“AI will flip the current attacker advantage” predicts Google’s threat intelligence group senior director

“In cybersecurity up to now, the attackers have had an overwhelming advantage. Whereas the defense side must perfectly protect the entire attack surface, attackers can achieve their objective if they succeed in breaching one vulnerability. With the appearance of AI, however, the balance of power may change.” So spoke Shane Huntley, Senior Director in Google's Threat Intelligence Group.

Cyber threats are growing increasingly serious Japanese corporations are becoming targets

Huntley pointed out that cyberattacks affecting Japan are becoming an increasingly serious problem. More than half the targets of advanced persistent threats (APTs) in 2023 were in the Asia-Pacific region. More than 90 percent of the attacks against Japan originate in China or North Korea, targeting a wide range of organizations from government agencies to vital infrastructure, ports, and ordinary companies.

He further noted that one factor behind the increase in cyberattacks is the rising popularity of cryptoassets. The reason is that these cryptoassets, which can be used as difficult-to-trace means of transactions, make it easy to monetize stolen information assets. He stressed, “To deal with this situation, not only individual measures but efforts throughout the entire ecosystem for preventing the monetization of cybercrime are needed.”

AI-driven defense strategies will solve issues in many organizations

Raising expectations in this regard are defense strategies using AI. AI with highly advanced inference capability learns past attack patterns. Able to process at far greater speed than human beings, it will become a powerful asset for the defense side. For example, AI can instantly detect anomalies from huge amounts of log data and predict new threats based on past attack patterns. Moreover, if routine tasks such as everyday monitoring and initial response are automated using AI, security experts can concentrate their efforts on strategy decisions and response to complex threats.

Huntley noted that, “While we cannot afford to let down our guard, since attackers are also making use of AI, I tend to be optimistic about defense strategy using AI.” He gave three reasons for this.

First is the superiority of the data held by the defense side. Google and other technology companies hold vast amounts of security data and can use this data effectively with AI. Second is the effect of “equalizers” on raising an organization’s security capability. There used to be a large gap from one organization to another; but with the spread of AI, many organizations can acquire advanced defense capability.

The third reason is the appearance of large-scale automated defense systems. By integrating AI operating 24 hours a day with widely used platforms, fast defense response can be made even in an organization without a security officer. “For addressing the worldwide shortage of cybersecurity personnel, automation by AI and expanding the scope will become an effective solution,” said Huntley.

Greatly improving threat detection rates with AI Further boosting autonomous measures

In his talk, Huntley introduced initiatives being taken in Google. Google has been promoting security measures with AI for more than 20 years, and Gmail detects and blocks 99.9% of phishing and spam email before it reaches the inbox.

A threat detection system using AI has improved the malware detection rate by 70% and raised file identification efficiency by up to 300%. In addition, by automating vulnerability management with AI, the whole defense process, from detection of code vulnerability to suggesting fixes and incident response, is being made more efficient.

As for what’s ahead, Huntley said Google is working on further strengthening autonomous measures with AI, aiming to advance to a system capable of “self-healing” and “self-defense.” Toward that realization, Google is currently seeking to build a global partnership-based approach around its Secure AI Framework (SAIF). The company is investing actively in R&D, and is supporting research on cybersecurity using AI through the provision of two million dollars (approx. 300 mil. yen) in research grants.