Role Of Artificial Intelligence In Cyber Security

The role of artificial intelligence in cyber security defensively is genuine, and narrower than the marketing suggests.

It is good at volume. Spotting unusual patterns across far more log data than a person could read, flagging a login that does not fit someone’s normal behaviour, and clustering alerts so a small team sees ten things instead of a thousand.

It is weaker where it matters most. It produces false positives that still need a human to judge, it struggles to explain why something was flagged, and a tool nobody can interrogate is difficult to rely on when a decision has consequences.

Treat it as triage that makes a small team considerably more effective, rather than as a replacement for having a team at all.

The Australian Cyber Security Centre publishes guidance for organisations. This is general information rather than legal advice, and obligations vary by state and territory.

See Sentrient’s cyber security training course and risk management system.