Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

AI in Security Carries as Many Questions as Answers

Companies are adopting machine intelligence even though there are still issues and questions regarding its performance, a new report on AI use in cybersecurity shows.

Nearly three-quarters of all organizations have implemented security projects that have some level of intelligence built in. And the more security alerts a company sees in a day, the more likely it is to look to machine intelligence in order to deal with the flood.

Those are just two of the conclusions reached in a new white paper, "The State of AI in Cybersecurity: The Benefits, Limitations and Evolving Questions," published today by Osterman Research. The report, based on more than 400 surveys of organizations with more than 1,000 employees, asked questions about the use of AI and the results of that use.

"AI is certainly, thanks to very strong marketing, winning the hearts and minds, not of the practitioners but of the broader executive suite," says Ramon Peypoch, chief product officer of ProtectWise, which sponsored the Osterman research. "They're being taken with the idea of allowing teams to do more and be more productive."

While companies are definitely employing machine intelligence in security, the perception of its value is not universally positive. According to the report, 60% of organizations employing AI think that AI makes investigations of alerts faster. The same proportion report that AI improves the efficiency of their security staff.

The more an organization employs machine intelligence, the more positive its perception of the technique's effectiveness. In companies that have deployed machine intelligence in 10% or less of their security applications, 49% see it speeding their research of alerts. In those companies employing machine intelligence in more than 10% of their security, that number rises to 69%.

Still, machine intelligence isn't perceived as perfect. Some 60% of responding organizations say that it doesn't deal with zero-day or advanced threats, and roughly half complain that it generates too many false positives. These issues are due at least partially, say some experts, to the difficulty in properly training machine learning engines.

"You have very few machine learning professionals that can handle and clarify and gain meeting from the data," says Heather Lawrence, a researcher at the Nebraska Applied Research Institute. She points out that machine learning professionals are rarely experienced in cybersecurity, while cybersecurity experts tend to have no real data science experience. The disconnect slows improvement and wide, effective deployment. "You still need somebody who can understand the data going in and the data going out. It hasn't yet been automated to a point where you can remove the professional to actually get meaning from the data," Lawrence explains.

Peypoch looks at data in the report and sees future progress that is almost inevitable. "AI is one tool for driving efficiencies. It can make your limited staff more effective, but it's not going to replace human staff anytime soon," he says. "AI is an approach, a journey for most organizations deploying it, and I think we're at an early point of deployment, of maturity and sophistication."

Searching for a ready metaphor for the current state of adoption, Peypoch turns to sports. "I don't think we're even in the first inning; the teams are still on the field warming up prior to the game starting."

Related content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 New Cybersecurity Vulnerabilities That Could Put Your Enterprise at Risk
In this Dark Reading Tech Digest, we look at the ways security researchers and ethical hackers find critical vulnerabilities and offer insights into how you can fix them before attackers can exploit them.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17475
PUBLISHED: 2020-08-14
Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000.
CVE-2020-0255
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-10751. Reason: This candidate is a duplicate of CVE-2020-10751. Notes: All CVE users should reference CVE-2020-10751 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-14353
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-18270. Reason: This candidate is a duplicate of CVE-2017-18270. Notes: All CVE users should reference CVE-2017-18270 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
CVE-2020-17464
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-17473
PUBLISHED: 2020-08-14
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting token by impersonating the server.