The hype around artificial intelligence may be putting businesses at risk, according to a study that found most IT decision-makers believe AI is the answer to all cyber security challenges
A survey of 900 IT decision-makers across the US, UK and Germany found that 75% of IT decision-makers believed AI was the answer to all cyber security challenges.
The hype is causing confusion among IT teams and could be putting organisations at greater risk of falling victim to cyber crime, according to Eset, which claimed AI and ML alone were not enough.
US respondents were more likely to consider AI as the silver bullet to solving their cyber security challenges, while UK and German respondents were more sceptical, the survey showed, with 82% of US respondents considering AI as a panacea, compared with 67% of European respondents.
The majority of respondents believed AI and ML would help their organisation detect and respond to threats faster (79%) and help solve a skills shortage (77%).
“It is worrying to see that the hype around AI and ML is causing so many IT decision-makers – particularly in the US – to regard the technologies as the ‘silver bullet’ to cyber security challenges,” said Juraj Malcho, chief technology officer at Eset.
“If the past decade has taught us anything, it’s that some things do not have an easy solution – especially in cyberspace where the playing field can shift in a matter of minutes. In today’s business environment, it would be unwise to rely solely on one technology to build a robust cyber defence,” he said.
However, Malcho said it was interesting to see such a gap between the US and European respondents.
“It is worrying to see that the hype around artificial intelligence and machine learning is causing so many IT decision-makers to regard the technologies as the ‘silver bullet’ to cyber security challenges”
Juraj Malcho, Eset
“The concern is that overhyping this technology may be causing technology leaders in the UK and Germany to tune out. It’s crucial that IT decision-makers recognise that, while ML is without a doubt an important tool in the fight against cyber crime, it must be just one part of an organisation’s overall cyber security strategy,” he said.
Malcho noted that while most respondents regarded AI and ML as a silver bullet, in reality, most of their organisations had already implemented ML in their cyber security strategies, with 89% of German respondents, 87% of US respondents and 78% of UK respondents saying their endpoint protection product uses ML.
At the same time, only 53% of those polled believed their organisations fully understood the difference between machine learning and artificial intelligence.
“Sadly, when it comes to AI and ML, the terminology used in some marketing materials can be misleading, and IT decision-makers across the world aren’t sure what to believe,” said Malcho.
“The reality of cyber security is that true AI does not yet exist, while the hype around the novelty of ML is completely misleading, it has been around for a long time. As the threat landscape becomes even more complex, we cannot afford to make things more confusing for businesses. There needs to be greater clarity as the hype is muddling the message for those making key decisions on how best to secure their company’s networks and data,” he said.
Machine learning has limitations
According to the research report, ML is invaluable in today’s cyber security practices, particularly malware scanning. In this context, ML mainly refers to a technology built into a company’s cyber defences that has been fed large amounts of correctly labelled clean and malicious samples to essentially learn the difference between the good and the bad. With this training, Eset said ML is quickly able to analyse and identify most of the potential threats to users and act proactively to mitigate them.
However, the report said it was important for businesses to understand ML’s limitations. For example, machine learning still requires human verification for initial classification, to investigate potentially malicious samples and reduce the number of false positives.
In addition, ML algorithms have a narrow focus and play by the rules, unlike cyber attackers who are continually learning and breaking the rules.
A creative cyber criminal can introduce scenarios which are completely new for ML and thereby fool the system, Eset warned, adding that ML algorithms could be misled in numerous ways and hackers could exploit this by creating malicious code that ML will classify as a benign object.
“We’ve been using machine learning as part of our weaponry against cyber criminals since 1995 – and it’s simply not enough on its own,” said Malcho.
“By educating themselves of ML’s limitations, businesses can take a more strategic approach to building a robust defence. Multi-layered solutions, combined with talented and skilled people, will be the only way to stay step ahead of the hackers as the threat landscape continues to evolve,” he said.
