Could AI replace cybersecurity pros by 2030?

• The cybersecurity sector has been wrestling with a shortage of professionals for several years
• Like other industries, it’s ripe for automation – but some IT leaders think AI could take over the function entirely

Cybersecurity has had a staffing shortage for a while now. With attacks becoming ever more sophisticated, targeted, and frequent, that’s an obvious problem. 

The average breach is reported to cost businesses US$3.6 million, according to Ponemon Research, going up to US$350 million for those of a larger scale. 

Successful attacks are a case of ‘if’ not ‘when’. More or less every business relies on connectivity today, while a shift to remote work demands even more need for trusted and secure network infrastructure. 

But finding skilled professionals to deploy and manage effective cybersecurity initiatives is proving the biggest struggle. According to research last year by IT security organization (ISC)², there are 2.93 million unfilled cybersecurity positions around the world.  

Naturally, given a shortage of expertise and the evolution of technology taking place constantly, automation has been eyed as the solution to this skills deficit. That makes sense, and the cybersecurity solutions market is so busy and competitive that these kinds of tools are becoming available to reduce the growing burden of work on existing professionals. 

Until now, automation has not been regarded as a “fix-all” solution in cybersecurity, with the “human factor” – advanced knowledge and experience – considered the most important aspect of information security. 

However, a new report by Trend Micro found that two-fifths (41%) of IT leaders believe AI will replace their role by 2030, with the cloud security firms predicting that remote and cloud-based systems will be targeted ruthlessly in 2021. 

The research was based on interviews with 500 IT directors and managers, CIOs, and CTOs, and likely won’t do much in attracting new professionals towards a long-lasting career in infosec. 

Just 9% of respondents were confident AI would definitely not replace their job within the decade and close to a third said they thought automation technology would eventually replace almost all need for cybersecurity professionals.

In this new age of cybersecurity, just shy of a quarter of IT leaders believe data access will be tied to biometric or DNA data, making unauthorized access theoretically impossible, while security will be self-managing and automated. 

Already, machine learning has applications in advanced threat detection and stopping insider threats, which require a more nuanced approach to monitoring and response. 

Sophisticated attacks that move laterally within a network or breaches caused by unwitting access to sensitive information can be tackled by automated and intelligent anomaly detection. 

AI and machine learning can enable analysts and security teams to paw through masses of log and event data from applications, endpoints, and network devices to conduct rapid investigations and uncover patterns to determine the root cause of incidents. 

As the threat landscape evolves, and the cost of a cybersecurity breach becomes increasingly catastrophic for small and large businesses alike, AI and machine learning will hand organizations improvements in detection speed, impact analysis, and response. 

Advances like this may be crucial to halting the advance of more frequent and sophisticated attacks, particularly with cyberattackers themselves now employing AI and machine learning techniques for their own gain.

Cybercriminals can take AI designed for legitimate use cases and adapt it to illegal schemes. Readers will be familiar with CAPTCHA, a tool that has been around for decades now in order to defend against credential stuffing by presenting non-human bots the challenge of reading distorted text. As far as a couple of years ago, however, a Google study found that machine learning-based optical character recognition (OCR) technology could solve 99.8% of these challenges.

Criminals are also using AI to crack passwords faster. Brute force attacks can be sped up using deep learning; researchers have fed purpose-built neural networks tens of millions of leaked passwords, and have asked them to generate hundreds of millions of new passwords, which in one trial, turned out a 26% success rate.

Automation will undoubtedly replace numerous roles, or at least many aspects of them, within the coming years. And ten years is a long time in IT. That said, cybersecurity experts will likely remain in demand as human oversight of AI and automation programs will remain necessary. 

Bharat Mistry, Technical Director at Trend Micro, said: “We need to be realistic about the future. While AI is a useful tool in helping us to defend against threats, its value can only be harnessed in combination with human expertise.”