Cybersecurity Concerns Rise as Generative AI Emerges as a New Variable for Organizational Security

Generative AI or GenAI's popularity is undeniable, with widespread adoption across organizations of all sizes, both domestically and internationally. Some utilize it for internal development, while others employ it to create innovative products. However, concerns have risen regarding the technology's security implications and the potential need for “human” employees to upskill to effectively work alongside these tools.

According to Gartner, businesses will increasingly use GenAI to develop or create AI-powered applications. By 2026, Gartner predicts that 80% of organizations will use GenAI to develop apps, up from just 5% in 2023.

Despite the widespread adoption of GenAI in industries, some organizations remain concerned about security threats, employee skills, regulatory matters and tool costs or employee development costs.

At the recent Gartner Security & Risk Management Summit, Deepti Gopal, a Gartner analyst, discussed the future of GenAI and cybersecurity. She stated that while there are security concerns, GenAI could be used to address long-standing security issues in the technology world. Gartner's 2023 Cybersecurity Forecast focuses on "human" issues, such as those caused by lacks of skills or human error. According to surveys of Chief Information Security Officers (CISOs), these executives are looking for ways to improve cybersecurity effectiveness and sustainability while adopting GenAI within their organizations.

Organizations Face a Shortage of 'Human' with Cybersecurity Expertise

Since early 2023, we've heard almost daily news about layoffs or employee layoffs for various reasons, such as cost-cutting, organizational restructuring, or hiring new technology-savvy talent.

However, there is a shortage of digital talent on the market, particularly in cybersecurity. This has resulted in cyberattacks on many organizations after implementing new technologies.

ISC2's 2023 Cyber Workforce Study reports that while the cybersecurity workforce grew by 8.7% last year, the gap between the demand for skilled workers and the available workforce has widened by 12.6% each year.

Gartner also predicts that by 2025, half of all cyberattacks will be due to "a lack of talent or human failure."

Generative AI and the Future of Cybersecurity Assistance

While AI is still a relatively new technology in its early stages of development, many believe that the arrival and popularity of ChatGPT could pose a problem and cause damage to the technology world. AI's ability to generate text or content could be used by malicious actors to create more believable text or emails to deceive users.

On the other hand, many still believe that GenAI can also be trained to be a cybersecurity management assistant. For example, it could be used to collect security data, provide recommendations for improvement, develop security protocols, or even train employees in more advanced skills.

A Forrester report highlights GenAI's cybersecurity management capabilities:

• GenAI simplifies content management since AI generation can help developers find bugs, improve, and assist developers in managing content.

• GenAI will calculate and predict potential risks, aiding in preventing cyberattacks through simulations or vulnerability analysis.

• GenAI can help security teams identify and filter potential errors or attacks faster than traditional systems that rely on human screening.

• GenAI can automatically assess potential regulatory risks and ensure that policies align with existing regulations and governance.

• GenAI can be used to simulate future cyberattack scenarios to calculate and test defenses against new attack types.

• GenAI can provide confidence to executives or CISOs by providing detailed analysis and summaries of forecasts and event responses.
  
  

While the use of GenAI in cybersecurity is still in its early stages, many organizations are already using AI to develop other tools to help with security.

Training 'Human' to Understand Risk

In addition to training AI for security management, organizations also need to consider other teams that may not have a deep understanding of the technology. Cybersecurity experts emphasize that organizations need to educate non-IT employees in basic cybersecurity, such as not clicking on email links. This can also help reduce the risk of data loss to malicious actors.

Moreover, organizations should also adopt digital tools for cybersecurity management, including AI-integrated tools to help employees assess cybersecurity risks at an early stage. Gartner also predicts that by 2027, applications’ security operations will be redesigned, making them easier to use for those without cyber expertise.

References: Gartner (1)(2)(3), Forbes, Stanford, Forrester, ISC2, Thomson Reuters (1)(2)(3)