Evo Cyber Security #62 - Is AI A Threat To Cyber Jobs

Speaker A: Welcome to another installment of the Evolution Exchange podcast and the Buzzword at conferences and on LinkedIn. Currently is AI artificial intelligence. So today we'll be exploring the idea of machine intelligence possibly replacing human expertise. What does that mean for the future cyber professionals? Will your roles be outsourced to algorithms and automated systems, or is there still a place for human, uh, ingenuity in the digital battlefield? So today I'm joined by Daniel Lewis, Giles Thornton, Neil Potter and Suk Paul. So, before we delve deep into the topic, we'll, uh, uh, work our way around the room with some introductions. Daniel, do you want to kick us off?

Speaker B: Yeah.

Speaker C: Hello, my name is Daniel Lewis. I'm cyber lead, uh, for the innovation company called Plexel, uh, where I help government startups and industry collaborate and do innovation, um, efficiently and effectively, particularly within anything cyber. Um, my interests and experiences are in three different cybersecurity, cybernetics and AI and cyber physical systems. And I founded a company, a cyber security company back in 2017 called AWEND to reduce cyber risk within critical infrastructure and other industrial sectors. Um, and Arwen was successfully acquired, um, uh, in 2023 by Sapphire. I also have an undergrad degree and have done PhD research in AI as well. So a very relevant topic for me today.

Speaker A: Thanks, Dan. Giles.

Speaker D: Hey. Uh, I'm Giles Thornton. So, I'm head of Information Security at the Premier League M. Prior to that I spent uh, almost a decade in the army, but I've been out in the real world now for about 10 years. Um, I've operated across security operations, governance, uh, threat intelligence, threat analysis, that kind of thing. Um, and as a result I have an interest in where AI can be applied absolutely anywhere, um, and particularly the business aspect of IT and how we can support that.

Speaker A: Amazing. Thanks, Neil. I'll come to you next.

Speaker B: Hi, I'm Neil Potter, head of security operations at uh, Just E Takeaway and we make sure your pieces get delivered. Um, I've got a pretty varied background myself while I work in security operations now. I've in the past worked in, um, astrophysics, teaching, military, uh, cyber intelligence and tree surgery, among other things.

Speaker A: Thank you. Uh, last but not least, Suk so

Speaker E: Suk Paul from Kudalsky Security. Um, been in IT, telecoms and security for about 20 years. Come from a delivery background in cyber defense consulting. I've done some work in solution architecture for um, when I was at Verizon as well part of their security business. Joined Kudelski Security, a Swiss hq, uh, cybersecurity, um, service provider. Uh, I joined to set up the SecOps and cyber threat intelligence practice and then about 14 months ago moved into the go to market part of the business. Looking at our services, uh, portfolio and strategy of going to market.

Speaker A: Perfect. So I suppose first of all I think it's important that we kind of set the stage for discussing the broader implications of AI in cybersecurity. Understanding that you know, the current landscape of AI integration and human intelligence sets the foundation for exploring its impact on cyber jobs. So with that being said, Suk, I'll come to you first for your first question.

Speaker E: Yeah, thank you. Um, and I asked this, it's a bit of a loaded question, but recently I've been in a couple of um, I guess incidents, uh, where our uh, incident response team have been part of understanding uh, and investigating a particular incident or a breach. So with that said, um, I'm quite keen for folks to share their thoughts on within our ecosystem. So whether that's the security tooling teams as a whole and what we try to do in terms of improving uh, and protecting the security posture. Do you guys feel like um, there's a decent level of understanding of where machine learning, I probably call it more than AI, where it can be capitalized on and used more. Ah, and then there's a clear area where you just know a subject matter expert, that is a human needs to help make those decisions or, or move the business in the right direction. I'll pause there.

Speaker A: Neil, I'll come to you.

Speaker B: Um, we're still very much early days in seeing how AI is going to be um, applied anywhere really. But in this field, um, the biggest um, advances I think are going to be in the, in the realm of um, anomaly detection and threat detection. When you can scale machine learning techniques across large, large volumes of data and many different kinds of data with um, minimal effort from the engineering team, scaling out large scale um, anomaly detections and also presenting that to an analyst as well. It's one thing to detect an anomaly, it's how do you put it into some kind of context that an analyst can understand? And I think that for me is one of the most obvious places where AI is going to be deployed. And I think it already is as well. There are already products in the market that can do that kind of thing.

Speaker A: Perfect. Giles, I'll come to you next.

