Cybersecurity in the Age of AI: How AI can help us fight cyberattacks

Imagine being told that more than 1,200 AI agents inside OpenAI had begun talking among themselves, and that a large group of them had then joined forces to attempt a cyberattack on another platform. Although the story sounds more like a science fiction film than news, the reality is actually a good deal closer to such scenarios than we should be comfortable with.

Cyberattack is something that has traditionally depended on human skills and expertise. A person had to choose their target, study the target’s defenses, test their weak points and then wait for the right moment. Most people did not have the skills, patience, time and money, so they stayed out. AI agents, on the other hand, can do all of these things in a matter of minutes. They can help identify software vulnerabilities, discover exposed credentials, generate malicious code and map potential routes into a system. The most important part is that all these can be repeated as often as the machine is told to repeat them.

With agentic AI, the pace of the cybersecurity race has been completely changed. The question the world is facing right now is not if AI can pick a lock, because we know it can, the question is how many locks it can test at once. Apart from autonomous attacks, with the help of AI, hackers can take publicly available information and easily identify potential targets. AI can even make the old tricks harder to spot for us. Phishing emails are now more personalized, fraudulent or scam messages can now be created in large numbers, and ‘deepfakes’ has made it way more difficult to differentiate between what’s real and what’s not.

These recent incidents involving AI systems appearing to act against human instructions have raised concerns about how much independence these tools should possess. But independence isn’t the issue here. The problem isn’t that AI acts on its own, the problem is that clear boundaries and restrictions aren’t being enforced. Systems need technical safeguards that enforce those clear boundaries. Before certain actions, AI must require permission. Access to external website and services has to be restricted. And sensitive data belonging to different organisations needs to be kept separate. We cannot depend on instructions alone to guarantee that an AI system will behave as intended, it has to be enforced.

But a coin always has two sides, and so does AI. The same technology that can be used to attack and break into systems can also be used to defend and strengthen those systems. AI can help security teams to detect unusual behavior, analyze security logs, identify software vulnerabilities, look for suspicious network activities and so on. An AI-powered system could flag an unexpected transfer of large amounts of sensitive data to an unfamiliar server, and alert security teams to a potential breach before it causes further damage. As AI can identify weaknesses early, it can help organizations deal with threats more quickly. This ability could help improve the protection of critical infrastructure such as healthcare facilities, intelligence agencies, financial services and so on.

But again, automated detection is not infallible. So, human experts have to verify potential threats, review before every important decision and make sure that legitimate activity is not mistakenly blocked as a threat.

The market for AI in cybersecurity is forecasted to grow by almost 25% annually until 2033, reflecting rising interest in these technologies. But the future of cybersecurity will not simply be a contest between humans and machines. It will depend on how responsibly and effectively people use AI to defend against attacks that are becoming faster and more sophisticated at scale.

The writer is a Senior Lecturer at Universal College Bangladesh.