Report: genAI rapidly advancing in cybersecurity operations

The field of cybersecurity is rapidly evolving, as suggested by a recent report from Canalys Chief Analyst Matthew Ball. The report, released amidst growing interest in generative AI (GenAI), highlights the movement of cybersecurity projects from proof of concept to the production stage.

According to the report, 72% of early adopter organisations surveyed by Omdia have either implemented or are trialling GenAI for cybersecurity purposes. GenAI holds significant promise in this area, with early use cases focusing on threat detection, prevention, and incident response, among other applications.

The report identifies three main areas where GenAI is currently being applied in cybersecurity. In threat detection and prevention, the technology helps identify anomalies in network traffic and user behaviour indicative of cyberattacks. It also aids in fraud prevention by analysing emails and other content for suspicious language and context. Additionally, GenAI is used in attack simulation, vulnerability management, and automating risk assessments.

In the realm of incident response, GenAI creates concise summaries to support decision-making. This includes analysing threat intelligence data to determine the severity of existing and emerging threats and identifying root causes to develop mitigation strategies. In terms of enabling Security Operations Centre (SOC) analysts, GenAI automates routine tasks like threat intelligence gathering and provides adaptive training to address skills gaps through interactive learning and attack simulations.

Despite its potential, the report cautions that GenAI presents new challenges and risks that need a thorough assessment before widespread adoption, particularly in regulated sectors. Important aspects include understanding the diversity of training data, ensuring the reliability and accuracy of AI outputs, and maintaining transparency in algorithms. Data privacy, adherence to regulations and industry standards, systematic auditing, and continuous monitoring are also critical considerations.

Another challenge highlighted in the report is the lack of in-house technical and operational resources to integrate and optimise GenAI tools. Securing the AI models themselves and assessing new vectors for breaches they may cause are also essential but have received little attention so far. "These issues must be addressed before projects move from proof of concept to the production stage," the report cautioned.

Findings from a Candefero survey conducted in March 2024 support this caution. The survey revealed that only 26% of channel partners and respondents are seeing most or all of their customers’ GenAI proof of concept projects moving to production. However, there is optimism in the sector, as highlighted by the Omdia GenAI Enterprise Survey of Early Adopters, published in May 2024. Respondents had an average annual budget of USD $2.0 million for GenAI, expected to rise by 29% to USD $2.6 million in 2025, reflecting satisfaction with initial results and confidence in the technology's potential.

Operationalizing GenAI represents a significant milestone in cybersecurity and offers partners an opportunity to assess their platform vendors' capabilities. It is arguably the most strategic technology for the next decade, creating both opportunities and challenges.

These topics will be the focal points at the upcoming Canalys Forums 2024, where a panel of vendors and top channel partners will discuss critical issues related to GenAI in cybersecurity. Key themes to be explored include current use cases, future trends, operationalisation, monetisation, challenges, limitations, and ethical considerations associated with GenAI.

The Canalys Forums 2024 will be held in Berlin, Germany, from 8-10 October for the EMEA region, in Miami, Florida, from 22-24 October for North America, and in Bali, Indonesia, from 3-5 December for the APAC region. These events aim to provide partners with insights into the latest trends and guidance on adapting to their customers' changing needs.