Speaker D: I think the short answer to the question is no. Um, agreeing with Neil in the,

Speaker A: the

Speaker D: potential is fairly limitless at the moment. Um, but yeah, that ability to ingest massive amounts of data and just flag the key bits that Potentially need a human review is great. Um, and I also think that the ability to add context, um, it's one anomaly of 10 in the past year. Is it? So what, what's the extra stuff that we can add to that that's not human generated? Um, so I very much see it as augmenting a human. Given how overworked most people in security operations are nowadays, I don't think it's necessarily a threat. I think it's just a blessed relief for the time being.

Speaker A: Daniel smiling there. I'll come to you next.

Speaker C: Yeah, I think, um, just kind of echoing what's been said really. I think that we've got plenty of tools and techniques out there for, for kind of during incidents, during cyber incidents which actually use AI. So we got some antivirus systems using AI, we've got intrusion detection systems using AI. Um, the problem is they're still creating quite a lot of noise and it still requires a lot of kind of investigation by people. And um, uh, like the others really, I'm a believer that human intelligence and artificial intelligence kind of combine um, to solve problems, including the problem of increasing CyberSecurity. Um, and AI should be used in places which are kind of tedious or repetitive or um, even dangerous sometimes for humans. Um, and I think that a lot more needs to be done in terms of innovation in this area, ah, for human AI collaboration, particularly within um, security operation environments and um. And I also think that there's a lot more opportunity for post incident response, digital forensics and business recovery, um, and perhaps also in the cryptographic space as well. So there's a lot of opportunity here which innovation can kind of happen as well.

Speaker A: And Suk, I'll come back to you to summarize.

Speaker E: Yeah, I think that's a great reassurance, um, because it's a hype cycle and we're seeing, I think as Neil said at the beginning, um, it's too early to tell, I don't think retrospectively yet we can really review use cases or look at a case where we can see the impact it's having. Um, so I think everyone's a strong believer that the combination could be very, very powerful. And I think maybe in a year's time as more adoption takes place, we'll probably have uh, maybe the same view or slightly more bias one way or the other. So. No. Thank you. Thank you for the inputs.

Speaker A: Thanks Duc. I suppose as we've explored the landscape of AI integration into cyber, I think it's probably only right we look at a potential impact on specific roles within the industry. So with that being said, over to you Neil.

Speaker B: Um, yeah. So which infosec roles are most likely to be at risk from AI driven developments and what should we do it do about it and the industry as a whole?

Speaker A: Giles?

Speaker D: I struggle on this one in terms of which ones are most likely. I think the slightly cynical side of me is probably people in governance, risk and compliance where there's a lot of document writing to be done and reporting and I feel like AI could really lean into that, um, into that space. Uh, but is it a risk necessarily? I'm not sure. Uh, I think the ability to output a lot of data isn't necessarily a benefit because people don't want that. You're still going to end up with human interaction there to face off to other people. The endless issue in cybersecurity is taking something very technical and explaining it to the business and making them interested and bothered. So uh, I think maybe it'd be that the big sort of where I lean on our dev team potentially to do some big data analytics for me or just set some patterns then perhaps I could not, perhaps. I can certainly see AI leaning into that space and helping me out.

Speaker A: Cool. Done.

Speaker C: So um, in 2018 in my previous Ah, role as the founder and CEO at the time of Arwen, um, I exhibited an exhibition in Munich called Automatika. Um, it's one of the world's largest robotics and automation exhibitions. And I remember hearing about um, and I hope I get this story correct, um, the trade unions in Denmark, um, getting involved in policy around automation because the fear that in this very industrial um, uh country um, automation would lead to a loss of jobs within the factories essentially. And they decided to, I don't know what caused this but they decided to take a kind of automation positive perspective on it and actually embrace cobot's collaboration collaborative ah, robots. Um, and the result has been as far as I'm aware, a very significant increase in the number of industrial jobs rather than fewer jobs. Um, and I feel like we'll see that here too. Um, AI is a tool which kind of supplements and has the potential to increase the security and the safety um, of an organization and as well as having the potential to increase job security and potentially even career happiness. Um, I take a very positive view here on this one. Um, but it's got to be done right. It really has to be done right. And as we kind of saw in this Danish example, the policies have to be there, the upskilling has to be there and the ability to be agile, um, in both society and in those organizations that all has to be there in order for it to be a success.

Speaker A: Thank you, Dan Suk.

