07 Jun AI Was Everywhere At RSAC 2023 – But It Came In Peace
in Blogs, Podcasts
Artificial intelligence is here to help you, BreachLock’s CEO says, not replace you
– David Braue
Melbourne, Australia – Jun. 7, 2023
Surging interest in artificial intelligence (AI) this year was evident on the floor of the RSA Conference, where vendors were demonstrating integration of the technology into every type of product — not only as a competitive differentiator, but as a potential solution for the skills gap that continues to plague the cybersecurity industry.
AI-driven platforms have emerged to at least partly fill that gap, BreachLock CEO Seemant Sehgal told Cybercrime Magazine from the floor of RSA Conference 2023 — a return to relative normal after three challenging years forced organizers to adapt their conference strategies on the fly — with “a lot of innovation in terms of how we can bring new talent to market.”
“It’s incredible to see the energy that’s in the air,” Sehgal said. “Everybody’s talking about doing [cybersecurity] together to help each other — and I think that’s something that stands out for our security community.”
BreachLock — whose penetration testing as a service (PTaaS) offerings have become prized among the company’s many customers as a way of conducting intensive vulnerability testing without tying up massive numbers of cybersecurity specialists for long periods — has been tapping AI to improve those services’ efficiency in handling security audits, SOC Level 1 and Level 2 analysis, and the myriad other tasks that security specialists handle on a daily basis.
“CISOs are tired of companies pitching them products,” Sehgal said. “What they’re looking for now is a solution that they can take and run with, and that actually solves the problem.”
Automating penetration testing is proving incredibly helpful for companies that have often found the process to be too expensive, complex, and burdensome to run on a regular basis. One recent survey, for example, found that 42 percent of companies run pen-testing just once or twice per year, with 17 percent conducting the tests quarterly, 11 percent monthly, and just 7 percent doing so every week.
Even more worrying was the finding that 13 percent of companies never conduct pen-testing — meaning that the only entities testing their security defenses are cybercriminals themselves.
Automating the process through PTaaS — and enhancing that automation by tapping the fast-evolving capabilities of AI — promises to put pen-testing within reach of any organization.
It also promises to help organizations increase the frequency of their pen-testing, to the point where it becomes far more viable to run a complete re-test once remediation has addressed the issues identified in an initial test.
Turning pen-testing into an iterative process is proving increasingly important in introducing SecDevOps capabilities to fast-moving development cycles where, Sehgal said, simply improving upstream security practices will only go so far.
“CISOs really love the idea of continuous pen-testing,” he explained. “Everybody is talking about shifting security left, but how left can it go? And can it be left alone after that?”
“Continuous security assessments are the need because there is so much changing in the DevOps world so quickly — and if you don’t really get your hands around what the risks are, how quickly they’re moving, and how quickly you can discover them, it’s really a race against time.”
High visibility, even with low staffing
AI is proving increasingly beneficial in helping companies morph pen-testing from something they do sporadically, into something they do on a regular basis — even as often as daily.
Democratizing pen-testing is a goal that Sehgal has considered extensively.
“AI is definitely coming to the rescue there,” he said, lauding its ability to drive much of the analysis and decision-making that has traditionally been the purview of human security experts.
BreachLock “is trying to take some chips off the table from a cybersecurity professional’s perspective,” he explained, “in terms of the effort that they would have had to put into conducting a security assessment.”
And while one persistent narrative about AI has been its threat to existing jobs — a recent Goldman Sachs estimate said “generative AI” tools such as ChatGPT could affect around 300 million jobs globally, or 18 percent of all roles — Sehgal was skeptical that cybersecurity jobs would be among them.
“Specially trained professionals, in terms of cybersecurity skills, are extremely scarce,” he said, “and we all know it. That means their time is precious — and if there is something that can be automated and done in a more efficient way, it should be automated.”
Rather, Sehgal said, the automation of many cybersecurity functions would allow people with those skills to be retasked to other functions.
Increasingly, AI-driven analysis “doesn’t mean that we are taking away jobs from an already short resource that’s in the market, but that we are creating more time for them, so they can help us find the cyber criminals in a much stronger way.”
Automated cybersecurity support is also allowing BreachLock to add new capabilities to its platform without customers having to worry about adding new staff.
The company’s new See External Threats (SET) platform, for example, was launched at RSA Conference and automatically discovers online assets to give CISOs a top-level view of all their assets — even the ones they weren’t aware of before.
This helps focus PTaaS activities to the areas of greatest need, and ensures that subsequent tests include newly added devices that may not have been detected in previous scans.
“It’s incredibly important for CISOs to track down shadow IT and track down the vulnerabilities that are unknown,” Sehgal explained.
“Now that you know the unknown as a CISO, you can immediately put it into our pen-testing queue — and with one click of a button, you can see what your risks are across the full stack.”
– David Braue is an award-winning technology writer based in Melbourne, Australia.
Go here to read all of David’s Cybercrime Magazine articles.
Sponsored by BreachLock
Affordable, Smarter and Scalable Cyber Security Testing
BreachLock™ offers a SaaS platform that enables our clients to request and receive a comprehensive penetration test with a few clicks.
Our unique approach makes use of manual as well as automated vulnerability discovery methods aligned with industry best practices.
We execute in-depth manual penetration testing and provide you with both offline and online reports. We retest your fixes and certify you for executing a Penetration Test. This is followed up with monthly automated scanning delivered via the BreachLock platform. Throughout this process, you have access to the platform and our security experts who will help you find, fix, and prevent the next cyber breach.
Find out why penetration testing with BreachLock™ is the leading choice for startups, SMBs, and enterprises around the world.
BreachLock has offices in The Netherlands, London, New York City, and Wilmington, Del.