More than a year ago (January 2024), I gave a presentation at a meeting entitled "Crime and new technological frontiers", held at the University of Trieste and aimed mainly at local police forces. A major focus of the meeting was, needless to say, the cybersecurity implications of so-called artificial intelligence.
My opinion was quite strong and somewhat unpopular (as is often the case):
- We should not be particularly worried.
- There is no significant evidence of AI usage for phishing/spearphishing.
- I think this fact will hold for a long time.
- The main AI-related risk in cybersec is "getting distracted by its promises": for MANY serious problems we have practical and effective solutions...but we don't apply them!
Every year, cybersecurity companies publish a report summarising the main trends they have observed. A few days ago, I read two commentaries on the 2024 data that confirmed my opinion.
This is Kevin Beaumont:
- My main observations: Firstly, no mention of generative AI or GenAI again. This is in common with Sophos incident response, ESET, etc etc etc...
- Everybody is busy worrying about AI while all their documentation about their systems and risks are in JIRA, Confluence, SharePoint etc that attackers just read...
- The long story short about why GenAI is missing from all of the data is vendors have blown the threat wildly out of proportion - AI is porn for execs - and why build a rocket launcher when you can just pick up the key from under the front door mat. Concentrate on security fundamentals, threat actors want you to be distracted.
And, this is Kelly Shortridge:
- Last year, I noted that attackers aren’t using GenAI. They still aren’t, really. And when they do, it doesn’t seem to make much of a difference...I suspect GenAI provides more ROI for aspiring CISO thought leaders on LinkedIn than most attackers.
The slide of my talk are here (italian only). Perhaps I should emphasise once again that my talk was addressed to police forces and considered a relatively short time horizon - a few years. I certainly do not want to downplay the importance of so-called AI: it will certainly change a lot of things in many areas, and cybersecurity will be no exception. However, I am convinced that neither attackers nor defenders will find the ultimate silver bullet in AI.
On a different but related note, this morning I gave a speech entitled Cybersecurity and New Risks: Are we Prepared?, where "we" means "Italy". My opinion was, once again, quite strong and somewhat unpopular: you can imagine my answer.
Commenti