Move fast and break (into) things

The recent rise in reports of AI related cyber events has had me thinking about what the not-too-distant future might look like.

Cybercrime-as-a-Service (CaaS) is nothing new. The ability to purchase a zero day, rent a botnet or outsource an attack, allowing an attacker without deep technical knowledge to make a significant impact, has existed for some time.

Recent advancements introduce the potential for new challenges:

1. The speed at which everything is happening. The time between discovery and exploitation is ever reducing.

2. Increasingly autonomous and adaptive attacks. Tools capable of modifying their own code, payloads, delivery method, identifiable features and behaviour.

If the pace of vulnerability discovery and exploitation continues to accelerate, how can defenders expect to keep up? Particularly when identifying a vulnerability is often considerably easier than fixing it.

Technology environments are complex, resources are often limited, and remediation isn’t always as simple as a patch or an upgrade. Even with increasingly capable tools, there’s only so much that can be done.

With less time to react and the potential for attacks to become harder to detect, it’s difficult not to look at this as a troubling picture for the future.

For perspective on some of these points, Google have recently published some research exploring this in much more detail, including some interesting data on the rise in vulnerability disclosures, exploitation and AI-assisted discovery of consequential vulnerabilities.