Due to the increase in complexity and volume of Cybercriminals' Tactics, Techniques, and Procedures (TTPs), the process of defence in cybersecurity has evolved from traditional reactive to a strategic and proactive approach of establishing Security Operations Centers (SOCs). In this new approach, the necessary tools to monitor and prevent cybercriminal infiltration into organizations’ networks are provided to the SOCs. Despite this solution, the SOCs analysts still struggle to keep up with the pace at which the cybercriminals are moving, hence the introduction of an AI-powered security automation solution.
The AI-powered security automation introduces a transformative approach that accelerates incident response and improves threat detection. However, I have to realize that despite the immense promises that the AI solution provides, it comes with a variety of challenges and lessons that every cybersecurity practitioner should be aware of when they are practically deployed. In this article, I share the practical lessons I have learned from real-world deployments of Artificial Intelligence (AI) in cybersecurity for defense. I also describe what has worked for me, what has not, and present recommendations for organizations to integrate AI into their security operations successfully.
The Promises of AI in Cybersecurity
AI, particularly machine learning (ML), has found a natural home in cybersecurity. Some of the benefits of AI in the cybersecurity defence mechanism allow security teams to handle larger volumes of data than manual processes could achieve through pattern recognition, anomaly detection, and predictive analysis.
Therefore, AI-driven tools can achieve the following:
- Anomalies detection that may indicate breaches or insider threats in network traffic.
- Automation of routine security tasks such as threat detection, malware classification, patch management, and log analysis.
- Analyzing known and recognized attack patterns as well as predicting potential attacks.
The Real-World Impact of AI
The use and application of AI systems span multiple sectors and industries, as evidenced by the diverse ways organizations utilize them. For instance, the application of AI is seen in areas such as customer service, logistics, recruitment, finance, healthcare, marketing, and so on. The applications of AI have significantly impacted businesses due to some benefits like enhanced operational efficiency, automation, and decision support that they provide, especially when they are carefully planned, deployed, and continuously monitored by SOC human analysts.
Some other additional benefits are highlighted below.
- AI can quickly decide which alerts need urgent human attention, and this is called alert triaging. This reduces the time to respond to high-priority threats.
- The ML algorithm that AI uses can identify patterns that humans may miss. For instance, low-and-slow attacks or insider threats, which cybercriminals employ, thereby enhancing threat detection.
- Operational efficiency is enhanced through repetitive automation, which allows analysts to focus on investigation and strategic defense.
- Organizations can maintain a security posture even as digital assets grow, as AI scales to large data volumes.
Lessons from Live Deployment
The deployment of AI systems in the cybersecurity live environments comes with surprises, lessons, and practical insights that cybersecurity practitioners should be aware of.
Below are the key lessons that real-world deployments teach us.
1. Data Quality is Non-Negotiable
AI models are only as good as the data they are trained on. In most cases, organizations often discover that their internal datasets are incomplete, biased, or inconsistent during live deployments. For instance, integrating an AI system into the Security Information and Event Management (SIEM) of an organization to a platform for real-time analysis and monitoring of phishing security events may encounter non-performance due to the trained dataset overrepresenting certain email formats and neglecting newer attack vectors.
Lesson: I have learnt that organizations must ensure that regular audits are carried out on their dataset before feeding them into ML models. When this is done, the inclusion of various attack scenarios, dataset update, and validation of the datasets, and many more are simulated against real-world incidents.
2. Human-AI Collaboration is Key
While AI systems can automate their cyber defense capabilities after deployment, they cannot operate independently without human input. Human expertise and input are crucial for interpreting identified threats and making the required decision at some point.
Therefore, it is a gross misconception to think that AI can entirely replace human analysts. For instance, in a financial services company where AI flagged hundreds of suspicious transactions per day, the human analysts' activities would triage these alerts by focusing on high risk items and identifying subtle patterns that the AI could not detect.
