Without Threat Intelligence, AI is Just a Buzzword

In the near future, artificial intelligence-driven cyber operations will play an outsized role in how the federal government protects its networks from malicious actors and nation-state threats. 

Aligning to the federal government commitment to “promote the use of trustworthy AI” (Executive Order 13960) and to “maintain American leadership in AI” (Executive Order 13859), a growing number of federal agencies are making strategic moves to broaden and accelerate enterprise AI implementation. A recent report from the Future Defense Task Force said that the Defense Department should divest legacy platforms and increase funding for cyber and artificial intelligence. The Department of Health and Human Services appointed the first chief AI officer, and in its latest AI strategy, highlighted that the department will promote and support using AI in its new and existing cybersecurity frameworks.

The benefits of using AI to shore up the U.S. government’s digital defenses are clear. Faster, smarter and more automated threat processing helps detect and respond to alerts and anomalies in near real-time, allowing cyber analysts to quickly identify the most serious threats and bring their skills and experience to bear in neutralizing them.

But the most critical piece of the operation is often overlooked.

Data is the Fuel

It’s not software or the processors or even the algorithms that make AI-driven security effective. It’s the quality and quantity of threat intelligence that’s being fed into the AI tools that make the difference between an agency that is truly harnessing the power of AI-driven cybersecurity and one whose security protection is AI-driven in name only.

According to a recent FortiGuard Labs threat landscape report, remediation must be an evolving and ongoing priority for agencies. The researchers tracked 1,500 exploits of known vulnerabilities over the last two years and found that only about 6% of exploits hit more than 1% of organizations within the first month, and even after one year, 91% of exploits have not crossed that 1% threshold. Identifying which of the millions of threats and exploits that exist in the wild are likely to be targeted against a federal network is next to impossible for a human analyst.

Private-sector cybersecurity firms collect this global data and use AI to turn it into both "heat maps" of activity directed against sectors such as government as well as actionable threat intelligence that can drive automated action to protect networks, data, and users. This can help agencies weed out less relevant threats and focus their efforts on serious ones directed against federal targets, prioritizing those that are most significant or difficult to detect and counter.

However, perfect security is impossible, and a successful attack is inevitable. Threat intelligence gives IT teams vital context on emerging threats and techniques that are most relevant to them. This helps agencies create a fast and focused security posture across distributed and complex operating environments.

Smart threat intelligence starts with good data. That data becomes fuel fed into the AI/ML engine, which uses the data to produce threat intelligence. A good AI cyber plan leverages diverse information shared across security organizations. Without that kind of data, the correlation and analysis of threats—especially those already known to be dangerous—will be a lot more difficult. The more threat telemetry that can be used to find an active threat, the better. Especially since cyber criminals also are using AI and automation to operate at machine speed, and have become more adept at evading security measures.

Extend Your Reach

To do this most efficiently, agencies need to streamline their cybersecurity processes. Recently, an organizing principle has emerged to simplify and integrate that process—XDR, or eXtended Detection and Response. Gartner defines XDR as a “security incident detection and response platform that automatically collects and correlates data from multiple security products.”

XDR defends particularly well against the kind of advanced persistent threats, or APTs, that agencies face because repeated cyberattacks produce the kind of data needed to better understand the specific threat. APT actors are sophisticated but not perfect; they can and do make mistakes that XDR sensors can detect as anomalies, and that AI can help to correlate and characterize as threats.

With a solid, thought-out framework like XDR, agencies can pull the best information possible from security data quickly and efficiently to identify and mitigate attacks. Agencies planning to modernize cyber operations need to be thinking as hard about the platform and its source intelligence as they are about new features and prospective benefits.

Without threat intelligence giving it purpose and direction, AI is just a fancy word. But with the right fuel, it can fundamentally change the federal government’s cybersecurity posture and shore up the defenses of some of the world’s most sensitive and targeted networks and data. 

Jim Richberg is the public sector field chief information security officer and vice president of information security at Fortinet.