Generative AI for Cybersecurity 1 © 2024 TechTarget, Inc. All Rights Reserved. Back to contents Generative AI for Cybersecurity: An Optimistic but Uncertain Future © 2024 TechTarget, Inc. All Rights Reserved. january 2024 Jon Oltsik | Distinguished Analyst and Fellow ENTERPRISE STRATEGY GROUP Since the introduction of ChatGPT in November 2022, generative AI (GenAI) has been described as everything from a novelty and an economic boon to a threat to humanity. As this debate continued, GenAI took center stage at the RSA Conference 2023 with the introduction of and subsequent hoopla around Microsoft Security Copilot. Many other vendors have introduced similar capabilities since. Few would argue against the idea that GenAI (and AI in general) will have a profound impact on society and global economics, but in the near term, it introduces new risks as employees connect to GenAI applications, share data, and build homegrown large language models (LLMs) of their own. These actions will inevitably expand the attack surface, open new threat vectors, introduce software vulnerabilities, and lead to data leakage. Despite these risks, generative AI holds great cybersecurity potential. Generative AI could help improve security team productivity, accelerate threat detection, automate remediation actions, and guide incident response. These prospective benefits are so compelling that many CISOs are already experimenting with GenAI or building their own security LLMs. At the same time, security professionals remain anxious about how cybercriminals may use GenAI as part of attack campaigns, and how they can defend against these advances. Have organizations embraced GenAI for cybersecurity today, and what will they do in the future? To gain further insight into these trends, TechTarget’s Enterprise Strategy Group (ESG) surveyed 370 IT and cybersecurity professionals at organizations in North America (US and Canada) responsible for cyber-risk management, threat intelligence analysis, and security operations, with visibility into current GenAI usage and strategic plans. Generative AI for Cybersecurity 2 © 2024 TechTarget, Inc. All Rights Reserved. Back to contents Research Objectives KEY FINDINGS: This study sought to: • Identify current usage of and plans for generative AI. • Establish how generative AI influences the balance of power between cyber-adversaries and cyber-defenders. • Determine how organizations are approaching generative AI governance, policies, and policy enforcement. • Monitor how organizations will apply generative AI for cybersecurity use cases. Generative AI Has a Foothold Today and Will Be Pervasive by the End of 2024 PAGE 3 Organizations Anticipate Generative AI Risks PAGE 8 Security Professionals Are Cautiously Optimistic About Generative AI’s Potential for Cybersecurity PAGE 13 Generative AI Will Become a Purchasing Consideration, Though Plans Are Still Developing PAGE 20 Generative AI Has a Foothold Today and Will Be Pervasive by the End of 2024 Generative AI for Cybersecurity 4 © 2024 TechTarget, Inc. All Rights Reserved. Back to contents The research indicates that 85% of organizations have a proprietary large language model in place, while another 13% report that they are in the process of developing one. It’s likely that many of these are early-stage projects based on open models. Nevertheless, this data indicates robust activity, forecasting rapid development of production applications in 2024. Which business functions are ripe for GenAI applications? Organizations are well underway toward ubiquitous use of GenAI in areas like IT operations, software development, sales, research, and others. Like “shadow IT” in the past, growing use of GenAI will introduce cyber-risks as multiple departments and individual employees interact with open GenAI applications, experiment with open source, and create their own LLMs. CISOs must assess and communicate these risks while working with executives to create the right governance models and policies for risk mitigation. Additionally, security professionals must implement compensating controls and monitor users and networks for anomalous, suspicious, and malicious behavior. Many Are Already Developing Proprietary LLMs to Support a Variety of GenAI Use Cases LLMs are already a part of production generative AI applications41+59+U41% LLMs are already a part of an ongoing development project44+56+U44% We plan to develop our own LLMs in the future1+99+U1% We are just getting started developing our own LLMs13+87+U13% We are interested in developing our own LLMs in the future1+99+U1% Development plans for proprietary large language models. Top five current or planned GenAI use cases. 