Three-quarters of UK critical national infrastructure (CNI) organizations identify the use of AI to drive cyber threats as a security concern. This is according to new research by Bridewell, which surveyed 521 staff responsible for cyber security at UK CNI organizations in sectors such as civil aviation, telecommunications, energy, transport, media, financial services, and water supply.
The research found that 78% of respondents are worried about AI-powered phishing attacks in which criminals use AI to radically improve the accuracy and wording of their email lures at scale. Criminals can also employ AI to complement basic coding skills, reducing the barrier to entry for exploits and enhancing the sophistication of their malware.
78% of respondents also said they have fears about:
- Adaptive AI cyber attacks that constantly evolve their tactics,
- AI-driven exploit development,
- Automated hacking using AI.
In addition, 73% said that they were concerned about polymorphic malware, which mutates with every infection.
AI cyber resilience opportunities
The research also explored how CNI organizations are using AI to combat cyber criminal groups. AI-driven exploits or techniques are not yet as effective as conventional cyber tactics, and businesses are able to use AI-focused tools to protect their systems and infrastructure. With its ability to analyse large datasets rapidly, AI can be a useful tool in detecting malicious activity in a system or network, spotting anomalies and suspicious behaviour. The research found current deployment of AI in cyber defences is in its early stages. Fewer than three-in-ten respondents’ organizations are using AI-powered threat intelligence platforms (29%), AI-driven data-loss prevention (28%), AI-enhanced endpoint protection (27%), or AI-based phishing detection and prevention (27%). Almost all organizations (94%) are, however, using some AI tools.
While we are at the early stages of AI-driven cyber attacks, concern among CNI organizations is not unfounded as the technology presents itself as a future threat. Businesses can prepare for the impending AI arms race by incorporating the technology into their cyber defence strategies. AI can be a force for good by helping CNI organizations to enhance threat intelligence capabilities and accelerate detection and response strategies.
Martin Riley, Director of Managed Security Services at Bridewell
