There is a growing disconnect between the increasing sophistication of cybersecurity threats and IT teams' readiness to combat them, according to an O'Reilly study of more than 1,300 IT professionals.
The survey found that nearly a third of technology professionals were aware of a lack of security skills in AI, particularly in addressing emerging vulnerabilities such as spot injection.
Nearly 40% of respondents identified cloud security as the most important skills shortage, even though cloud computing has been around for a long time.
The report also highlighted that AI-powered security tools are expected to be a top priority in 2024, with 34% of professionals focusing on deploying them, closely followed by an increase in security automation efforts (28%).
Report author Mike Loukides noted that AI presents an entirely new set of threats that are only just beginning to be understood.
“AI has made a lot of progress in the past decade, but when GPT-3 came out in November 2022, everything went off the rails,” he said. Everyone, including the security community, was shocked – both by the possibilities and the risks.
Nearly a third of participants cited a lack of AI skills, particularly regarding vulnerabilities such as immediate injection.
“Companies need more people who understand forensics and red teaming,” Loukides said. “However, this will likely always be a skills shortage – people doing forensics and red teaming must have a strong knowledge of the basics, and must keep up to date with the latest developments.”
Concern about traditional threats
Meanwhile, traditional threats such as phishing remain a top concern for 55% of respondents, while network compromise (40%) and ransomware (35%) still pose significant risks.
On the preventive side, multi-factor authentication is widely adopted, with the vast majority (88%) of technology teams implementing it, with 60% adopting endpoint security and almost half using a zero trust model.
However, the survey results also underscore a certification gap: while 51% of companies require certifications to hire, 41% of members of security teams are still not certified, most notably on incident response teams, where 70% were not. Certified.
Deploy IT security intelligently
In the face of limited resources, organizations need to ensure their technology helps leverage the expertise and skills they possess, said Nicole Carignan, vice president of strategic cyber AI at Darktrace.
“Organizations should look for integrated solutions designed specifically for cloud data rather than trying to modify on-premises tools,” she said.
With the right implementation, AI can dramatically enhance visibility and threat detection across multi-cloud, hybrid and on-premises environments, Carignan explained.
“AI-powered agentless cloud solutions can reduce the complexity and costs associated with installing and maintaining agents on cloud resources,” she said.
They can help reduce the performance impact on cloud workloads and can simplify security deployment across large, dynamic environments.
“With tools that provide continuous visibility, independent investigation, and real-time response, security teams can focus their limited time and resources where they are needed most,” Carignan said.
Invest in training and partnerships
Enterprises can address the AI security skills shortage by investing in specialized training programs and partnering with AI security experts, added Steven Koski, field CTO at SlashNext Email Security+.
“Encouraging cross-functional collaboration between AI and security teams can enhance knowledge sharing and skills development,” he said.
Leveraging advanced AI-powered security solutions can also help bridge the gap by automating complex threat detection and response tasks.
To prepare for AI-powered security and automation tools, Koski said organizations should first evaluate their current security posture and identify areas where AI can add the most value.
“Investing in solutions that seamlessly integrate with existing security infrastructure and provide actionable insights is critical,” he said.
He added that improving security teams' skills regarding artificial intelligence concepts and promoting a culture of continuous learning would help ensure successful adoption and maximize the benefits of these technologies.