Speaker E: Yeah, I mean I don't know if it's, if it's initially a risk. I think there's definitely a large opportunity for the soc analyst here to, if you think of the trajectory of their careers, on the role they do and what they probably want to do if, and you hear a lot about burnout from analysts because of the alert um, fatigue that they're experiencing with what they're managing tooling wise. So you know, anything from a machine learning standpoint could give them an opportunity to get the, the, the model to do a lot more of the initial analysis and triage where you know, an analyst could start spending a lot more time in a threat hunting campaign or trying to understand what, what's happening out there from a threat actor profile standpoint and why and m. Serve their end customers better. I think it becomes a risk though if they don't, you know, delve into those additional, probably more rewarding tasks and, and just are stuck in that kind of uh, analyst mindset because then the, the model will be able to do what they do. So then their role I think would be exposed. And um, I can't remember who said it, but post incident, I think when you're retrospectively looking at the um, you know, where patient zero was discovered in an attack, how it basically did lateral movement, I think a lot of your models could help with that depending on the type of data sets they're uh, contextualizing. So it's probably a combo of opportunity and risk depending on how you react to it. I like Dan's story about the hype of automation which actually has actually resulted in more jobs, not less. So it could go both ways.

Speaker A: Amazing. And Neil, I'll come back to you to summarize.

Speaker B: There's a consensus here around um, it's a force multiplier, an enhancement to our jobs. And there, there is. Every security practitioner knows there is always way too much to do and this will help us to be more productive with that workload. I think, um, the risk may be in not embracing it fully rather than it being a threat to somebody's

Speaker D: great.

Speaker A: Yeah. So I assume everybody is kind of of the same mindset that AI will aid people in doing their jobs rather than replacing their jobs completely. Right.

Speaker B: I really hope so. I've seen some great things that are on their way to being properly realized.

Speaker A: Amazing. Okay, sweet. I suppose, you know, as we contemplate the evolution of cyber security roles, uh, in the age of AI, I suppose a fundamental question arises. So Giles, I'll come to you.

Speaker E: Sure.

Speaker D: So, uh, my question for the group is will AI uh, ever really be trusted without some form of human input? And I'm just going to add a little subtext to that as I wrote that. And then when that seems very simple, is more also around. Will there be a human to human interaction involved? Will people need to know? Even, even in security operations, I don't think I would buy a purely AI driven tool now without knowing who was in control of the dart, the strings at the back end. So that's where I was going with that.

Speaker A: Dan, I'll come to you.

Speaker E: Mhm.

Speaker C: So um, from my perspective, the thing is, um, we already do trust AI to some degree. There's a lot of trust in things as simple as Autocorrect or the chatbots that you see in customer services. Although that's more of a trust from the employers of that AI rather than the customers. Um, we see trust in things like robo investors, um, if not directly or definitely indirectly through uh, banks and things. We trust to a degree in the weather reports which we've been um, using models based on statistics for many, many years. And so we do trust in AI. Um, but all of this said, we do have the right to be wary as well. And I think um, to alleviate some of that anxiety, I think there are certainly more things that can be done with um, what's known as explainable AI and trustworthy AI where we can really try to kind of delve into why a machine has made a particular decision or output. Um, and this, um, this doesn't necessarily require human input per se, but certainly human auditing before a decision or an action is executed based on the output. So that would be my take on that particular question.

Speaker A: So I'll come to you next.

Speaker E: Yeah, I like the word um, that Giles used, trust, because I think it's a subjective, um, sentiment if you like, in terms of, or how you see the decision being made. And I think it's more about the impact. So if you use the principle of um, orchestration and automation within a soc. So the soar concept, how much you probably can rely on a workflow, uh, where it's orchestrated based on, you know, what, what, what detections come in, can you drive that workflow into something like ServiceNow to then either stop the impact of that particular, um, configuration or whatever the case may be. I think as soon as you start to see the impact of that decision increase, you rely less on the technology and you want a human to make the decision. So I think in the same vein, I have no doubt that the AI models can do much more, uh, they can probably make much more sophisticated decisions, but it will be down to the area that you're governing or you're responsible for, where I think it shows how much trust you're able to impose or allow. And maybe it's a case of how many resources do you have? Like, if you're really lean and you have no choice but to rely on the model to do a lot of it for you, then you don't have it. But again, I mean, if you're a control freak and you're like, no, I'm sorry, but I actually have to be the authority that signs that off, then you may be limiting how much adoption you have. So I think only time will tell how much we truly end up trusting this opportunity or capability.

Speaker A: Perfect. Thanks, Rick. I'll come to you, Neil.

Speaker B: Um, most organizations have processes in place that can do some assurance around the quality of decisions made, depending on, regardless of whether it's automated or human. And that should be no different for AI really. And um, that sort of process will tell you how much you can trust. An AI audit had, uh, the quality of its decision making just as you would do in a SOC or any other part of the business.

