In the modern threat landscape, AI isn’t just a tool. It is a battleground. It continues to transform the landscape of information security. It now plays a critical role not only in enhancing detection, response, and resilience, but also in enabling sophisticated, scalable, and evasive cyber-attacks. AI is not a monolithic tool; it encompasses a range of computational models and techniques, each with unique capabilities, limitations, and suitable applications.
This section provides a comprehensive overview of how AI is used in cybersecurity, categorized by technical approach, and mapped to its impact across the threat lifecycle from reconnaissance to recovery. It also explores practical risks and the shift from conventional to bespoke threat models in the age of AI.
Categories of AI in Cybersecurity #
Understanding the taxonomy of AI technologies is foundational to their effective application in cybersecurity strategies.
Supervised Machine Learning (SML) #
Definition: SML is trained on labeled datasets to classify or predict outcomes. It recognizes patterns similar to those it has seen before.
- Use Cases:
- Signature-based malware and phishing detection
- Alert prioritization in SIEM/XDR platforms
- Automated triage
- Strengths: Highly accurate for known threats
- Limitations: Ineffective against unknown, zero-day, or polymorphic attacks
Unsupervised Machine Learning (UML) #
Definition: UML analyzes unlabeled data to detect patterns and anomalies. It builds behavioral baselines without needing prior knowledge.
- Use Cases:
- Insider threat detection
- Zero-day attack identification
- Anomalous lateral movement
- Strengths: Effective in identifying novel or subtle deviations
- Limitations: High false positives without domain tuning
Generative AI and Large Language Models (LLMs) #
Definition: LLMs are deep learning models trained on large corpora to generate coherent human-like text and interactions.
- Use Cases:
- Spear-phishing simulation and prevention
- Threat report summarization
- Query-based threat intelligence search
- Social engineering emulation
- Strengths: Scalable human-like communication and contextual reasoning
- Limitations: Prompt injection vulnerabilities, hallucinations, bias, data privacy concerns
Self-Learning AI #
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
