Modern cyber security has to move at machine speed to outperform automated attacks, which can exploit vulnerabilities at scale in a matter of minutes.
This is according to Ali Yilmaz, Senior Manager of Solution Architects for Turkey and MEA at Picus Security, who was addressing an executive roundtable for risk and cyber security heads in Sandton this week.
Yilmaz said in the 'post-Mythos' era in which autonomous AI agents are capable of hacking at scale, cyber security teams faced challenges of increasing risk and complexity.
"We have entered the agentic era. We are facing fully autonomous malware and AI cyber weapons. We are no longer just using AI to process data; we are deploying autonomous and generative AI for agentic threat hunting and automated patching, effectively fighting an AI versus AI adversarial war," Yilmaz said.
He said: "Managing the expanding attack surface and third-party risk is becoming a complex nightmare. At the same time, CISOs must stay abreast of new and evolving regulations and comply with more stringent risk governance and incident response reporting requirements. AI-driven attacks are making incident response planning more urgent: organisations must strengthen automated threat detection, response strategies and crisis management frameworks."
Senior cyber security practitioners at the event highlighted their key security concerns, such as proving the value of security investments and justifying additional security spend to the board.
Yilmaz noted: "Risk quantification and board-level communication are common challenges. Security leaders must be able to translate cyber risks into business risks for executives and boards: cyber risk quantification (CRQ) and financial impact assessments are essential for risk-based decision-making."
Paradigm shift for cyber resilience
"Cyber security needs a paradigm shift," he said. "Siloed risk exposure activities and a lack of visibility threaten business resilience. Now, organisations need to be able to correlate insights around the threat landscape, security validation and the organisational context of risks to manage risk better."
Highlighting the importance of security validation, he said Picus enables organisations to become more proactive by correlating data from assets and devices with vulnerability data, security control data, threat intelligence and business context.
"Picus changes the paradigm. We move organisations from unscalable, fragmented, point-in-time solutions to an orchestrated architecture," he said.
The Picus platform is built on highly mature, proven engines, he said. "We pioneered the breach and attack simulation market over 10 years ago." That foundation now spans attack path validation, exposure validation and detection rules validation, he explained, which together adjust vulnerability criticality based on an organisation's actual defence gaps rather than generic severity scores.
The platform correlates exposure, validation, threat and identity data, he added, and connects directly to an organisation's existing EAP, ticketing, SOAR and CTI tools through APIs.
AI now runs through the platform's core workflows, he said, across three areas.
"We have enabled the auto-consumption of cyber threat intelligence, which effectively eliminates the old, manual, craft-heavy emulation workflows. By automating this phase, we have compressed our emerging threat response times down to mere minutes.
"We now offer chat-based orchestration via the Picus AI Assistant. This provides adaptive workflows that act directly on your intent, covering the entire life cycle from running simulations to driving mobilisations," Yilmaz said. "Finally, we have changed how you interpret findings. The platform now features AI-generated risk dashboards so you can build out your environment using prompt-driven custom widget creation, or you can rely on our extensive predefined widget libraries to instantly display key metrics, such as your MITRE ATT&CK coverage and overall detection scores."
Share
