


AI is used in almost all areas of security. The impression quickly arises that nothing works without AI. But experts are very sceptical about this.
They warn that not everything labelled AI actually contains AI.
Our article "AI capabilities in threat defence: more to appear than to be?" provides a critical view with useful and less useful examples of use.

Artificial intelligence (AI) has been used successfully in a variety of product groups within cybersecurity for some time now. In the ubiquitous field of endpoint detection and response (EDR and XDR), AI-based solutions continuously monitor end user devices for suspicious changes, analyse suspicious activity and automatically respond to threats.
In the network security sector, which is also very common, also known as network detection and response (NDR), AI monitors network traffic in order to recognise anomalies and suspicious activities and react to them if necessary. Flexible products can adapt to changing network topologies and detect new systems with specific network behaviour, for example. Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are located above the NDR. They collect data at neuralgic points in the network in order to generate deductions that indicate an attack. Time-delayed events in particular need to be correlated, and AI helps with this. AI is used in many other product areas, for example in security information and event management (SIEM) systems. As the merging of various logs from different sources alone usually results in very large amounts of data, AI is often an indispensable component when analysing them.
The AI revolution is in full swing - exciting and frightening at the same time. Defenders are using AI, but when will attackers take advantage of it? And what is our battle plan?
Find out the answers to these questions and more in Mikko Hyppoenen's keynote.
Please note: The video is in German.
Recording of the it-sa Expo&Congress forum contribution