How reliable is AI-assisted cybersecurity?

12 Tem 06:42

While AI-powered cybersecurity is revolutionary in terms of optimization and threat analysis, there are several key points to consider when evaluating its reliability. First and foremost, the effectiveness of AI in threat detection is directly tied to the quality and diversity of the data it's trained on. For example, AI models trained on the MITRE ATT&CK framework can recognize attack behaviors with 85-90% accuracy. However, there's also the risk of "false positives"; according to Noise Security’s 2023 report, AI-powered systems in a mid-sized SOC generate around 1,200 alerts per day, with only 30% of them being related to actual threats. This makes manual review a necessity. On the other hand, the concern that AI could be turned into an attack tool is very real. We're seeing cybercriminals using AI to carry out zero-day attacks (such as automated vulnerability research using fuzzing techniques) and targeted phishing (using deepfake audio/video). According to Kaspersky’s data, deepfake-based attacks increased by 400% in 2023, and the open rate for AI-powered phishing emails reached 68%. The key takeaway here is that AI’s use in both defense and attack is fueling an "arms race." In conclusion, while AI is a useful tool in cybersecurity, there are still significant doubts about its ability to operate fully autonomously. From the perspective of an OSCP-certified pentester, I see AI as a "safety net"—it handles basic filtering and prioritization, but critical decisions and human intuition are essential in situations requiring nuanced judgment (such as countering sophisticated techniques used by APT actors). Organizations should position AI as an "expert assistant" and continuously optimize human-AI collaboration.