Speaker A: Amazing. And Charles,

Speaker D: hey, yeah, some, some really interesting points I thought there actually. I particularly enjoyed the basically we're already trusting AI point from Dan. Um, and then perks point about if you're a real control freak, you're going to really want to dig into it. And then with SecOps being SecOps, I think there are probably quite a lot of control freaks already. So the explainable AI, uh, and then that assurance around the quality of decisions, I should say is probably going to come to the fore just uh, in that cyber ecosystem, by the sounds of it.

Speaker A: Perfect. Thanks, Giles. Um, and I suppose as we've examined the intricacies of AI systems, let's zoom out a little bit and consider the bigger picture. So Dan, over to you.

Speaker C: Yeah, bigger picture, certainly. I think, um, when it comes to the adoption of AI and the support, um, that the public has, I'm curious to know your opinion on what has the government actually done well in AI so far and how might they be able to give, um, additional support to us in society, but also specifically within cybersecurity sectors?

Speaker A: Shock. I'll come to you.

Speaker E: Um, it's a great question and I Feel like I don't have a lot of insight here other than optically um, since I guess late 2022, introducing a chat, GPT, Etc. I think for the UK we've definitely tried to um, ride the wave and lead uh, on how AI is going to determine um, industry. So you know you've seen the government really wanting to play a center stage role of bringing uh, public sector, private sector together. And then I guess recently you have the introduction of the, the UM act, the EU act for AI. And I know in April there was something we kind of signed with the US as an MOU to see how we can start testing things together. So for me I feel like it's a bit early uh, to really see uh, what the government is doing. It seems to be encouraging it and promoting it but maybe you know, in two years time where we've seen more adoption we'll start to see is it, how is it being regulated and is it still allowing agility and innovation to go at the speed it is or is it having to be slowed down because of the ethics impact? Um, I feel like it's a bit early to tell yet but um, I think at the moment that seems to definitely, definitely be a lot of encouragement, at least on the UK government side. That's my view.

Speaker A: Thanks Neil.

Speaker B: Yeah, this is a difficult question to answer um, because there's not much hard information out there about this. Um, to me it's um, good that no knee jerk reactions have been made around um, overly harsh policy enforcement to try and keep the genie in bottle. And that has given those who have an innovative mindset to experiment and put some early use cases in place. But there needs to become a point where you can develop some momentum around the adoption of this and the um, supporting this in the press isn't enough. It needs real um, support with a plan and funding and perhaps some centralized guidance on how to do this because it does require specialist knowledge and a lot of government departments, while they may have the need um, to implement AI to increase productivity, they may not have the resource to draw on to implement it.

Speaker A: Thanks Neil Giles.

Speaker D: Yeah, I, I um, tend to be a bit of an optimist about all new things as probably a lot of people in tech might be. Um, so I'm, I think it's going quite well at the sort of leading edge of AI where we're seeing loads of use cases, everyone's testing it out and seeing the government um, run that big multinational conference and then the NCSC collaborating across different countries to produce at least Some high level guidelines uh, is quite promising. Uh, I also tend to agree with Neil in that how specific can you be as a government to provide anything beyond guidelines when the technology is so new and the use cases are so varied. So yes, it looks quite good to start with. I would hate for it to become some kind of prescriptive horror. Uh but at the same time there's definitely going to need to be some sort of what it looks like. I don't know whether it's an extension to you know, DPA or some other form of legislation or whether we're just going to go it alone. Uh, would be interesting to see.

Speaker A: John.

Speaker C: Oh yeah, some really interesting responses there I think. Um, yeah, I mean certainly from my perspective, um, the, the UK um held this um, AI Safety Summit, um, the first one, um, and there's going to be another one, another two this year. Um, uh, I think one's in, one's being run by, by Korea and another's um, by France I believe. Um and so you know the UK has, is being seen as a AI safety um kind of leader in a way. Um and I think that is you know that they are starting to back this up. So there's now an AI Safety Institute as well. They've released their first open source tool to inspect um, uh, inspect AI technologies. Um and I've also personally seen some relatively good investments from the government and government supported initiatives. I think probably more now needs to be done to get the public to understand the pros and the cons of AI and what to do about the cons and then maybe importantly how the public can start to upskill and how people who want to and can, can start a career within AI or AI safety and security in including cybersecurity. And I converged much um, like we've seen in cybersecurity really there are initiatives out there to uh, help people get into cybersecurity um as a career um, and also try to drive up the cybersecurity hygiene of organizations and um, personal security as well.

