1.5 - Leveraging AI in Cyber Defense
AI for Security Configuration Review
Security configurations, like firewall rules, access lists, and network segmentation, get more complicated as organizations grow. Misconfigurations create openings that attackers exploit, but manually reviewing thousands of rules takes forever and is easy to mess up.
AI tools compare existing security policies against best practices, industry standards, and threat intelligence, looking at things like firewall rules, access permissions, network segmentation, authentication requirements, and encryption settings.
Example: a company's firewall has 3,847 rules built up over eight years. An AI tool reviews them and finds 74 rules allowing inbound traffic from anywhere to internal servers, 132 rules that contradict each other, 28 rules pointing to servers that don't exist anymore, 15 services exposed to the internet that shouldn't be, and Telnet still allowed on the management network even though it sends credentials in plain text. The AI recommends tightening the permissive rules, cleaning up conflicts and old rules, blocking outside access to internal services, and swapping Telnet for SSH.
A knowledgeable security person still needs to review any of this before it goes live, since AI might not understand business needs, context, or risk tolerance. For example, if AI suggests blocking all inbound HTTPS traffic from outside the US, a human reviewer might catch that this would break the company's international e-commerce business and reject the recommendation.
AI for Application Security and Code Analysis
Modern apps have millions of lines of code, way too much for humans to manually review at scale.
AI-powered static analysis tools scan source code, binaries, or frameworks looking for things like injection flaws, authentication issues, access control failures, weak cryptography, input validation problems, misconfigurations, and outdated dependencies with known vulnerabilities.
Example findings and fixes:
- SQL injection: vulnerable code builds a query by directly concatenating a username and password into the string. The fix is parameterized queries, where the values get passed separately instead of glued into the query text.
- Hardcoded credentials: an API key or database password sitting directly in the code. The fix is pulling those values from environment variables instead.
- Weak password hashing: using something outdated like MD5 to hash passwords. The fix is a proper algorithm like bcrypt with a strong number of rounds.
A knowledgeable developer still has to review all of this, since AI suggestions can break functionality, hurt performance, conflict with the framework, or miss business logic. For example, if AI suggests locking accounts after just 3 login attempts a minute, a developer might recognize that's too strict for real users and loosen it to something like 10 attempts per 5 minutes with progressive delays.
AI-Generated Detection Rules
Security systems use detection rules to spot malicious activity, and AI can analyze threat intel and attack patterns to help write rules for SIEM, IDS, and EDR platforms.
Example rules an AI might generate:
- Alert when a single process modifies more than 100 files in under 60 seconds with suspicious extensions like
.encryptedor.locked, unless it's a known backup or antivirus process
- Alert when PowerShell runs with hidden or encoded parameters and tries to reach out to the internet, especially if it was launched from Word, Excel, or Outlook
- Alert when a process tries to access credential storage like the SAM file or LSASS memory, unless it's an authorized system process
A detection engineer still needs to review and tune these before deployment. Rules that are too broad create alert fatigue from false positives, rules that are too narrow miss variations of the attack, and complex rules can eat up resources. For example, if AI suggests alerting whenever a user touches more than 50 files in 10 minutes, an engineer might notice that would constantly trigger for the graphics team and adjust the rule accordingly.
The Scale Challenge in Threat Detection
Big networks generate way more events than any human team could review.
Example: a medium-sized company with 5,000 employees might generate about 75.5 million security events a day across firewalls, authentication, endpoints, applications, and email. Even if an analyst reviewed one event every single second nonstop, that's only about 86,400 events a day, roughly 0.11% of the total. Even 100 analysts working around the clock could only cover about 11% of events, leaving 89% completely unchecked.
That's the needle in a haystack problem: an attacker doing recon over 3 days might only generate 78 suspicious events buried in about 226.5 million total events (3 days at 75.5 million a day), which a human analyst basically has zero chance of spotting.
AI-Powered Threat Detection
AI is built to process huge volumes of data fast and spot patterns that point to malicious activity.
Machine learning models get trained on labeled datasets of both normal and malicious activity. Security experts label the data, the AI figures out relevant characteristics like timing, volume, and source, learns the correlations, and gets validated against new data.
Detection approaches:
- Anomaly detection: spotting behavior that strays from someone's normal baseline, like an employee who usually accesses 20 files a day suddenly accessing 15,000
- Signature matching: recognizing known attack patterns, like PowerShell commands that match a known credential-theft tool
- Behavioral analysis: spotting suspicious sequences, like logging in from an unusual place, changing the password, downloading a database, and uploading it externally
- Machine learning classification: scoring the probability that something is an attack, like scoring login attempts based on time, location, device, and risk profile
Example: at 2:47 AM, a workstation starts connecting to 500 internal IPs on port 445 within 3 minutes. If a human catches this the next day during log review, the attacker's had 8 hours to spread ransomware. If AI catches it, it recognizes the scanning pattern immediately, notices the user was logged out since 6 PM so this is out of pattern, checks threat intelligence, and sends an alert within 30 seconds, meaning the security team knows about it just a minute after it started.
Automated Alerting and Response
AI systems can detect threats, notify teams, and even take corrective action automatically based on preset policies.
Smart alerting means AI prioritizes and adds context to threats instead of just flooding a team with low-confidence alerts. A well-built alert can include things like the threat score, affected system and user, a timeline of what happened, related suspicious activity, and clear recommended next steps, all bundled into one alert instead of dozens of scattered ones needing manual correlation.
Automated response for high-confidence threats can happen without waiting on a human, like isolating an infected system from the network, suspending a compromised account and forcing a password reset, or killing and quarantining a malicious process.
Example: at 3:14 AM on a Saturday, an attacker exploits a vulnerability and starts pulling customer records. Without automation, nobody reviews the alerts until Monday, 60 hours later, by which point 2.3 million records are gone. With AI automation, the system flags the abnormal database queries within 7 seconds, shuts down the connection and blocks outbound traffic within 12 more seconds, and the attacker's session is dead in 19 seconds total, with only about 4,200 records accessed instead of millions.
Speed comparison: manual detection can take hours to days, AI detection takes seconds to minutes. Manual response can take 15 minutes to several hours between notification, investigation, and execution. Automated response takes seconds, with no human delays and consistent performance no matter the time of day.
Accuracy comparison: human analysts deal with fatigue, alert fatigue, knowledge gaps, and bias. AI doesn't get tired across billions of events, recognizes subtle patterns humans might miss, and applies logic consistently. For example, a sophisticated attacker might use legitimate tools in individually harmless-looking ways spread out over days specifically to avoid detection. A human analyst might miss it since each action looks fine on its own, but an AI model can recognize that the overall sequence and timing statistically matches known attack patterns, even though no single action looks bad by itself.
Human-AI Collaboration in Defense
Even with everything AI can do, human expertise is still essential. The best security setups combine AI's speed and scale with human judgment and context.
AI is good at: processing huge volumes of data, recognizing patterns across millions of events, real-time analysis and alerting, and quickly containing clear-cut threats.
Humans are good at: strategic threat hunting based on what AI flags, investigating complicated or ambiguous situations, understanding business context AI can't know, deciding what level of risk is acceptable, double-checking AI recommendations before they go live, and improving AI models based on false positives and new threats.
The best setup uses AI to filter out the 99.9% of events that are clearly fine or clearly malicious, freeing up human analysts to focus their judgment on the remaining 0.1% that actually needs a careful, nuanced look.