The Mythos moment

Anthropic’s Mythos AI model reportedly leapfrogs the coding and cyber security hacking capabilities of previous Frontier AI models. Similar future developments will undoubtedly further challenge effective cyber security protection. Testament to that is the recent revelation that Mythos has successfully reverse-engineered a cell type from raw DNA data. AI will soon grant people extremely dangerous powers and our defences will have to become more purposeful, everywhere.

The AI horse has truly bolted and effective cyber security now means something quite different to just months ago. Then, a successful attack might have taken an expert hacker several weeks to research and execute. AI can now autonomously achieve it in hours. In an open letter to industry ASIC advises that AI is shifting the cyber threat landscape:

• Lowering the barrier to sophisticated cyber activity;
• Increasing the speed and scale of attack; and
• Enabling new forms of exploitation previously only available to expert adversaries

Organisations need to stress test their security controls and risk management practices for overall adequacy. Their ongoing cyber resilience depends on it.

These AI advances will in time deliver improved cyber defences and less vulnerable attack surfaces. But for now, they assist hackers more than the enterprises and security teams that protect them. In the wrong hands, AI assisted adversaries will automatically identify and exploit vulnerabilities at speed. An uplift in compensating security controls, defence in depth, and attack-surface protection is now essential.

Implications for security oversight

Levels of enterprise cyber security risk are understated, almost everywhere. As a result, calculus of operating, economic and reputational risks has changed.

Speed to vulnerability detection

Cyber security policies and risk management practices must now shift focus from security controls compliance to addressing unprotected vulnerabilities.

Automated AI attacks, with their speed and precision will severely test most cyber governance practices. As the times from discovery to vulnerability exploit (TTE) plummet the speed to security gaps detection becomes more critical.

Security compliance is not effective cyber security

Prudent cyber security practices are no longer just about compliance with security frameworks (if they ever were?). Security frameworks with their rules-based processes and controls must continue to guide cyber security activities. But the time to secure a security gap now determines your cyber posture; not your level of framework compliance.

Evidence-based actionable intelligence is now vital to identifying and protecting the attack surface against emerging security gaps. With remediation times needing to be slashed, effective cyber defence requires up-to-the-minute information to support dynamic risk mitigation activities. The inability of sampling or arbitrary risk assessment techniques to assist in identify emerging security gaps, is reducing their usefulness.

The changes required

To match this need for speed and rigour, security and risk teams need more dynamic cyber security risk management capabilities.

This in turn raises the question of the adequacy of existing cyber security governance practices more generally. For many, an annual review of such matters may now be too infrequent to meet current regulatory reporting obligations.

Your odds of an attack are shortening all the time

The increased velocity, scale and effectiveness of AI attacks brings with it far greater risks of operational disruption.   On top of plummeting TTE timelines is the reported skyrocketing of vulnerability numbers (CVEs). Together these factors make “keeping a continuous and watchful eye over your attack surface” increasingly taxing.

Address speed and scale with Continuous Threat Exposure Management

Security and risk teams now require near real-time visibility of their attack surface and the effectiveness of their mitigation responses. Data-driven threat exposure management (CTEM) technologies ensure faster and more reliable threat detection and risk management practices. In the background they monitor millions of security events per hour to identify and maintain real-time risk assessment practices:

• Delivering ongoing evidence-based security intelligence to security and IT teams that inform the joint investigation and mitigation strategies; and
• Supporting dynamic decision making and security control management to respond to emerging vulnerabilities before they are targeted by hackers.

Increased cadence of risk assessment

The ACSC Essential Eight Maturity Model will continue to be important in guiding organisations to systematically treat their security threats. Effective mitigation strategies that address:

• misconfigurations;
• access control,
• authentication,
• patching and
• policy enforcement

remain essential for effective enterprise security management.

What has changed is that these threat assessments must now be completed faster and more often. And the cadence of these defensive enterprise security risk management practices must better match the ongoing offensive AI developments.

Collaborative IT and security risk mitigation team

The speed to mitigation is now as important as the time to vulnerability detection itself. Organisations must establish effective risk management operating models. This includes IT and risk management teams working jointly with the latest security intelligence to inform their defensive efforts. It also means fully informed detection and mitigation teams able to promptly respond to any gap emerging in their attack surface.

Risk management and governance processes must adapt

Clearly Frontier AI models will continue to automate a lot of things that humans can do, faster and more reliably. In response, enterprises must increase the rigour and tempo of security threat protection practices to protect themselves against operational disruption.

AI will hasten the discovery and exploitation of vulnerabilities everywhere. In response, regulators are now urging improved attack surface protection with more diligence and timely gap detection and repair.

Mitigating a vulnerability before your attack surface is breached by an AI-assisted adversary will ensure your ongoing cyber resilience.

For more information on threat exposure management technology and what it delivers, refer to https://huntsmansecurity.com/capabilities/threat-exposure-management/.

If you want to transform your cyber security practices to meet these AI challenges head on, please Get in Touch.