Dive Brief:
- AI is disrupting enterprise cybersecurity environments, according to a survey of nearly 600 cybersecurity decision-makers and practitioners published Thursday by IT management provider N-able. Among a cohort of managed service providers, small and midsize businesses and midmarket organizations, more than 4 in 5 said they had experienced a confirmed or suspected AI-assisted attack in the past year.
- N-able found that organizations adopting AI are split on its operational impact. Just over half reported that AI made security operations more manageable, while just under half said it has introduced greater complexity. Nearly 90% of respondents reported making at least minor exceptions to security policies to enable AI tools.
- AI adoption is forcing trade offs as organizations rethink data strategies, N-able Director of Threat Research Brendan Griffin told Channel Dive. “A couple years ago, it was all about building silos to protect all of our information, and now we're talking about maybe not breaking down those silos, but at least securing access into each one of them, so that we can take advantage of all of the insights that an AI capability might provide,” Griffin said.
Dive Insight:
IT services firms are on the frontlines of AI adoption campaigns, as organizations lean on partners to guide deployments. MSPs in the N-able study reported the highest rate of varied or greater operational complexity following AI adoption, consistent with the demands of managing multi-tenant environments.
AI has given attackers tools to speed up and scale their operations. It’s also created pain points for cyber defense teams, as automated alerts proliferate. Over 86% of respondents said alert volumes increased in the past 12 months and nearly a quarter reported a more than 50% surge. Frequent alerts disrupted incident response daily or several times a week for more than half of respondents and nearly the same proportion reported duplicate alerts from overlapping tools.
Context — or a lack thereof — is a key to making AI security tools more useful. More than half of respondents said they received duplicate alerts from overlapping tools, and 48.9% reported that AI-generated alerts lacked sufficient context.
“AI can be non-deterministic,” Griffin said. “It can apply or make inferences that are somewhat challenging to make sense of without additional context.”
Security teams are grappling with multiple additional challenges, including staffing shortages, compliance burdens and budget constraints.
AI-assisted attacks have left small small and midsize businesses vulnerable, according to Griffin.
“We’re in an era where smaller organizations are experiencing disruptive or destructive ransomware attacks combined with the theft of information,” he said. “That one-two punch can lead to questions like, ‘Is my server just not available, or have I been attacked?’”
Value-based judgments that balance risks with opportunities are the most important tool in cybersecurity, Griffin said.
“If you think about what cybersecurity incident response and business resilience are all about, it's a lot less about understanding the salacious details of the techniques of what an adversary is trying to do,” he said. “Those are always going to shift. What actually matters is what is the risk to my business. How can I protect the things that matter most to me and to the people I'm trying to serve?”
