With AI maturing, are humans still needed to fight cybercrime?

Cybercriminals are clever, and AI cannot always account for that. This is where cybersecurity and AI professionals come in.

Image: iStockphoto/metamorworks

Experts are urging caution and expressing doubts that artificial intelligence (AI) is the end-all answer when it comes to cybersecurity. AI will likely help immensely, but we shouldn’t start celebrating that cybercriminals will soon find themselves unemployed.

Major Jimmy Housley, Commandant of the Marine Corps Fellow at the United States Chamber of Commerce, is one of those experts. In his Chamber of Commerce commentary, Beyond the Hype – Artificial Intelligence in Cybersecurity, Housley writes, “While AI systems support cybersecurity by enabling prevention or detection and resolution of threats, they should not be considered the panacea to all cybersecurity problems.”

SEE: Incident response policy (TechRepublic Premium)

More about cybersecurity

AI as a disruptive force

When it comes to how cybersecurity will benefit from AI applications, and why Housley is concerned, he references a an October 2020 webinar hosted by the Chamber of Commerce’s Cyber, Intelligence, and Supply Chain Security Division. Housley recounts that, during the webinar, Caesar Nieves, senior vice president and general manager for cyber at Jacobs, offered an accurate, yet straightforward, definition of AI: “AI is the ability for machines and technology to take on tasks and services that would normally require humans.”

Next, the discussion during the webinar looked at how AI will benefit and enhance cybersecurity programs. “The challenge in cyber is that you sometimes have very subtle signals pointing to anomalies, and you must move beyond the human scale to see that drift from normality in complex enterprises,” explained Albert Biketi, vice president of security business at Splunk. “Moreover, you must understand those subtle signals and respond to them at machine speed. This is where the power of AI potentially provides the most value.”

Housley, who agrees, offers the 2016 Cyber Grand Challenge hosted by DARPA as an example. “Teams developed cyber reasoning systems that could identify software flaws, formulate patches, and deploy them in real-time,” writes Housley. “This was a remarkable feat and showcased the effectiveness of AI systems at supporting security efforts.”

Other areas where AI excels are:

Network monitoring is particularly useful because AI can build an infrastructure baseline profile of a company’s normal digital activity. Using that profile, tools (also driven by AI) can detect anomalies–for example, phishing attacks.

Nieves also stated, “Operationally, we are under cyberattack every second, and AI allows us to target malicious code and other intrusions at scale to achieve faster decision-making versus attempting manual triage.”

With AI, think carefully about outcomes and oversight

It’s time to discuss what’s troubling these same experts. Once again, we seem to be heading down a path where we become overly reliant on new technology without taking the time to discern what is being lost or traded away by being fully invested in the technology–in this case, AI.

Biketi, with 20-plus years of cybersecurity experience, has already witnessed some indications. “We’ve seen evidence of AI applications demonstrating skewed results and anti-patterns in terms of the outcomes that you should be driving as a society or even as a business,” explains Biketi. “People need to look at these technologies with very clear scoped outcomes in mind and a sense of oversight regarding how these technologies are applied or audited.”

Shortage of skilled workers to maintain AI systems

Whether you believe AI alone or AI with human intervention is the ultimate answer needs to take a back seat to a more pressing issue. Biketi and Nieves believe there is a severe shortage of skilled hardware and software professionals who are capable of using and maintaining AI systems.

The shortage of qualified professionals is not new–it has been a concern for several years. What is relatively new is cited by Haris Elias in his TechHQ commentary Will cybersecurity pros be ousted by automation?. Elias gathered information for his article from Exabeam’s 2020 Cybersecurity Professionals Salary, Skills and Stress Survey, which not only looks at the question brought forth by the title of his article, but the growing concern among people under the age of 45 that AI is a real threat to their job security.

“Professionals within cybersecurity are tasked with defending very expensive, digitalized companies from increasingly sophisticated cyber attacks,” writes Elias. “We already know that’s a stressful gig that takes a hefty mental toll. But now there’s another concern looming–that their job could be at risk of replacement by robots.”

SEE: Hiring Kit: Security architect (TechRepublic Premium)

What’s the answer?

To recap, depending on which side of the fence you’re on, AI capable of finding anomalies in massive databases will eventually replace humans; or, humans will remain an essential piece of the puzzle because of the ability to handle ambiguous situations related to cybersecurity.

Housley believes what is of utmost importance is to leverage the best of both worlds. This will ensure individuals drawn to the fields of AI and cybersecurity will get to worry about cyber bad guys instead of whether they will have a job.