66%IT operations 660+340= 36%Software development 360+640= 29%Sales 290+710= 26%Research 260+740= 25%Product development 250+750= Generative AI for Cybersecurity 5 © 2024 TechTarget, Inc. All Rights Reserved. Back to contents Mitigating GenAI risk is not some future requirement. Rather, organizations are already dealing with, or struggling to address, generative AI risks proactively. Respondents claim that their organizations are already blocking access to generative AI sites. Security professionals are also concerned about GenAI-driven data leakage and remain unsure as to whether employees are already accessing and using GenAI applications today. CISOs must address these risks before losing control of who does what with GenAI across the enterprise. “ Organizations are already dealing with, or struggling to address, generative AI risks proactively.” Pervasive Security Concerns for Generative AI Cybersecurity professionals’ GenAI opinions. Strongly agree Agree Neither agree nor disagree Disagree Strongly disagree 42% 43% 44% 54% 40% 39% 42% 40% 7% 10% 6% 6% 5% 5% 5% 5% 3% 2% We aren’t sure if any employees are currently accessing generative AI sites today or what they are doing on these sites We are concerned about data leakage as employees increasingly use generative AI My organization has blocked/is blocking access to one or several generative AI sites My organization expects generative AI to help accelerate the software development cycle 0% 20% 40% 60% 80% 100% Generative AI for Cybersecurity 6 © 2024 TechTarget, Inc. All Rights Reserved. Back to contents Of course, most organizations have acceptable use policies and governance models in place today that may provide needed guardrails for GenAI usage. Recognizing additional risks associated with GenAI, many firms are creating specific governance models. Larger enterprise organizations, with the most at risk, are taking the GenAI governance lead, while their smaller counterparts lag. CISOs at these organizations must act as a catalyst to accelerate the creation of governance models, policies, and policy enforcement controls. Given the pace of GenAI innovation, delays will only lead to rapidly increasing risk. Many Are Getting Ahead of GenAI Governance, Especially Larger Organizations Plans for a specific GenAI governance structure. Percentage of organizations that already have a specific governance structure for the use of generative AI by company size. 18+82+S18% We are developing a specific GenAI governance structure 36+64+S36% We are interested in developing a specific GenAI governance structure 2+98+S2% We believe our existing governance and acceptable use policies apply to generative AI 10+90+S We already have a specific GenAI governance structure 10% 41% 2,500 to 4,999 employees 410+590= 34% 1,000 to 2,499 employees 340+660= 73% 5,000 or more employees 730+270= Generative AI for Cybersecurity 7 © 2024 TechTarget, Inc. All Rights Reserved. Back to contents While many organizations have created or are creating GenAI governance models, security professionals admit that these models have abundant weaknesses, including third-party risk management (29%), data leakage protection/ rights management (27%), regulatory compliance (26%), and enforcing GenAI access policies (26%). Based on the data, it is safe to assume that most organizations have a myriad of these weaknesses in place today. Closing these gaps should be a 2024 priority. Weakest Areas of GenAI Governance Weakest areas of generative AI governance and policy enforcement. 17% 19% 23% 24% 24% 26% 26% 26% 26% 27% 29% Acceptable use policies User behavior monitoring Data governance Risk modeling/management Identity governance List of approved/disapproved generative AI applications supported User awareness training specific to generative AI usage Enforcement of approved/disapproved generative AI application access Regulatory compliance Data leakage protection/rights management Third-party risk management Organizations Anticipate Generative AI Risks Generative AI for Cybersecurity 9 © 2024 TechTarget, Inc. All Rights Reserved. Back to contents IT professionals with cybersecurity responsibilities Pure cybersecurity professionals Overall Trust boundary risks 260+740= 470+530= 530+470= Data management risks 63% 44% 36% 630+370= 440+560= 360+640= Inherent underlying model risks 7% 9% 8% 70+930= 90+910= 80+920= General security risks 4% 1% 2% 40+960= 10+990= 20+980= Biggest risk to LLM and generative AI application development by role. As organizations experiment with GenAI applications and build their own LLMs, they face several application security challenges such as trust boundary risks (i.e., where data comes from or when it moves to an untrusted source), data management risks (e.g., data leakage or corruption), inherent underlying model risks, and general security risks. Security professionals are especially apprehensive about data management risks, while IT professionals’ concerns focus on trust boundary risks. Organizations must reinforce their application security efforts with oversight, tooling, and testing to address specific GenAI application security. Generative AI Risks Associated With LLMs 26% 47% 53% Generative AI for Cybersecurity 10 © 2024 TechTarget, Inc. All Rights Reserved. Back to contents Top five reasons cyber-adversaries will likely gain the biggest advantage from GenAI technology.