How can you use AI in your day to day in Cyber Security
We thought we’d write a bit more informal article this week, detailing a couple of ways AI can be utilized at organizations by security/IT individuals. What we will be talking about can be done using your existing LLM tooling – ChatGPT, Copilot, Claude etc, no specialized software.
Most of you reading this are already using AI in your day to day, to draft emails, or write powershell or some other scripting language you hadn’t looked at since university. And AI is good (with some painful caveats) at that, however we wanted to these list these ideas further to maybe inspire how you can utilize these powerful tools in other ways.
Before we get into that though, its vitally important to note its limitations. First and foremost is its accuracy. Different benchmarks for different tasks point it between 50-90% accuracy1, so lets say 75% as a generalization for the sake of argument. Now, 75% accuracy is quite accurate for some things? Drafting an email you’re reading over? Perfectly fine. Writing a powershell script to read the number of users in your directory? The consequences of failure are non-existent, as you can simply rerun it if it doesn’t work, or double check the code yourself for these common functions. However, as I’m sure you’ve experienced if you’re reading this, in the world of Cyber Security, things are usually binary. A technical control is either implemented on a device, or it’s not. A vulnerability exists or it doesn’t. You either have an exploitable path to your domain admin, or you don’t. This is the primary problem with using AI for cyber security. Cyber is one of the few areas of IT where you can’t afford a mistake, as the mistakes are too consequential. Using AI in devops to code a new feature allows for a much greater tolerance of failure for example, as you go through many loops of testing and iteration, chances to view if the function does not work. However with security, no one wants to have to standup in front of the board after an incident has occurred, only to explain the AI-scripting you developed implemented 75% of the controls, but the attacker used the other 25% you weren’t even aware were a problem. This is the crux of the problem. AI is great at being mostly right most of the time, in cyber security you need to be completely right 100% of the time when implementing, reviewing and designing.
I’m not trying to fearmonger or scare you away from AI in your daily tasks, but its important to understand why and where we need to have human’s in the middle of these functions within cyber security. We’re usually only one mistake away from a breach. All that being said, listed below are a few things we’ve found AI useful for, or seen it being used, and how you can do it safely. Less of a step by step guide, and more ideation for how you might be able to better use the tools you are probably already paying for.
Finding specific points of data in log analysis
Although manual log trawling has thankfully been mostly replaced by the myriad of SIEM tooling within enterprises, I’ve very rarely seen 100% aggregation of every log type into these tools. And if they are, they are often in very clunky formats that the SIEM tools don’t gel with. There tends to always be exceptions. Think old physical appliances, OT infrastructure, or non-critical software applications organizations tend to not bother tweaking the SIEMs for. Often hundreds of these logs are dumped monthly into a bucket, blob, or folder, and forgotten about. That is until the unlucky day something suspicious has happened, and you are forced to find something extremely specific within a few thousands text logs of a software you have never used. Sound familiar? Previously you would either review them manually if a small sample, or write python/powershell scripts. This is one use case AI is actually pretty helpful with. Using whatever LLM you have at your firm, you can actually point it at an entire folder, and get it to find specific lines or trends using text recognition within there. This requires the AI to have permission to this folder, which most firms don’t allow, in which case simply bring the folder to your local drive and point it there, granting the AI permission to this folder. Bonus points if you ensure you use a model running locally or entirely within your environment, so big tech doesn’t get access to this potential breach data through the model model. So for example, if you know the username or IP, or even the ranges this activity might have come from, you can ask the model to search the folder for all instances of these occurring within a date range. It should return something. If it doesn’t, tweak the prompt, apply different values and rerun again. And again. Most likely, you’ll be able to get a jumping off point to continue your analysis.
