‘AI threats are real, it’s not some sort of urban myth’: Microsoft UK security chief explains why his company needs to be prepared for a new generation of AI cyber threats
follow us
Add us as a preferred source on Google
As AI becomes an increasingly important part of our daily lives, the role it plays in cybersecurity for both attackers and defenders is coming under increasing scrutiny.
Microsoft recently released its Digital Defense Report (DDR) highlighting the role AI plays in crafting new and more devious cyberattacks, and businesses are being impacted by more threats than ever.
But Microsoft is also using its own AI tools, such as Copilot, to help support its digital crimes unit, showing that attackers won’t have every advantage.
Latest videos ofTechnologyRadar
At the recent Microsoft Frontier Tour event in London, I spoke to Dr Jon Davies, Chief Security Advisor at Microsoft UK, to find out more.
AI threats are here
“Frontier AI is transforming the threat landscape,” Davies tells me. “Right now, the threats from AI are real, it’s not an urban myth or something we’ll see in 2030.”
The DDR found that as AI becomes more available, the barrier to entry for cybercrime is lowered, allowing hackers to launch a record number of campaigns against consumers and businesses alike.
The UK was particularly affected, becoming the country most targeted by geopolitical and nation-state cyber activity in Europe, facing 76 observed events in the last year and ranking fifth in the world among countries where customers are most frequently affected by cyber threats.
Davies notes that the AI threat has been rising for some time, as attackers turn to automation to carry out more advanced attacks, and so-called “swarm attacks” become particularly more common as attackers get agents to do their dirty work.
“We’re getting to the point where technology, compute, and storage are catching up to the attacker’s ambition,” he says, noting that defenders are also embracing AI.
“We’ve been solving one problem at a time as (threats) have evolved,” he adds, “the opportunity with agent AI is to elevate the human to orchestration.”
But even as all the AI intelligence is channeled into creating new, more complicated attacks, more “basic” forms of scamming, like phishing, continue to prove incredibly effective, proving that humans will always remain the weakest link when it comes to cybersecurity.
The DDR found that phishing attacks increased globally from 7% to 23% of incident response intrusions year on year, with attacks using fake meeting invitations and calendar bookmarks among the scams on the rise, and Davies highlights how criminals are taking information gathering on specific individuals in senior management to a new level to get them to click on a link.
“An attacker has no ethical line,” he notes, “phishing… is still the gateway for any organization… (and) I don’t think it’s going away; with AI on your side, it will only become more real and harder to detect.”
So where does the responsibility lie when it comes to awareness? Davies says it should be a combination of individual and collective culpability, meaning those pesky phishing tests your employer sends you are probably here to stay.
“The goal of those training exercises is to help educate us, to show us what the attackers are doing… I don’t think we should be ashamed if we have clicked on a link to one of those exercises, because the goal is to educate and train.”
“It is everyone’s responsibility to buckle up, you are responsible for it and regardless of who you are in your personal life, you are responsible for cybersecurity. We are now at that step of change where it is not just the cybersecurity teams who are responsible for security, but everyone within the organization.”
Davies notes that “safety can be the seatbelt for AI transformation,” comparing it to the introduction of seatbelts in cars, as although they worked from day one, it still took some time to catch up.
“Safety is the same for companies: we can buckle up,” he adds, noting that the seat belt does not slow the car down, and eventually the change occurred, making seat belts (and safety in general) a key reason we might buy a specific car.
So, with the enormous number of threats that cybersecurity defenders face daily, how can security professionals stay positive?
“It’s really difficult,” Davies says, “the threat landscape is evolving extremely, extremely quickly right now. It has to be integrated from the top to the bottom, from board level down, through senior management and down to employees, but it also needs to be trained from the frontline staff.”
He adds that, given the number of widespread cybersecurity stories making headlines these days, more and more senior executives are waking up to the need to stay protected and challenging their CISO about what they plan to do about it and how they can recover if the worst happens.
“We’re having these conversations pretty regularly,” he says, “as a member of the security profession, we’ve been asking for a seat at the table for a number of years, and we’ve finally gotten it.”
Davies points out that DDR is not just a commercial or public relations exercise: it is Microsoft’s vision from the front line of the battle against the latest cybersecurity threats.
“We have skin in the game,” he says, “there is no other organization on the planet that can do this at that level, it is giving back what we can share to help organizations measure their risks and threats.”
“The physics of cyber is changing,” he concludes, “we have variables we can change, but they (attackers) also have variables they can change on their side… it’s a scary place… the world we live in now is very dynamic.”
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment