How Generative AI is Poised to Transform Cybersecurity

Generative AI has been a hot topic for the past year or so. The technology is significantly different from previous AI-powered solutions and has a wide range of applications. This article discusses the ways generative AI is radically changing cybersecurity and how an extended detection and response platform protects an IT environment from cyberattacks developed with these powerful tools.

What is Generative AI?

Generative AI demonstrates an application of machine learning and artificial intelligence that is fundamentally different from the way AI technology has previously been used. Legacy machine learning models have been extensively employed in business and industry to make predictions based on querying databases. These models do not generate new information.

Generative AI is a machine learning model that is trained to create new data based on its training. Large language models (LLMs) form the foundation of generative AI solutions and dramatically influence their performance.

While the technology behind generative is not new, it has gained popularity due to the development of easily accessible user interfaces. The release of ChatGPT and DALL-E have put a lot of AI power in the hands of virtually anyone who wants to use it. This includes threat actors and the personnel responsible for protecting IT environments from cyberattacks.

How Can Generative AI Be Used by Threat Actors?

Unfortunately, generative AI falls into the category of technical advancements intended to be beneficial that can also be co-opted for nefarious use by threat actors. The power inherent in generative AI solutions provides malicious entities with multiple new methods of disguising their intentions and compromising an IT environment and its valuable data.

Following are some of the ways generative AI is being used to launch more effective and dangerous cyberattacks.

• Increasingly sophisticated social engineering scams - Malicious generative AI tools such as WormGPT remove the content moderation guidelines to allow the creation of business email compromise (BEC) and phishing attacks. The use of a generative AI platform enables virtually anyone to craft believable, fraudulent communication designed to deceive the recipients.
• Challenging identity management systems - More effective brute-force password attacks are possible by seeding the algorithms with information scraped from various sources by generative AI tools.
• Generating fake content - Fake images, text, audio, and video clips, can be used to create misinformation that impacts an organization’s cybersecurity. Deep fakes can make it extremely difficult to discern facts from fiction.
• Data manipulation - AI tools can be used to alter images or documents to falsify information and tamper with evidence. Threat actors may be able to cover their tracks by manipulating monitoring data to escape detection.
• Adversarial attacks - These attacks on generative AI models modify input data to produce false or misleading output. They can be used to bypass security systems by generating false data and spoofing legitimate entities.
• Evading cybersecurity solutions - Generative AI helps cybercriminals generate novel malware variants to defeat traditional security tools. Extended detection and response (XDR) platforms help mitigate these risks by identifying emerging and unique threats based on system activity.

How Can Generative AI be Used to Strengthen Cybersecurity?

Security personnel can leverage the power and functionality of generative AI in multiple ways to help combat sophisticated cyberattacks. Following are some of the beneficial uses of generative AI as it relates to cybersecurity.

Testing for adversarial attacks - Understanding how the LLMs can be deceived enables them to be used more effectively. Results of adversarial testing may result in modifications to the LLM to address vulnerabilities.

Optimizing threat intelligence - Generative AI tools can facilitate the analysis of intelligence feeds to provide enhanced threat intelligence. Effectively trained generative AI can help wade through the enormous volumes of threat intelligence to identify the most immediate threats.

Enhanced threat hunting - Generative AI can assist IT personnel in conducting complex threat hunting activities and discovering hidden adversaries in the environment. The use of machine learning enables the tools to continuously identify new techniques used by threat actors.

Supporting red team testing - Using generative AI to simulate cyberattacks helps red teams develop the appropriate defenses to protect the environment. Teams can use an AI platform to simulate attacks and effectively test cybersecurity readiness throughout the environment.

Cybersecurity education and training support - AI tools can create realistic simulations to enhance training and education. Synthetic data modeled on real-world data can be used to facilitate various types of cybersecurity training. The use of natural language interfaces facilitates providing training to non-technical personnel.

Deploying generative AI tools responsibly requires consideration of the following factors.

• Teams must ensure that answers generated by the tool are accurate. This may entail significant manual fact-checking to verify the results of the AI platform.
• Employees must understand the ramifications of putting company data into generative AI tools. The platform may generate inappropriate content that puts sensitive information at risk.
• The generative AI attack surface has to be secured from data poisoning to maintain its integrity and functionality.
• Customer privacy needs to be maintained which requires care in how data is presented to the AI platform.
• The results of generative AI processing need to be monitored to ensure there is no unintentional data leakage or disclosure.

How XDR Protects Your Infrastructure From Generative AI Attacks

Integrating an extended detection and response (XDR) solution with your existing security stack enhances your cybersecurity posture. The following features of Samurai XDR address the challenges of protecting an IT environment from the dangers of generative AI.

Samurai XDR’s detection engine employs NTT’s Tier 1 internet backbone to obtain an outstanding perspective on new and emerging threats. NTT is a global leader in cybersecurity, trusted by many of the world’s most prestigious organizations and its proprietary threat intelligence is derived from a variety of sources including our public Internet backbone covering more than 40% of the Internet.¹

• The XDR platform leverages threat intelligence to identify existing and emerging threats that pose a risk to the IT environment.
• Machine learning powers advanced analytics to identify suspicious activity that often indicates a compromised infrastructure component.
• XDR helps thwart the disguises possible through generative AI by identifying subtle lateral movements through the environment that may be the signs of advanced persistent threats (APTs).
• Samurai XDR consolidates and prioritizes threats to improve productivity and help implement improved security in organizations with small IT teams.

Samurai’s new Starter Plan is designed to get your organization up and running with an advanced XDR platform. Give it a try and see how it can help address the complications generative AI brings to cybersecurity.

¹ Based on CAIDA AS ranking