The relationship between artificial intelligence (AI) and cyber security is proving symbiotic, with security practices serving to defend AI systems, while AI is simultaneously leveraged to enhance the effectiveness of security. Yet there is also a parasitic parallel, with AI increasingly used by threat actors as a tool to breach security. Much about these interactions is new, and while AI doesn't demand an overhaul of the fundamental security principles, it is clear that practices and practitioners will have to adapt to meet the evolving applications of AI and its emerging risks.

The evolution and deployment of existing security protocols for AI was a key theme for and expert panel that met for S&P Global Ratings' Quarterly Cyber Focus webinar, "AI For Security, And Security For AI: Two Aspects Of A Pivotal Intersection." A replay of the webinar is available here.

"We have learned already so much that we can continue to apply from cyber security to AI. This is not something completely different" said Mercedes Cangueiro, S&P Global Ratings Associate Director, Emerging Risk.

The Three Intersections Of AI and Security

The discussion centered on the ways in which AI and security intersect, with the three key points of convergence set out by Scott Crawford, Research Director, Security, 451 Research, a unit of S&P Global Market Intelligence.

The first is the provision of security for AI, which focuses on the creation of a secure environment in which AI can function. That includes a secure space for systems, security for components, and security of inputs and outputs. The other side of that coin, AI for security, refers to AI's application within security systems. That is likely, at least for now, to focus on processing and analyzing the often overwhelming amounts of data created by cyber security operations in order to better prioritize outputs, monitor threats, and improve systems.

Finally, Crawford turned his attention to the subject of AI against security, where AI is used as a tool to threaten security. "We are starting to see adversaries take advantage of what artificial intelligence can do in order to achieve malicious objectives," he said.

AI Risk Assessment Fits Within Established Paradigms

The panel acknowledged that the task of assessing AI's relationships with security can seem overwhelming, particularly given the complexity and pace of evolution, and lack of precedent. Diana Kelley, Chief Information Security Officer at Protect AI counselled "fellow CISOs" to approach AI risk assessment via the four dimensions of business risk, namely: strategic, financial, operational, and regulatory.

"Strategic risk is competitive risk: Is a competitor using the technology to win market share faster? Financial risk: AI isn't free, so understanding the total cost of ownership is critical," said Kelley. "Operational risk is where a lot of conversation needs to happen because there is this wonderful promise of AI being able to automate so much. But what if that automation goes wrong? And then there is, regulatory risk: The EU has set the pace…but there are regulations all around the globe that organizations need to consider."

Kelley said that communication between CISOs and executives will be key to effectively prioritizing resources dedicated to AI. That will, in turn, form the foundation for technical discussions relating to how AI can be protected and how to ensure it works as expected.

Security Will Be Built On Communication

Management of AI systems, and management with AI systems, will give rise to challenges. The technology promises to parse and provide information to improve decision making capabilities, but it will also inevitably enlarge the universe of possible actions. That will have implications for security.

"AI complicates things because decision trees become very wide; though they were always wide, we just didn't have a lot of the data," said Sudeep Kesh, Chief Innovation Officer, S&P Global Ratings. That complication could be harnessed intentionally and thoughtfully by organizations to make decisions that are more informed, quicker, and ultimately better. But complexity could also be exploited by threat actors to develop new attack vectors, said Kesh.

AI's potential to contribute positively to cyber security will be unlocked by effective communication with developers, data scientists, regulators, and organizations' decision makers. The panel agreed that engagement should start early, not least so that security is built into the design of AI software and systems. And they said that cyber experts will have to engage with AI's different actors on their terms.

"You have to start by understanding how these people operate, their UX (user experience)," said Richard Seiersen, Chief Risk Technology Officer Qualys. "If your vision as a vendor or as a security person is that I am going to pull them out of their tool chains and pipelines and make them think about security, then you have lost. You have to understand how they develop things."

For more information on AI, including plain-language guides to the technology and its implications for the sectors and organizations that we follow, please visit S&P Global's dedicated AI research website, here.

More information and links to S&P's past and upcoming AI-related events and webinars are also available on that site.

Related Research

• Language Modelling: The Fundamentals, Jan. 23, 2024.
• Can Generative AI Create A Productivity Boom, Jan. 10, 2024.
• Artificial Intelligence: What Are The Key Credit Risks And Opportunities Of AI, Dec. 4, 2023.
• CreditWeek: How Will AI Affect Credit Quality For Corporates?, Nov. 30, 2023.
• The AI Governance Challenge, Nov. 29, 2023.
• AI for Security, and Security for AI: Two Aspects of a Pivotal Intersection, Nov. 29, 2023.
• Gen AI Is Writing A New Credit Story For Tech Giants, Nov. 14, 2023.
• Future Of Banking: AI Will Be An Incremental Game Changer , Oct. 3, 2023.