According to a recent IBM study, AI has featured in over 20% of UK security breaches. AI-powered impersonation was the most popular vehicle of abuse, used in 45% of cases, while, malware made up 19% of attacks and phishing campaigns, 17%. IBM’s Cost of a Data Breach report put the average cost of one data breach at nearly $5 million, up 12% globally.

AI’s ability to enable faster, large-scale cyber attacks by automating reconnaissance, developing malware and analysing stolen data, while lowering the technical barrier to entry, is creating an urgent need for businesses to hone their defence capabilities and strategy. And, for a large part, the same technology can do just that.

“AI’s given the people at the bottom of the expertise ladder about four or five steps up on that ladder because they can now effectively copy the techniques that more sophisticated attackers use at scale and at speed,” says James Bore, a UK-based cyber security expert and chartered security professional.

How AI can be used to improve cyber security

The case for AI rests largely on speed, says Kay Daskalakis, a senior solutions architect of cyber security firm SpecterOps and recent guest on ICAEW’s Beyond Finance podcast.

AI helps attackers "get further, faster," he says, as once inside one account, an intruder can use it to work out what that account can reach and how to move deeper, leaving defenders less time to intervene.

AI can help bridge the defence gap, which requires both preventative monitoring and response. Here are four typical use cases for AI when it comes to cyber security:

Know the risks

Using AI to discover vulnerabilities or to inform about phishing or other attacks is fantastic, says Bore. “The way that it's sometimes being sold as a magic silver bullet that will make all your security problems go away – that's somewhat more problematic”.

The technology is also unpredictable. Tests have shown AI can do harmful things even with well-defined instructions and it can also amplify a mistake "at machine speed and scale”. While AI can help monitor activity, analyse patterns and flag suspicious behaviour, it can also generate more anomalies and exceptions, which could result in teams spending more time distinguishing genuine suspicious activity from false positives.

Bore explains: “Without AI, you can still employ basic security hygiene – ensuring people are aware of the threats out there, how to spot and avoid them and what to do.” 

Priorities for any organisation should be multi-factor authentication on every account, back-ups kept outside any one cloud provider and a five-second pause before acting on any urgent request, he adds.

Keep humans accountable

Daskalakis says organisations should limit access with technical boundaries, not just instructions. Human approval should be required for changes that could affect the

business and test those controls before expanding the system’s authority.

He adds that you should always have a person accountable for the system, whether it is AI doing the work or a human. “The principle is simple: you can delegate the work but not the accountability.”

Webb also notes that more prolific use of AI large language models presents a data risk, and that sensitive data should not go anywhere near any LLMs in use.

She emphasises the importance of training and empowering people to question suspicious activity. “We need to be building cultures within organisations where we're comfortable with challenging things that don't look like the norm”, such as someone receiving an ‘urgent’ invoice from a senior colleague requesting immediate payment.

At the end of the day, most attacks still get in through people or unaddressed weaknesses, and AI cannot replace how humans respond.