If I had to name one word I heard the most at Black Hat and Bsides this year, it’s AI (yes, I know that’s technically two words). From presentations about AI-borne threats, to vendors showcasing AI-powered solutions, to conversations about the impact of AI in the (very long) line for coffee — AI was everywhere.

There are generally two common reactions to AI talk: 1) fear that AI-driven attackers will stealthily beat every one of your security controls and take over the world or 2) eye rolls from skeptical CISOs who have heard too many AI claims to take them seriously.

The truth is, it’s somewhere in between. Here’s what I saw at the Black Hat AI Summit and Bsides events.

1. At the very least, the use of AI in cyberattacks isn’t going to decrease. There are going to be sophisticated AI powered attacks on every user in your organization. While it may have started with phishing and other familiar attacks, future threats will manifest in ways that none of us can imagine now with deep fake impersonation based attacks.
2. Because AI-driven attacks are only going to increase, security has to REALLY become an enterprise- wide capability. The complexity of the modern threat landscape demands participation from and collaboration with all employees. Security teams can no longer work in a silo and be transparent to users. Instead, security must be built into the everyday operations of every employee. CISO’s must be able to work cross-functionally, building strong relationships with their workforce and finding new ways to use technology to enable self-healing security.
3. The result? Human- centric security is gaining momentum. Practitioners need to be able to quantify risks of individuals at every level of the organization, design appropriate controls, and efficiently interface with employees to remediate risk. To be effective, those engagements should help employees understand the role they play in security and how they are doing. How many of your employees really understand their security hygiene? Or the amount of risk they bring to the organization?
4. As a 3x CISO, here’s where I netted out: the key is to use AI in appropriate ways. There are so many new tools using generative AI in the security space, and there can be real value in leveraging AI to protect your organization. However, it is important to remember that this technology isn’t perfect (for example, AI hallucinations are still a real problem, so it’s important to consider where a hallucination or mistake could potentially put your organization at risk) and without keeping humans in the loop, AI and other automation still has a last mile problem. Fighting AI-borne threats with AI-powered solutions is a good start, but this will only be successful if employees remain in the equation.

These insights underscore the complexities that modern enterprises face in securing their workforce while embracing new AI- based technologies. As AI and security continue to converge, practitioners will focus on solutions that both enforce security controls and engage employees to take self-healing actions without hindering productivity.

Through the smart application of AI, CISOs can bridge the gap between Security, IT and the rest of your workforce. For organizations looking to stay ahead of the curve, the time to act is now. Finding better ways to humanize your security initiatives will be key – the decisions you make today will pay dividends for your employees in the future!