76% of the UK’s critical national infrastructure (CNI) organisations have identified the use of AI to drive cyber threats as a current security concern.
This dramatic rise in concern about how cybercriminals use AI is revealed in new research by pioneering cyber security services firm Bridewell, surveying 521 staff responsible for cyber security at UK CNI organisations in sectors such as civil aviation, telecommunications, energy, transport, media, financial services and water supply.
AI-powered phishing attacks
The research found that 78% of respondents are worried about AI-powered phishing attacks
The research found that 78% of respondents are worried about AI-powered phishing attacks in which criminals use AI to radically improve the accuracy and wording of their email lures at scale. Criminals can also employ AI to complement basic coding skills, reducing the barrier to entry for exploits and enhancing the sophistication of their malware. These developments are why 78% of respondents also said they have fears about:
- Adaptive AI cyber-attacks that constantly evolve their tactics
- AI-driven exploit development
- Automated hacking using AI
All of the AI-driven threats listed in the research are of concern to more than 70% of respondents – including polymorphic malware which mutates with every infection. 73% said they fear this emerging threat.
Current deployment of AI
The research found the current deployment of AI in cyber defences is in its early stages
The research also explored how CNI organisations are using AI to combat the increased use of AI by cybercriminal groups. AI-driven exploits or techniques are not yet as effective as conventional cyber tactics, and businesses are able to use AI-focused tools to protect their systems and infrastructure. With its ability to analyse large datasets rapidly, AI can be a useful tool in detecting malicious activity in a system or network, spotting anomalies and suspicious behaviour.
The research found the current deployment of AI in cyber defences is in its early stages. Fewer than three-in-ten respondents’ organisations are using AI-powered threat intelligence platforms (29%), AI-driven data-loss prevention (28%), AI-enhanced endpoint protection (27%), or AI-based phishing detection and prevention (27%). Almost all organisations (94%) are, however, using some AI tools – a trend certain to gain momentum as cyber threats escalate and become even more sophisticated.
Stages of AI-driven cyber attacks
“While we are at the early stages of AI-driven cyber attacks, concern among CNI organisations is not unfounded as the technology presents itself as a future threat,” said Martin Riley, Director of Managed Security Services at Bridewell.
“Businesses can prepare for the impending AI arms race by incorporating the technology into their cyber defence strategies. AI can be a force for good by helping CNI organisations to enhance threat intelligence capabilities and accelerate detection and response strategies.”
