‘It’s an arms race’: AI has the cybersecurity world on high alert

The vast majority of phishing attacks, which may account for up to 90% of cyberattacks that result in a data breach, come from countries where English is not the first language, often in Eastern Europe or Russia.

When you got an email, text or social media message where the English was “off” — whether the grammar was incorrect or the phrasing was just awkward — it was a tell that the message wasn’t coming from, say, your bank or a hiring manager for a local company.

That tell is all but gone in these early days of generative artificial intelligence. ChatGPT may not know what happened yesterday, but it can craft an email in perfect American English every time.

That’s bad for people and companies who may now be more susceptible to falling for phishing scams, but it’s not bad for the cybersecurity industry. Between improved text copy, voice spoofing and the looming threat of deep fakes, cybersecurity is more of a necessity than ever. And since AI is also used increasingly aggressively in cybersecurity, it’s game on.

AI: the new smartphone?

Steve Piper, founder and CEO of the Annapolis, Maryland-based CyberEdge Group and a speaker at Cybersecurity Marketing Society’s CyberMarketingCon in Austin, contextualizes the impact AI will have on our lives by comparing where we are now to where we were in the late aughts, when most people held a smartphone for the first time.

“I held an iPhone 1 in my hand, the very first very first one, and I just thought it was amazing,” Piper told Technical.ly. “But I had no idea how smartphones were going to change my life. … If you think about comparing the first time you held a smartphone to what you know today, you had no clue how it was going to impact your life. You had no clue. That’s artificial intelligence.”

Cybercrime will get more and more sophisticated — but so will cybersecurity. Matt Barnett, CEO of the King of Prussia, Pennsylvania cybersecurity firm SEVN-X and co-producer of the upcoming AI weaponization documentary “Inhuman,” points out that while things like voice spoofing are becoming more difficult for the human ear to detect as AI, AI itself is capable of telling the difference.

“One of the things it’s really hard to get right [with deepfake audio] is the way that we naturally talk,” Barnett told Technical.ly. “We have inflection and tone and there’s a randomness, almost, to our voice in our vocal patterns that it’s kind of hard for a computer to get right. But it’s also really easy for a computer to diagnose when something is made by AI. So the soundbite is that the best tools for detecting the use of AI are actually AI.”

The AI arms race

When the best tools to both cause and prevent cybersecurity destruction are AI, we have what Piper aptly described as an “arms race”: AI makes a cybercrime easier, AI learns how to thwart it, AI evolves to evade that detection, and on and on.

“We have an early sense of how [AI] ultimately is going to help cure diseases,” Piper said. “But the bad guys may use it to create new diseases. In the world of cybersecurity, there’s a lot of benefits to the good guys, and security vendors have created new capabilities to detect threats that were never possible before because of artificial intelligence and machine learning. So our ability to detect threats is much, much, much better. But now the bad guys are using artificial intelligence to create more sophisticated threats.”

Most large companies keep up by investing in state-of-the-art cybersecurity services and products. While it can’t be overstated that we’re still in AI’s infancy, Piper’s company produces an annual Cyberthreat Defense Report that has shown that today’s cybersecurity is, in fact, keeping up. Around 1,200 security professionals from 17 countries are annually asked whether their organization of 500-plus employees was victimized by a successful attack that year.

“For the first time ever, we saw a two-year consecutive decline in successful attacks,” Piper said. “Now it’s gone from horrible to slightly less horrible to slightly less horrible. And what I mean by that is, in 2021, it was 86%, 2022 85%, 2023 84.7[%]. The bleeding has stopped. It’s not getting worse, things are getting just a tiny little bit better. Because in recent years, organizations are embracing machine learning to detect cyber threats in ways never before possible.”

The data suggests that medium to large businesses, at least, are gaining a slight upper hand over cyber criminals.

But what about individual consumers? They’re at a disadvantage, per Piper.

“Individuals often don’t invest in leading-edge cybersecurity defenses,” he said. “They don’t have firewalls to protect them, and they typically don’t have purpose-built email security and web security. They have antivirus software, if they even have that, and maybe their subscription ran out because they forgot to renew it. So I think AI is going to give cybercriminals the upper hand in terms of attacking individuals, because individuals are not taking advantage of new innovations in cybersecurity defenses.”

Protecting yourself from AI cybercrime

As an individual, there are ways to protect yourself without expensive high-end cybersecurity.  Chris Glanden, founder of the Delaware-based BarCode Security brand and producer of the “Inhuman” documentary, noted that data about individual users is collected all the time. That data can be used to make cyberattacks on individuals much more targeted. Not only can AI be used to collect voice data for voice phishing scams, it can also learn details like where you work and who you’re related to.

“Be cautious of the information that you provide, because if you’re talking about the general population, I think chatbots are probably the number-one use case of AI technology right now,” Glanden said. “Anyone and everyone now is using ChatGPT in some way, so from a data privacy standpoint, I would not recommend feeding it any sensitive data about yourself, just because you don’t know exactly where that’s being stored and how it may be used later.”

Plus, Barnett noted that what you type while you’re chatting with, for example, a customer service bot, is showing up somewhere even before you hit send, in real-time.

“I don’t think people really truly understand or grasp that,” he said. “… The keystrokes that they put in before they hit enter are actually captured.”

It’s all enough to make some people want to shut AI down altogether, out of fears that the technology will overtake humanity — even, potentially, leading to an extinction event. (The odds of this are not high, but they’re not zero.)

But like other technological advances over the last century, AI also can improve society. It’s already on its way to being a part of our everyday lives, for both bad and good.

“If you think about the internet, it’s a blessing and a curse, right?” Piper said. “We can be victims of identity fraud, or cyberattacks, and so many horrible things happen because of the internet and social media and whatever.

“But I think the vast majority of people would agree that the internet is a net positive on our lives,” he said. “I am really hoping that artificial intelligence is also a net positive on our lives.”