Over the past year, artificial intelligence (AI) has risen in prominence across every industry. AI technology, such as ChatGPT and other technologies, have dominated not only the imagination of the average consumer but also provide real-world benefits to enterprises and businesses of all sizes to grow their businesses more efficiently, effectively and securely.
For CISOs and other cybersecurity leaders, AI has the potential to change the way organizations can defend against the latest cyber and physical threats. Applications today can already be seen around supply chain security, physical security, data access, threat detection and response, cloud security, and more. Many of these technologies are already in action today, but the potential is just beginning.
NightDragon has been following this market closely, having long viewed AI as a foundational technology in our investment thesis for both our current portfolio and future investments. AI delivers the potential for incredible innovation, including new technology and greater defense capabilities than ever before. For investors, this is an exciting inflection point for a new wave of opportunity, the beginning of which we have only just begun to scratch the surface.
In the third part of our series of reports evaluating the state of the AI market, NightDragon conducted a survey of our NightDragon Advisor Council, where NightDragon Advisors anonymously shared their spending patterns around AI and where they see the technology in use today, and where it might go in the future. NightDragon’s Advisor Council includes more than 76 renowned industry leaders, including many highly regarded Chief Information Security Officers (CISOs) and other executives from some of the world’s largest and most influential organizations.
Findings from the survey include:
- More than 90% of Advisors either strongly agree or agree that implementing AI is a strategic imperative for their organization. No Advisors disagreed or strongly disagreed with that statement.
- Nearly 50% of Advisors said their organization was currently purchasing or developing security tools to support the usage of Generative AI internally. Around 25% said while their organization isn’t currently, they do plan to in the near future. Less than 10% said there were no plans to purchase or develop security tools for this use case.
- Priorities for securing the ML stack included securing the internal usage of LLMs, deployment of ML models, outputs of ML models, and training data.
- All Advisors surveyed (100%) said they expect to see an increase in cybersecurity attacks against Generative AI tools.
- Nearly 20% of Advisors said they expect to see a greater than 25% increase in the cybersecurity budget for technologies that can secure AI tools. Nearly 50% said they expect to see an increase but by less than 25% and more than 30% said they expect to see no change to current budget for this technology category.
Additionally, we asked some of our Advisors to contribute their thoughts on the use of AI technology today and its potential for long-term growth. Here’s what they had to say:
What opportunities around AI are you most excited about and what potential use cases do you think will drive the most value for CISOs?
Demetrius Comes, Chief Technology Officer, Sovrn and former Chief Information Security Officer, GoDaddy –
I’m most interested to see what products are created using AI, specifically around automation of reconnaissance analysis. The ability to feed reconnaissance data to an AI model and have it predict the most probable attack vectors will not only focus defensive mitigation efforts but with the creativity being exhibited by todays AI we may also find novel new attack vectors as well. The war gaming that could play out in seconds between 2 AIs playing either side of this type of exercise, I believe will challenge our current defense and depth practices.
Gerhard Eschelbeck, Chief Security Officer, Kodiak Robotics –
The rapid adoption of AI requires rethinking our Cybersecurity architecture and posture framework. I am most excited about AI use cases driving innovation and accelerating those innovations in a secure and trustworthy fashion. These new products and services can be developed completely in-house or via a number of open-source foundational models that get trained on your own company data. Thanks to GenAI, the barrier to entry has been lowered dramatically and CISOs are feeling pressure from their CEOs and Boards to support these initiatives when they’ve had little to no visibility or connection with their existing security posture and governance programs. As security leaders we’ve seen this scenario play out before much like DevOps before the advent of DevSecOps only today it’s happening even faster. I see an opportunity for CISOs to lean in and leverage their prior experience to support and enable these AI teams and projects with focus on security and safety.
