrying out these attacks is far from straightforward, as it requires access to the training data at the time of model development, which presents a significant challenge. Although the risk of AI poisoning attacks may increase as more models become open source, the likelihood of such attacks remains relatively low for now.

The Unknowns and Looking Ahead

While it is crucial to separate hype from reality, it is equally important to ask the right questions about the potential impact of AI on the threat landscape. The unknowns surrounding how AI may alter adversaries’ goals and motives should not be overlooked. As new abilities offered by AI emerge, adversaries may reshape their objectives and recalibrate their motivations. While we may not witness an immediate surge in novel AI-enabled attacks, the scaling of cybercrime through AI will undoubtedly impact organizations that are unprepared.

Speed and scale are inherent characteristics of AI, and just as defenders seek to capitalize on these traits, so do attackers. Security teams are already grappling with understaffing and overwhelming workloads. A sudden influx of malicious traffic or incident response engagements places an immense burden on them. This reinforces the urgent need for enterprises to invest in defenses that leverage AI to enhance the speed and precision of their threat detection and response capabilities. Enterprises that seize this “grace period” stand to benefit from heightened preparedness and resilience when attackers eventually catch up in the AI cyber race.

Conclusion: Staying Prepared in the AI Era

The rise of AI in enterprise security has ushered in new possibilities and challenges. While AI will not revolutionize cybercrime overnight, it will facilitate its scaling in certain areas. Organizations must remain vigilant and proactive in adapting their defenses to address emerging threats linked to AI.

Separating fear-inducing hyperbole from genuine concerns is crucial. Enterprises should focus on concrete actions such as advancing threat detection and response capabilities, investing in cutting-edge technologies, and fortifying their workforce with skilled cybersecurity professionals. Harnessing the power of AI to augment the capabilities of security teams is imperative for staying ahead in the ever-evolving cybersecurity landscape.

The path forward requires a sober assessment of the potential risks and opportunities presented by AI. By taking appropriate measures and staying ahead of adversaries, organizations can navigate the AI era confidently and safeguard their digital assets in an increasingly complex and interconnected world.