The Rise of AI: Strengthening Cybersecurity for a Digital Age

AI Is the Hero to Embrace, Not the Villain to Defeat

Rapid advancements in AI since the 1950s have set the stage for substantial growth, with no signs of slowing down. The global market for AI-based security tools is expected to reach $133 billion by 2030, reflecting the increasing integration and use of AI in daily DevSecOps workflows. As the industry incorporates AI and machine learning (ML) into more processes, we are presented with numerous opportunities to harness AI as a force for good.

Faster and More Accurate Configuration for Security Tools

Currently, many security technologies require extensive manual fine-tuning to be effective. This process often involves sophisticated parameter tweaks that can impact what incidents are reported, what vulnerabilities are identified, and how issue priorities are determined. These manual configurations are time-consuming and can leave organizations exposed to threats until the right settings are in place.

Machine learning can come to the rescue in this scenario. By continuously optimizing parameters, ML algorithms can prioritize items in a scanning queue, ensuring that operations run as efficiently as possible. Automating these configuration tasks will significantly reduce the amount of time future cybersecurity teams spend on tedious manual work.

Improved Risk Scoring and Threat Intelligence

Modern scanning tools provide risk assessments once a scan is complete, offering insights into the levels of security protection and potential risks across applications, websites, and networks. While useful, these assessments often lack deeper context and guidance necessary for security to keep up with fast-paced software development.

In the coming years, security tools will increasingly rely on machine learning to evaluate risk and manage threats. As machine-generated results improve in scope and quality, they will support more accurate, data-based decision-making. This will allow organizations to address actionable issues in the right order, minimizing risk and making their security efforts more effective.

Putting a Sharper Edge on Security Testing

Easier access to accurate insights through language models like ChatGPT will facilitate the use of AI and ML by engineers and developers, leading to better and more useful insights over time. When it comes to security testing, training AI/ML tools to become sharper will enhance static application security testing (SAST) and dynamic application security testing (DAST) tools.

This advancement means increased control and precision when analyzing scan results, providing reliable intelligence into current and future risks, and improving the efficacy of vulnerability hunting.

Fewer False Positives for Less Manual Verification

False positives pose a persistent challenge for security, often resulting in hours of manual work to verify scan results. The need for manual verification can undermine confidence in security tools and processes.

However, a recent study by IBM demonstrated that AI can reduce false positives by 65%, freeing up resources for activities that add business value. As this technology progresses, business and operational leaders will have reliable data to confidently make decisions based on accurate AI/ML results. Clear and actionable vulnerability reports, powered by learning systems, will enable DevSecOps teams to prioritize building and delivering innovative applications.

Winning the Race to AI Supremacy in Security

From threat identification to tool configuration, we are already witnessing tangible impacts of AI in cybersecurity. The potential for incorporating AI and ML into cybersecurity operations and strategies is vast.

If we fully realize the potential of existing and emerging tools to continuously improve cybersecurity, AI can truly be one of the good guys. It is crucial for cybersecurity professionals to embrace AI as a hero and utilize its capabilities to safeguard digital ecosystems.

About the Author

Frank Catucci

Frank Catucci is a global application security technical leader with over 20 years of experience in designing scalable application security-specific architectures and partnering with cross-functional engineering and product teams. Frank has contributed to the OWASP bug bounty initiative and served as the Head of Application & Product Security at Data Robot. He has also held roles as a Senior Director of Application Security & DevSecOps at Gartner and as the Director of Application Security for Qualys.

Outside of his professional pursuits, Frank and his wife maintain a family farm. He is an avid outdoors enthusiast and enjoys fishing, boating, watersports, hiking, camping, dirt biking, and motorcycling.