Renee Guttman, Founder and Principal, Cisohive, former Fortune 50 Chief Information Security Officer –
I am most excited about how AI opens new doors for improving the decades old challenge of identity access management. For example: an AI-based system can more effectively – and at scale – validate government-issued IDs, and match this to a real-time image or video of the person requesting access to systems and information. Any use case today where IDs are checked can be automated with this emerging technology.
Two, AI can sort through all of the behaviors of an employee base, or other user population, to grant the appropriate access to systems and information, pruning access that is not needed for the job and inappropriate for the level of user risk.
Finally, AI can address the access control challenges associated with the billions of IoT and OT systems that have been deployed.
Gary Hayslip, Chief Security Officer, Softbank Investment Advisors –
For me as a CISO, its all about visibility and making informed decisions in real-time that either enable my organization to innovate securely or protect it from evolving threats. Some use cases I am watching evolve are new platforms that will enable me and my security program to monitor the use of generative AI tools inside my environment and the data being put into these tools and their AI generated content. So this first example would be an insider threat, data protection use case that I am seeing companies pivot and add to their current portfolio of services but of course these new services need to mature. Another use case would be taking my current policies, controls, security stack inputs and then providing me a risk baseline in realtime and then allow me to plug in or change controls/technologies and see the impact on my program and see recommendations to reduce risk and mature my program.
Brad Jones, Chief Information Security Officer and VP of Information Security, Seagate –
There is a tremendous immediate opportunity with AI to be a force multiplier for CISOs and their teams. Onerous tasks such as creating policies or employee education campaigns can have most of the heavy lifting handed with just small tweaks and tuning required. Longer term, having AI Security Co-pilots coupled with Security Operations staff will enable massive efficiency and productivity gains and help teams quickly triage and manage what we can expect to be larger workloads generated by adversaries leveraging malevolent AI co-pilots.
Hanan Szwarcbord, VP and Chief Security Officer at Micron Technology –
There’s no AI technology that offers a one-stop solution for all our security challenges. I am excited by the opportunities that AI presents, like its ability to scale the productivity of our security analysts and threat detection teams, its rapid detection capability of anomalous and malicious behavior, and its enablement of data synthesis and summarization in a larger scale. I see the potential for AI to enhance the future generations of internal development of new tools and applications that will strengthen various business aspects.
Micron has been using AI for numerous years in our manufacturing processes. The current focus and acceleration of AI’s capabilities in the semiconductor and security industries will help us realize and refine our capabilities. I am excited to see its worth playing out in the form of threat detection and prediction, where teams can analyze enormous datasets to identify patterns that may indicate malicious behavior in ways we have not been able to before and provide new insights. From those “learned” behaviors, we can begin to predict and detect emerging threats more quickly, accurately, and at scale.
More than ever before, the CSO role is evolving, pulling us from a tactical position to one of accelerated innovation and business enablement more than ever before. As we forge ahead, we must recognize the importance of risk-based security, and Micron acknowledges the significance of implementing measures that assess and mitigate risks at all levels. Through innovative products and a risk-based security approach, Micron is creating a safe and more secure digital future with AI for our global customers.
Jeff Zygmunt, Senior Director, Cybersecurity Architecture and Protective Services, CSAA Insurance Group –
With the rise in Machine Learning (ML)/ Artificial Intelligence (AI) capturing many headlines in trade shows and periodicals, there is much more to learn about the application of this technology from a cybersecurity perspective. For the last few years cybersecurity products have been using some form of ML/AI; Next Gen firewalls, EDR/XDR, and SIEMS, to name a few. The Open AI platform now offers new challenges to cybersecurity professionals, especially in the software development space. As code starts being generated by AI, the source data for which the “AI Code” is developed has to be controlled. An example of this would be similar to the log4j vulnerability (also an open-source vulnerability) that was embedded in many layers of code, both commercial and private. The good news is that red teams and blue teams and also more cybersecurity products will also be using this technology to become more robust.
This blog is the third in a series of blogs on the AI market. Read our previous blogs in the series that analyze the new threats caused by an increase in AI technology and the new market categories and opportunities in the sector.
