The humans burning out on AI's cyber frontlines
· axios.com · popularity 32/100 · 0 similar stories today · Cybersecurity (Technology & Consumer Electronics)
Read the original at axios.com →
Summary
The people at the frontlines of the ongoing barrage of AI-enabled cyberattacks are being pummeled with attacks, vulnerabilities and false alarms. Why it matters: Humans are still at the frontlines of a fight enabled largely by AI — and they're struggling to wade through mountains of threat data to determine who's been hit and which attacks pose a real danger to companies. What they're saying: "The last month has been the longest year of my life," Justin Timothy, threat intelligence consultant at GuidePoint Security, told Axios. Even before "Black October," Timothy was already swamped and dealing with hacker gangs that returned from a seasonal summer lull. These groups specialize in ransomware, essentially attacking the networks of an institution and holding it hostage. While AI is playing a role in many new cyberattacks, the ransomware scourge has already been shutting down pipeline systems, hospitals, education software and other essential services for years. It's only expected to get worse this year as powerful new AI systems are amplifying the capabilities of attackers faster than defenders can insulate vast corners of the unprotected internet. The big picture: The people companies call when they're hacked are being swamped, piling onto the persistent burnout that has plagued the industry. Troy Bettencourt, who leads Palo Alto Networks' global digital forensics and incident response practice, told Axios that demand for his team's services has climbed by double digits over the last six weeks. Unlike past surges tied to historically harmful attacks like SolarWinds , this year's workload has been relentless. "It's just a continuous grind that increases," Bettencourt said. The same heavy workload is happening across the industry, and even Palo Alto Networks' incident response subcontractors are at max capacity, he said. Investigations that could once be handled by a single consultant now require teams of five to 20 people, he said. The company is also pulling employees off other projects and shifting staff into incident response as it braces for more attacks exploiting the PHP vulnerabilities disclosed last week. Zoom in: Samantha Lewis, head of threat intelligence at Armadin, said her team has been inundated with requests from customers scrambling to determine whether their systems are exposed to AI-discovered flaws in foundational internet code. "This week has been pure chaos," she said. "The burden of that has been tremendous." Her team spent days sorting through hundreds of purported exploits, many of which didn't work , to determine which posed real threats to customers. Between the lines: AI's ability to uncover more software flaws threatens to bury defenders in even more work. The mounting workload is pushing security firms to use AI and automation to identify weaknesses and accelerate investigations. "The number of people you would need to actually defend against this starts to become entirely untenable," Lewis said. Yet the shift comes with another headache: Palo Alto's Bettencourt said he's juggling workers who are both exhausted by the caseload and worried that the AI tools being developed to ease their workloads could replace them. "They're burning out, and they're hearing everything in the media that AI is going to take everyone's job," Bettencourt said. "It's a tough balance." The intrigue: Even companies that largely escaped the latest security scares haven't been spared. Jack Nelson, Ivanti's chief information security officer and deputy general counsel, said he got "less sleep than normal this past week," despite the company's limited exposure to the PHP vulnerabilities. "It's been busy, there's no doubt about it," Nelson said. What to watch: Cyber defenders can't keep working at this pace indefinitely, but many are hopeful AI will offer them more ammunition in a battle some expect to go on for 12 to 18 months.
Found in: Axios. Rating basis: single outlet; outlet tier 4; 1 feeds; feed position 7.