Lesson: While the incorporation of AI in the SOCs' infrastructure ensures that human analysts are not overwhelmed by the large number of logs and alerts, the process of triaging the logs and alerts cannot be replaced by AI, but by human Analysts.
3. Context Matters in Automation
AI systems work best when they understand the environment they are operating in, and they are aligned with it. What this means is that any built AI model cannot just apply generally without considering the specific organization where it will be deployed. When AI rules are generalized, their application when deployed in the production environment can trigger unnecessary alerts or miss the real threats.
For instance, an AI-driven Security Information and Event Management (SIEM) configured with a generic rule such as “alert after three failed login attempts within five minutes,” might work well in some industries but not in others. This could lead to the generation of false alerts when deployed to certain environments, take, for instance, a university setting environment where there are many students who mistype their passwords when logging into their accounts. Therefore, this type of AI solution should be configured based on the peculiarity of the environment it will be deployed in, so as not to overwhelm the security analyst with unnecessary alerts capable of diverting their attention from attending to true positive threats.
Lesson: The AI model should always be adapted to fit into organizations’ specific operating environment."
4. Continuous Learning and Adaptation
It is becoming obvious that regulations and frameworks are lagging when compared to the pace at which cybercriminals are ramping up with their TTPs. This is becoming obvious and explains the reasons why framework review has to be given utmost attention, and AI models' continuous retraining must be required. For instance, a deployed ML model designed to flag phishing emails based on the mail subject lines, sender reputation, and suspicious links can be manipulated by the attackers using AI-generated text. With the AI-generated text, the new attacker's tactics can bypass and compromise the system, making the AI-generated text appear authentic. Once the deployed ML models are not retrained, the attackers would succeed in infiltrating the system.
Lesson: AI-powered systems must be retrained and validated continuously by incorporating real-life samples, which would enable the AI system to evolve with the attackers' strategies and stay ahead of their TTPs.
5. Explainability and Trust
Explainable AI provides clarity behind every prediction and outcome. When stakeholders such as security analysts can’t understand how an AI system makes decisions, the probability of trusting or relying on such a system becomes very low. The implication is that it becomes very challenging to trace decisions or assign accountability when anything goes wrong with the system, and this is termed a ‘black box.’ This concept also becomes a major issue within regulated industries, where the reason behind why an event was flagged as suspicious is needed by the regulators, and no one is available to provide clarity on it. For instance, a deployed healthcare cybersecurity AI tools that is understood and which explain different alerts will prove more effective than one without it. The implication of this for the security analyst is that they could easily and quickly validate warnings, report incidents, and present to auditors any queries raised on certain actions.
Lesson: To foster trust and improve response times, cybersecurity analysts must prioritize fairness, accountability, transparency, and explainability in AI models, and doing so not only strengthens operations but also supports compliance with regulations like ISO 42001, HIPAA, GDPR, the EU AI Act, and NIS.
Recommendations for Successful Deployment of AI Systems
To successfully deploy AI-Powered Security Automation, organizations should adhere to the following
- Ensure that the designed AI solutions are not generalized but designed for specific use cases. The designed solution must also be piloted before rolling it out for optimal results.
- Comprehensive and representative high-quality datasets must be embedded in the AI systems, and the same must be regularly updated.
- Implement Human-in-the-Loop Systems, which combine human judgment with AI efficiency.
- Establish that AI models are monitored and retrained to adapt to new threats.
- Ensure that the AI design and the results are understandable and interpretable to relevant stakeholders.
Conclusion
AI-powered security automation is no longer futuristic but now lives with us, especially in the face of continual innovations by cyber-attackers. While the deployed AI system enhances productivity, rapid threat detection, and prompt responses, the concepts of fairness, privacy, trust, and transparency must also be embedded in the AI solutions to conform to global regulatory frameworks and standards.
However, the lessons from live deployments have taught that quality data, human collaboration, contextual awareness, continuous learning, and explainable AI must be upheld for optimal AI solution performance. Consequently, for organizations to stay proactive in their defense strategies, incorporating human analysts into the system is key to focusing on what really matters.