Over three-quarters (76%) of the UK’s critical national infrastructure (CNI) organisations have identified the use of AI to drive cyberthreats as a current security concern.
This dramatic rise in concern about how cybercriminals use AI is revealed in new research by leading cybersecurity services firm, Bridewell, surveying 521 staff responsible for cybersecurity at UK CNI organisations in sectors such as civil aviation, telecommunications, energy, transport, media, financial services and water supply.
The research found 78% of respondents are worried about AI-powered phishing attacks in which criminals use AI to radically improve the accuracy and wording of their email lures at scale. Criminals can also employ AI to complement basic coding skills, reducing the barrier to entry for exploits and enhancing the sophistication of their malware. These developments are why 78% of respondents also said they have fears about:
- Adaptive AI cyberattacks that constantly evolve their tactics
- AI-driven exploit development
- Automated hacking using AI
All of the AI-driven threats listed in the research are of concern to more than 70% of respondents – including polymorphic malware which mutates with every infection. Just under three-quarters (73%) said they fear this emerging threat.
The research also explored how CNI organisations are using AI to combat the increased use of AI by cybercriminal groups. AI-driven exploits or techniques are not yet as effective as conventional cyber tactics, and businesses are able to use AI-focused tools to protect their systems and infrastructure. With its ability to analyse large datasets rapidly, AI can be a useful tool in detecting malicious activity in a system or network, spotting anomalies and suspicious behaviour.
The research found current deployment of AI in cyber defences is in its early stages. Fewer than three-in-ten respondents’ organisations are using AI-powered threat intelligence platforms (29%), AI-driven data-loss prevention (28%), AI-enhanced endpoint protection (27%), or AI-based phishing detection and prevention (27%). Almost all organisations (94%) are, however, using some AI tools – a trend certain to gain momentum as cyberthreats escalate and become even more sophisticated.
“While we are at the early stages of AI-driven cyberattacks, concern among CNI organisations is not unfounded as the technology presents itself as a future threat,” said Martin Riley, Director of Managed Security Services at Bridewell. “Businesses can prepare for the impending AI arms race by incorporating the technology into their cyber defence strategies. AI can be a force for good by helping CNI organisations to enhance threat intelligence capabilities and accelerate detection and response strategies.”
