Navigating the Reality of AI/ML in Cybersecurity: Moving Beyond the Hype Cycle

Disrupting the AI/ML Hype Cycle

Understanding the Difference

Artificial Intelligence (AI) and Machine Learning (ML) are often used interchangeably, but it is important for cybersecurity leaders and practitioners to understand their distinctions. AI is a broad term encompassing machines mimicking human intelligence, while ML is a subset of AI that uses algorithms to analyze data, learn from it, and make informed decisions without explicit programming.

When new technologies like AI/ML make bold promises, it becomes challenging to discern what is commercially viable versus what is mere hype. The Gartner Hype Cycle provides a visual representation of technology maturity and adoption, helping to identify solutions that can solve business problems and explore new opportunities.

However, the problem with AI and ML arises from their loose usage. Professor Eric Siegel of the University of Virginia points out that AI suffers from vagueness, as it lacks consistency in referring to any specific method or value proposition. Misapplying the term AI to ML tools oversells what most ML projects actually achieve. Projects that maintain a clear operational objective have a better chance of delivering value.

Managing Expectations and Transparency

While AI and ML have made significant strides in enhancing cybersecurity, these technologies are still in their infancy. The overhyping of their capabilities can lead to disillusionment among users, who question the value of ML in cybersecurity. Additionally, the lack of transparency between vendors and users is hindering the broad deployment of AI/ML in the field.

As ML algorithms become more complex, users struggle to understand how specific decisions are made. Vendors often fail to provide clear explanations, citing the confidentiality of their intellectual property. This lack of transparency erodes trust, causing users to revert to older, familiar technologies.

How to Fulfill the Cybersecurity Promise of AI and ML

Bridging the Knowledge Gap

Achieving the full potential of AI/ML in cybersecurity requires collaboration between security researchers and data scientists. Currently, data scientists may develop tools without grasping their utility for security, while security researchers may lack the necessary depth of knowledge in data science or ML. These two disciplines must work together, leveraging their respective expertise. Data scientists can enhance threat detection systems by using ML to identify meaningful patterns, while security researchers can contribute their understanding of threat vectors and vulnerabilities.

Normalized Data as the Foundation

The quality of data used to train models directly impacts the success of AI/ML tools. As organizations shift towards a more data-driven approach, normalizing telemetry at the point of collection becomes crucial. Normalized data in a standard format can be easily streamed into a detection cloud (a security data lake), simplifying the training process and improving ML model accuracy by avoiding format inconsistencies.

Prioritizing User Experience

The user experience of security applications often falls short, creating an obstacle to adoption. To overcome this barrier, security practitioners should prioritize the user experience from the start rather than tacking it on at the end. Incorporating clean visualizations, customizable alert settings, and easy-to-understand notifications can encourage adoption and engagement with AI/ML tools. Furthermore, establishing a feedback loop allows security analysts and threat researchers to provide input and tailor the ML model to their organization’s specific requirements.

The Path Forward

The ultimate goal of cybersecurity is to prevent attacks rather than simply reacting to them. To break the hype cycle and fulfill the promise of AI and ML in cybersecurity, tangible steps are needed. This includes bridging the knowledge gap between security researchers and data scientists, ensuring the use of normalized data, and prioritizing the user experience. By delivering practical ML capabilities that security teams can implement, the true potential of AI/ML can be realized in cybersecurity.