Security teams turn to AI to fight hackers

Blue outline of head with AI inside

Security teams are increasingly reliant on machine learning and AI tools to cope with the sheer volume of security threats they face, according to new figures.

More than 70% of 3,600 organisations across 26 countries said they were mostly or entirely reliant on AI, automation and machine learning in order to help cope with the amount of threats faced by businesses, according to Cisco's 2018 Security Capabilities Benchmark Study, released today.

The high volumes of intrusion attempts made on many organisations - in the UK, for example, councils face an average of 27 attacks per minute - often result in huge volumes of event logs, which can be impossible to sift through by hand. This task is made even more difficult by malware that uses encrypted traffic - in which Cisco researchers saw a 300% increase over 12 months.

Instead, many businesses are turning to AI tools, the network vendor claimed, because these can automatically learn what is and is not a normal event, and flag high priority items to security staff.

Similarly, behavioural analytics tools can automatically detect what a given user's normal behaviour is and can identify when an account is acting suspiciously, which may indicate a compromised account or a malicious insider. A total 92% of security professionals said these tools work either very or extremely well.

In order to try and cope with the growing breadth and scale of attack attempts, organisations are deploying an increasing number of tools.

A quarter of respondents to the study reported using security products from between 11 and 20 vendors, an increase of 7% from the previous year. The number of organisations using between 21 and 50 vendors more than doubled, and 5% reported using more than 50 vendors' products.

"Last year's evolution of malware shows adversaries are becoming wiser at exploiting undefended gaps in security," said John N. Stewart, senior vice president and chief security and trust officer at Cisco. "Like never before, defenders need to make strategic security improvements, technology investments, and incorporate best practices to reduce exposure to emerging risks."

Adam Shepherd

Adam Shepherd has been a technology journalist since 2015, covering everything from cloud storage and security, to smartphones and servers. Over the course of his career, he’s seen the spread of 5G, the growing ubiquity of wireless devices, and the start of the connected revolution. He’s also been to more trade shows and technology conferences than he cares to count.

Adam is an avid follower of the latest hardware innovations, and he is never happier than when tinkering with complex network configurations, or exploring a new Linux distro. He was also previously a co-host on the ITPro Podcast, where he was often found ranting about his love of strange gadgets, his disdain for Windows Mobile, and everything in between.

You can find Adam tweeting about enterprise technology (or more often bad jokes) @AdamShepherUK.