Why CISOs Need to Fully Embrace AI

I’m not the first to say it, but it’s a statement worth repeating: Artificial Intelligence (AI) is a game-changer for cybersecurity. If we trust AI and use it well, it will be a vital addition as a technologically advanced partner to the humans on our cybersecurity teams. If we fail to fully embrace AI, bad actors will use it as a weapon to overwhelm us.

AI is a double-edged sword in cybersecurity. Right now, the edge seems to be on the side of the cybercriminals. They use AI to accelerate and scale attacks, making many tactics, techniques, and procedures (TTPs) far more effective.

For example, by using off-the-shelf tools like ChatGPT, scammers can make their business email compromise (BEC) and phishing attacks more targeted and realistic. Would-be criminals with lower levels of expertise are using AI to launch far more sophisticated attacks than they would be if left to their own devices. What we’re seeing now is just the tip of the iceberg.

Although AI has been around for a long time, it is still in its relative infancy in cybersecurity. Remember, ChatGPT has only been available since November 2022. Much of AI learning will be around the application stack as it evolves. It’s only a matter of time before hackers use AI extensively to exploit software code.

What AI Can Do to You

Cybercriminals are always searching for innovation and new attack methods. It’s a simple business model: Whatever works. They already use AI effectively and are eager to use it more extensively.

Given these challenges, many CISOs are already wary of what AI may do to them instead of what AI may do for them. A London-based cybersecurity consulting company conducted a recent survey of 250 CISOs. Eighty percent of respondents said they believe AI is the most significant cyber threat to their businesses—and a whopping 81% believe the risks of AI outweigh the advantages.¹

This thinking, while understandable, is also short-sighted. We can’t control the tools and technologies used by cybercriminals. And they will use AI exponentially—especially if we don’t build strong defenses against AI-generated and AI-based attacks. If we rely solely on humans to defend against AI-based attacks, we are fighting with one hand tied behind our backs.

How do we build those defenses? In my opinion, the only way is to fight AI with AI.

What AI Can Do for You

The reality is that AI can do specific jobs faster and more accurately than humans can. It can iterate more quickly than any human; it can craft code in less time than a human would. A single AI can do the job of 10 people if used for the right functions. AI is becoming more capable with each passing day.

In today’s environment, we use AI to get alerts, monitor, and react to threats. Within the next year, we will use AI to monitor alerts and take independent actions.

Why? Because humans are not fast enough to keep pace with the threat landscape. We have to allow AI to do what it does with appropriate limitations. To allow AI to take independent actions, we must define its rights and responsibilities. Perhaps most importantly, we must trust it to do its job, just as we place trust in the humans on our cybersecurity teams.

Another Member of the Team

If you don’t use AI right, it’s a useless tool that could make your organization less secure. As CISOs, I think one of our most important responsibilities is to create and nurture the culture of our organizations. If we embrace AI as a necessary tool, our teams are much more likely to embrace it.

I suggest an interesting way to think about AI—as another employee, a co-worker on the cybersecurity team with a lot of autonomy and the ability to execute important tasks comprehensively, accurately, and with enormous speed.

CISOs and our teams must be willing to trust AI to do many of the rote tasks that can bog down human workers. That means carefully evaluating what AI can do effectively, now and into the future, as the technology continues to evolve. Where does it supplement our humans, where can it take over the work of humans, and where can humans use it to be more effective? What tasks may be susceptible to human error that can be performed faster, better, and with less risk by AI?

We also must ensure that we are using AI responsibly. That means carefully crafting audits to expose errant actions. For companies in highly regulated markets, as we are at Better, we must take extra precautions when using AI. The same goes for other companies in finance or fields like healthcare. There are nuances to using AI. In our field, for example, we are concerned with potential discrimination. In healthcare, a medical misdiagnosis can have devastating consequences.

Time to Join the Bandwagon

The ideas and even the cautions I’ve raised in this article are all factors to consider in determining how to use AI most effectively as a proactive, preventive, and, in many cases, defensive tool in the arsenal of our cybersecurity teams. The key point is that we should be thinking about how to use AI and not whether to use AI.

Fortunately, as CISOs, we are not alone. We have a community of support and shared knowledge. We have solid and innovative partners in the vendor community who have the resources—and the motivation—to invest in AI-powered solutions that can help us all.

We already see AI being used positively in real-time threat intelligence and response, automated incident response, behavioral analytics, security information and event management (SIEM), fraud detection, and more.

Looking ahead, I see tremendous opportunities to use AI in code patching and code generation, identifying bad code and fixing vulnerabilities automatically, completing those tasks faster and more accurately than the humans on our team. Humans free from those tasks have more time to build features that can generate revenue.

There will be a learning curve in using AI to strengthen our defenses, just as there is a learning curve for cybercriminals exploiting our vulnerabilities. We can’t afford to let the bad guys get too far ahead of us on the curve. If they do, they will use AI to overwhelm us.

Now is the time for CIOs and our teams to embrace AI, recognize that AI is a game-changer in cybersecurity, and build a culture around securely adopting and trusting it.

Better is a pioneer in using digital technology to make home ownership simpler, faster, and more accessible.

1. Chris Middleton, “Why 80% of CISOs see AI as the biggest threat to their business,” Diginomica, October 11, 2023.