Artificial intelligence (AI) is accelerating the cyber threat landscape, enabling attackers to automate attacks, exploit vulnerabilities and impersonate trusted individuals, while organisations struggle to keep pace with the security and governance risks associated with the technology.
The growing threat posed by AI, coupled with the need for stronger cyber resilience, was a key theme at the Armata Cyber Security Leadership Summit on Wednesday, where security experts urged organisations to look beyond traditional preventative controls and prepare for the possibility that attackers will eventually breach their defences.
Caesar Tonkin, managing director of Armata, said the cyber security company is seeing increasing demand from organisations looking to outsource security operations, as businesses struggle to maintain the skills and resources required to manage increasingly complex cyber threats.
“We are increasingly seeing customers wanting to outsource their security operations,” said Tonkin.
Added cyber vulnerability
Richard Frost, head of technology solutions and consulting at Armata, said AI is introducing a new dimension to cyber security, with trust becoming increasingly difficult to establish.
While employees are using AI tools to improve productivity and perform everyday tasks, cyber criminals are leveraging the same technology to produce more convincing phishing attacks, impersonate executives and automate elements of the attack chain.
“The biggest aspect of this is trust,” said Frost. He said organisations can no longer assume a communication is legitimate simply because it appears to come from a known individual or trusted source.
He noted that the rise of AI-generated content, deepfakes and voice cloning is further complicating the situation, as it enables attackers to mimic people and create convincing communications designed to manipulate employees into sharing information, or authorising fraudulent transactions.
“Every breach has at its core a betrayal of trust,” Frost said.
The impact of a cyber attack also extends beyond the technical disruption. Organisations can face financial losses, regulatory consequences and significant reputational damage.
Frost said organisations should therefore adopt a multi-layered security approach combining e-mail and endpoint security, network controls, employee awareness training and incident response capabilities.
However, he cautioned that organisations should not focus exclusively on preventing attacks. They should also be prepared to quickly contain an attack and limit the damage.
“You want to contain access as quickly as possible,” he said, noting it is much easier to deal with one affected user than thousands of compromised users.
AI raises the stakes
According to Frost, AI is changing both the speed and economics of cyber attacks. “Attackers can use AI to automate reconnaissance, identify vulnerabilities and generate malicious code, potentially reducing the time and resources required to launch sophisticated attacks.”
At the same time, organisations are adopting AI faster than they are establishing appropriate governance frameworks.
He explained that this creates the risk of employees inadvertently exposing sensitive corporate information through public AI platforms, while organisations may have limited visibility into the number of AI applications being used across their environments.
“Businesses need to understand which AI tools are being used, what information is being shared with them and what level of access they have to corporate systems and data,” he said.
During the summit, he demonstrated Armata's AI analyst, Athena, which is designed to support the company's security operations centre by monitoring threat feeds and converting raw security alerts into actionable intelligence.
The technology is intended to help security teams interrogate threat intelligence, monitor customer environments and accelerate investigations.
Frost said the approach is not about replacing cyber security professionals with AI, but combining AI capabilities with human expertise to improve the speed and effectiveness of security operations.
Preparing for the worst
Frost said organisations often focus heavily on preventing cyber attacks but fail to consider what happens when preventative controls are bypassed.
“Businesses may have invested in firewalls, e-mail security and endpoint protection, but without effective incident response plans, reliable backups and processes to isolate compromised systems, a successful attack can quickly escalate into a major business disruption.”
Cyber resilience, therefore, needs to form part of an organisation's broader security strategy.
Frost also highlighted the growing risk associated with third-party suppliers and service providers. Organisations, he said, should assess third-parties based on the level of access they have and the potential impact of a compromise. A supplier with access to sensitive databases, for example, presents a significantly different risk profile from one with limited access to corporate systems.
Craig du Plooy, principal cyber security consultant at Armata, said the digital forensics function is also evolving as organisations contend with increasingly complex cyber incidents.
“Digital investigations are no longer confined to traditional computers and mobile devices, with investigators now required to consider cloud environments, AI systems and other emerging technologies.”
Du Plooy said organisations must ensure evidence gathered during an investigation is properly preserved and capable of withstanding scrutiny, particularly when incidents have regulatory, legal or insurance implications.
“The digital forensic process will help you meet that,” he said.
He stressed that forensic investigations must be repeatable, with evidence collected and analysed using a documented methodology that allows another investigator to independently follow the process and reach the same conclusion.
The need for robust processes is becoming increasingly important as organisations handle growing volumes of data and AI-generated content, he noted.
Du Plooy also highlighted the importance of AI governance, pointing to emerging standards that provide organisations with frameworks to establish, implement, maintain and continuously improve AI management systems.
The objective, he said, is to ensure AI is deployed transparently and accountably, while remaining aligned with regulatory requirements.
Share