You might ask, should I get the model to give me the why, how and next steps of this incident? Well, this goes back to our previous discussion around accuracy. In this instance, you can’t afford AI to hallucinate the wrong method or system the attacker used for entry, and it will end up being more costly and time consuming in the long run to lead you on a wild goose chase. AI is good at collecting data and reading data, but not so good at making assumptions on said data, so best to stick to your own analysis. But finding that initial piece of evidence is a whole lot easier now, and gives you an excellent start point for further analysis
Saving you money on security visibility
It’s no secret that the security industry has become heavily commercialized over the past few years. There’s even etfs that track just cyber security companies2. And no doubt, you have salesmen contacting you every week trying to sell you the next dashboard that is bigger and better than last weeks dashboard for x reasons. Now, if you have digital footprint to warrant them, and the budget, these can be worthwhile and provide valuable insight in an easy to read form. But did you know, a lot of these dashboard features are simply reading API’s from Microsoft and AWS that you’re already paying for? Often they exist to display these APIs in a user friendly and readable format, in a live/semi live view. The good ones draw insights from the data to tell you about things you cant get from the raw data itself, when combined with other sources. But its not too difficult, with the help of AI, to display a lot of this data yourself. It might not get you 100% of the way there compared to paying $10,000 a month, but getting 70% of the way there for free is a good start.
Now, like most things AI can do, this can, and always has been, done with scripting. This an example of AI-empowered scripting, for lack of a better word. AI just helps us get there a little faster. To start, we want to find the control you want to gain visibility of. Microsoft Benchmarks for Cloud, and CIS Benchmarks, are an excellent place to start for lists of cloud controls. Free, online resources that list technical controls to implement. Once you’ve found something interesting enough to warrant investigation, you need to connect either a session or application to your environment. There are a few ways to do this, which we won’t go into depth here, but the gist is you either need a user account, service account, or an application service with the appropriate API permissions to audit this control, and ensure its connected securely using either certificates or credentials. A bit of info around this is located here3, but like before, you can use your model for step by step info for how to do this, as the model itself won’t be able to view/change anything. After you’ve ensured you’ve got the right permissions, ask your model to write the script directly correlating with the control you found earlier. It should output something usable, if not test, prompt, and test again. A cycle you will have to get used to when using AI.
For example, say you wanted to check if your organization had DKIM enabled for all exchange online domains. First you would need to grant permission to the auditing user/account running the powershell session that would be auditing this. Next, get the model to write you a script, using a prompt along the lines of ”Can you write a script to query Microsoft Graph to list if DKIM is enabled for all Exchange Online Domains in my environment”. You would then run this script in powershell. You can use the model to change the output of the script to text, excel, Json or whatever format you need, very quickly compared to having to manually write the scripts to change the format. The main benefit of AI here is that you can now quickly develop scripts for other controls using the model, instead of having to manually script it yourself. Remember, in this scenario, the AI is not touching your environment, rather assisting you with writing the scripts. You might be tempted to get the AI to remediate said controls using the same API, adding on a few extra permissions, and running a remediation script. However, we would advise against automated remediation activities on a script generated by Ais. Any remediation automation has to be vetted and reviewed by an experienced operator, to ensure no mistakes are made.
Now, none of this is new information to seasoned security professionals, and they’ve most likely been working with the same scripts and APIs their whole career. But the benefit here is that it has become more widely available to non-technical personal. Instead of paying for a service to check x control, you can use the AI-assisted coding to do it instead. Maybe your company does not have dedicated security analysts, or the cloud engineers are tied up. It goes further when you start building out more controls, and task schedulers to run automatically, meaning you can create your own internal dashboard, with enough time and effort, rivaling the SAAS products, without much coding experience. Although this example is simply ai assisted scripting, we’ve seen it used to great benefit in smaller organisations who don’t have the dedicated resources to be experienced in this, and they were able to gain a good chunk of security visibility for minimal effort.
We hope these two examples we’ve shared on how to use AI within your company for security have sparked a bit of ideation on how it might be used for other tasks, and how to do it safely with humans in the middle. Please feel free to get in touch with us if you would like to ask any questions on how to build on these blocks into something more sophisticated for your organization.
Sources
