1 - Impersonation of trusted users
AI attacks will be highly tailored yet operate at scale. These malwares will be able to learn the nuances of an individual’s behaviour and language by analysing email and social media communications. They will be able to use this knowledge to replicate a user’s writing style, crafting messages that appear highly credible. Messages written by AI malware will therefore be almost impossible to distinguish from genuine communications. As the majority of attacks get into our systems through our inboxes, even the most cyber-aware computer user will be vulnerable.
2 - Blending into the background
Sophisticated threat actors can often maintain a long-term presence in their target environments for months at a time, without being detected. They move slowly and with caution, to evade traditional security controls and are often targeted to specific individuals and organizations. AI will also be able to learn the dominant communication channels and the best ports and protocols to use to move around a system, discretely blending in with routine activity. This ability to disguise itself amid the noise will mean that it is able to expertly spread within a digital environment, and stealthily compromise more devices than ever before. AI malware will also be able to analyse vast volumes of data at machine speed, rapidly identifying which data sets are valuable and which are not. This will save the (human) attacker a great deal of time and effort.
3 - Faster attacks with more effective consequences
Today’s most sophisticated attacks require skilled technicians to conduct research on their target and identify individuals of interest, understand their social network and observe over time how they interact with digital platforms. In tomorrow’s world, an offensive AI will be able to achieve the same level of sophistication in a fraction of the time, and at many times the scale.
Not only will AI-driven attacks be much more tailored and consequently more effective, their ability to understand context means they will be even harder to detect. Traditional security controls will be impotent against this new threat, as they can only spot predictable, pre-modelled activity. AI is constantly evolving and will become ever-more resistant to the categorization of threats that remains fundamental to the modus operandi of legacy security approaches.
Incorporating AI in the digital ecosystem
As we increasingly rely on connected systems and devices, we are quickly developing a highly advanced and heavily connected digital ecosystem. We will require partnerships and capabilities that prioritize winning the strategic battles that count – and safeguard not only economically valuable data held by the public and private sectors, but the confidence in digital systems that underpins social cohesion and democratic institutions.
Investment in new technology will play a critical role in this emerging reality and evolving ecosystem. According to Forrester’s Using AI for Evil report, “mainstream AI-powered hacking is just a matter of time”. Indeed, as we begin to see AI become part of the cyber attacker’s toolkit, the only way that we will be able to combat this malicious use of AI is with AI itself. Therefore, incorporating the technology into this ecosystem is crucial.
Counterattack: Fighting machine with machine
The cybersecurity community is already heavily investing in this new future, and is using AI solutions to rapidly detect and contain any emerging cyberthreats that have the potential to disrupt or compromise key data. Defensive AI is not merely a technological advantage in fighting cyberattacks, but a vital ally on this new battlefield. Rather than rely on security personnel to respond to incidents manually, organizations will instead use AI to fight back against a developing problem in the short term, while human teams will oversee the AI’s decision-making and perform remedial work that improves overall resilience in the long term.
AI-powered attacks will outpace human response teams and outwit current legacy-based defenses; therefore, the mutually-dependent partnership of human and AI will be the bedrock of defense strategies in the future. The battleground of the future is digital, and AI is the undisputed weapon of choice. There is no silver bullet to the generational challenge of cybersecurity, but one thing is clear: only AI can play AI at its own game. The technology is available, and the time to prepare is now.