Speaker A: Dan, you mentioned then uh, you hope that we're able to kind of upskill the public um and to know more of the pros and the cons, cons around using AI. But do you think like the general public that aren't particularly involved in this sector like really care about the cons because you know you talk about kind of efficient attacks or you know we all get them text telling you to click on links and you know there's a certain demographic or certain type of person that Just would click on any link that's ever sent to them and they would never even bother trying train themselves or upskill to learn kind of what these attackers are doing. Do you think that will pose a risk within AI?

Speaker C: There are certainly attacks that do attack AI models, um, which could lead to misinformation and disinformation. Um, and so I think the awareness that those kind of things um, can happen and have started to happen, um, um, is, is going to be quite crucial really for the trust that people have in these technologies.

Speaker A: Yeah, okay, uh, fine. All across my social media feed now all I see is updates about ChatGPT and how you know, the public are loving it. But they're the exact same public that are put in personal information into ChatGPT in order to kind of get a response. But what they don't understand is that personal information can get used to elsewhere. Right. So I don't think the general public probably appreciate how vulnerable they can make themselves by you know, using the likes of the ChatGPT and the kind of AI as a whole.

Speaker C: Yeah, yeah, absolutely. And organizations like the um, uh, Electronic, um, Frontier foundation, um, EFF have been kind of championing um, the protection of personal data on the Internet for many years now. And I think that's kind of a similar, a theme here. You know we need, we need some protections around personal data um, within AI systems, uh, and also corporate data in AI systems as well. Um, there's a way to go. There is a way to go.

Speaker A: Perfect. Would anybody like to add something before we end?

Speaker B: Um, something Daniel said earlier about the public perception of these things, um, is important as well. And I'm going to draw back to recent events where there are subcultures of conspiracy minded people whose voices have been quite distracting in certain areas over the last few years. And I think that definitely poses a risk to full adoption of AI. Um, sure, it's good that we have controls about how it's used. But um, yeah, conspiracy minded public opinion is dangerous in this space as well as it is uh, in a lot of technology space. If you look around the fear around the word algorithm and um, some of the discussions that come up around that in Congress, people don't really understand what that means. It's not that complicated when you've looked into it and it's definitely not something to be scared of. But there is a fear or an accusation against that, that word and that technique. And I'm pretty sure we'll see the same thing happening to AI in the next few years too.

Speaker D: Yeah, I, uh, had an interesting conversation with someone at work the other day who likened the sort of advent of AI with other big technical revolutions and in particular the sort of mass production of the car. And he's a fairly cynical man who said, well, this is all well and good and when cars first came out there were all sorts of rumors and speculation about them. You know, could, could the human body survive traveling that fast at 10 miles an hour, 15 miles an hour in a car when it wasn't a horse and stuff like that. And it's exactly what Ian is talking about. Everyone theorizes about it when they don't understand it. Um, and then interestingly, the car's mass adopted. And the cynical man's point is everyone uses them, not everyone's good at it. Um, and that's probably a rule for phishing and any other form of technology as it comes out as well.

Speaker A: Perfect. Anybody else Suk?

Speaker E: Yeah, I think just listening to the guys, something that came to me as Daniel was speaking. If you think about the late 90s when the Internet was just taking off, um, and if you look at people's general behavior, whether they're in the industry or they, they know what's going to come or not, I think these things organically just take, run their course and then it's a, uh, matter of time before you start to see the impact. I think for us, the world of work that we're in, we're going to talk about it and see it day in, day out. But somewhat Joe Blog, standing at the bus stop, like you said, they're none the wiser. And even if their public information is out there, they don't really care because they um, you know, they want to like whatever they like online, they want to share. It's just the way of, of the world Now I think we're a much more digitized population globally now, so some kind of skills in, in digital, whether it's on your phone or computer, they're a lot more standard practice now than they were. But I think the Internet came, it took its course and then with E commerce, it exploded. So we'll probably see something similar, but it might not be big bang. It will be over a certain time and period is probably what I, I think will happen.

Speaker A: Amazing. We've explored AI's impact on cyber roles, its integration, potential job risk, uh, need for human oversight and government involvement. So I think a key takeaway for, for me especially, um, as someone that doesn't use AI really as part of my day to day is that AI will enhance but will not replace human expertise. Right, um, and I suppose we'll leave it there. Um, this has been the Evolution Exchange podcast. I want to take this opportunity to thank Daniel Giles, Neil Ansuk for providing insights into the topic as thoughts leaders in the industry. If you'd like to get involved in one of our upcoming podcasts in the cyberspace, reach out to me on LinkedIn or email me at, uh, Gareth Davis at, uh, evolutionjobs.co uk. See you next time.