Six key takeaways from CISOs on AI’s role in security

Generative AI has created unprecedented challenges for CISOs, increasing the complexity of enterprise environments while providing bad actors with the tools to create more sophisticated attacks. Security leaders now face the dual task of mastering this evolving technology and integrating AI into their defence strategies, all while ensuring the security and privacy of AI tools.

 

The data shows that these challenges are top of mind for CISOs. In Tines’ survey on AI adoption, 94 per cent expressed concerns that AI will increase pressure on their teams. But how are leading CISOs leveraging AI today? Are they feeling optimistic or underwhelmed by AI’s impact so far?

 

These are some of the questions I posed to Mandy Andress, CISO of Elastic, and Matt Hillary, VP of Security and CISO of Drata, during our webinar, How to make AI an accelerator, not a blocker. Today, I’m sharing six key takeaways from our conversation, including some valuable insights for forward-thinking security leaders.

 

AI is already providing security teams with significant benefits

 

Both CISOs I interviewed said AI is helping them reduce repetitive and manual tasks, such as responding to large volumes of security alerts.

 

Elastic’s CISO Mandy Andress told me, “We could automate bringing in asset data, owner data, application criticality to the business, IoCs and so on. using today’s tools. But what we couldn’t always do was tie that into what’s happening in the threat environment around us, because that’s always changing. Having some of that accessible via an LLM allows you to apply better context in a world that’s changing quickly.”

 

Ensuring the quality and security of AI’s output remains a challenge

 

Both CISOs were concerned about visibility into the “black box” of AI.

 

But as CISO of the leading platform for search-powered solutions, Andress said she was encouraged to see security teams being vigilant about the security and privacy features of their AI tools. “I see a desire for more transparency in the AI space,” she says. “From a product perspective, it’s about being explicit and letting customers use what works best and what’s approved by them and helps their environment. It’s not us dictating what needs to be there.”

 

AI is helping bad actors with phishing (but not much else)

 

While Andress and Hillary had concerns about AI, they haven’t seen it significantly change cybercriminal tactics.

 

Hillary explained that, while bad actors use AI, human creativity remains the biggest threat. “There are still humans behind these [phishing emails and deep fakes], creating content, creating misinformation. I think they have much greater impact, as far as what might hurt us in the long term.”