What should security leaders do with AI? They don’t know.
Cybersecurity leaders face 'AI decision fatigue' due to the rapid pace of AI adoption and emerging threats. To mitigate this paralysis, experts recommend starting AI deployment with low-risk, repetitive tasks (L1/L2 alerts) or by arming red teams. The discussion highlighted sophisticated new attack vectors like Ghostjacking—which poisons trusted data sources (logs, alerts)—and questioned the reliability of AI in patching vulnerabilities. Overall, successful AI integration requires a 'human-in-the-loop' approach and strict adherence to Zero Trust principles, particularly regarding agent permissions.
Key takeaways
-
Start AI deployment with repetitive tasks
Initial AI adoption should focus on automating predictable, high-volume activities (e.g., triaging L1/L2 alerts or vendor risk assessments) to reduce staff fatigue and build confidence in the technology.
-
Red Teaming is key for defensive AI use
17:25
Equipping red teams with advanced tools allows them to simulate sophisticated threat actor behavior, enabling defenders to proactively develop countermeasures against emerging attack methods.
-
Ghostjacking targets trusted data sources
17:25
A new attack method involves sneaking malicious prompts into highly trusted systems like logs, alerts, and error reports. This is a sophisticated evolution of prompt injection that bypasses initial security controls.
-
AI patching requires human oversight
Research indicates AI-generated patches (e.g., using GPT 5.5) have a low success rate, often failing to solve the underlying vulnerability or creating new issues. Human validation and partnership are crucial.