New threats, kind of like the old threats: Why AI makes speed the ultimate cybersecurity defense

Recent cybersecurity headlines have given us plenty of reasons to worry about what AI can do.

While the new risks are real, safety is a conversation that pops up with nearly every big tech advancement, and old-school practices can still go a long way.

Last week, researchers disclosed that AI had helped uncover critical vulnerabilities in PHP, the programming language used by roughly 70% of websites. We later learned that unauthorized users had already been exploiting the flaws for days.

AI didn’t create these vulnerabilities, and malicious actors will always exist.

“All novel attacks are novel,” Isaiah King, assistant professor at American University, told me. “If an AI finds an exploit or a human finds an exploit, it’s always going to be something we didn’t think of before.”

What is changing is the speed. AI tools can help attackers turn newly discovered flaws into working exploits faster, and target more systems at once.

“It just might be that you have to update your operating system more often than in the past because they’re finding stuff faster now,” King said.

Then there’s the human factor. AI can make phishing messages more convincing. But phishing emails were already becoming more sophisticated, an OECD report from 2020 noted, as attackers continue to exploit traits like trust, distraction and emotional responses. 

“There are just certain things within human beings that don’t seem to change in terms of how we are susceptible to certain types of stimuli,” John D’Arcy, a professor at Temple University’s Fox School of Business, told me.

Human behavior will remain a factor in cybersecurity, even as technology changes. 

Basic cyber hygiene is something many of us know we should practice, but it’s worth repeating because the biggest change AI could bring is that there may be less time to respond.

Install software updates. Check who has access to your accounts and systems. Turn on multifactor authentication. Secure passwords, API keys and other sensitive information.

Then do it all again, even when no one’s talking about it. The industry standards you’re probably sick of hearing about can still help protect against AI-enabled threats — as long as you use them.

“There’s always been this issue where, even something as simple as a software patch, organizations are reluctant to take a system down to have any type of downtime to address that,” D’Arcy said. “Maybe now they don’t have a choice.”