How AI is Changing Cybersecurity

Vivian Schiller (left) and Heather Adkins (right) at the 15th Annual Aspen Security Forum in Colorado.

At the recent Aspen Security Forum, the Google Public Policy team sat down with our VP & Executive Director, Vivian Schiller, and Heather Adkins, founding member of the Google Security Team and VP of Security Engineering at Google. They discussed how the safe and responsible use of AI can change the cybersecurity landscape for the better.

Q&A with Vivian and Heather

2024 has been another big year for AI. As it becomes more widely accessible, how do you see AI changing the cybersecurity landscape?

VS: We think about the intersection of AI and cybersecurity as two sides of the same coin. On the one side, there’s the cybersecurity of AI-enabled products. How do we keep them secure? On the flip side, there’s both the opportunities and risks that AI brings to the cybersecurity landscape. These are cross cutting issues. The work that private industry, civil society and governments take on now will determine who benefits more – attackers or defenders.

HA: Large language models (LLMs) are poised to revolutionize the cybersecurity landscape. Their ability to process massive datasets at scale opens new avenues for defenders, such as identifying code vulnerabilities, analyzing complex telemetry data, and streamlining operations. This proactive approach will significantly reduce attack opportunities and give defenders a much-needed advantage. However, it’s crucial to acknowledge that these same capabilities will also be available to attackers. As the technology advances, we must remain vigilant and closely monitor the potential development of automated attack platforms.

In the face of growing cyber threats, how can AI be used to increase the cyber defenses of the world’s democracies?

VS: We’ve examined this question at both the micro and macro level. You need to tackle both to defend democratic societies and their institutions.

At the micro level, organizations must stay true to cybersecurity principles and not be swept up in the hype of deploying AI without good reason. AI can never be a complete substitute for human thinking and human judgment. Having a human in the loop – ALWAYS – is a core principle. We examine these questions in two papers: Navigating Uncharted Waters: Generative AI Guidance for Organizations and Envisioning Cyber Futures with AI, which we developed based on insights from our Aspen US and Global Cybersecurity Groups. In short, organizations must provide clear guidance for their employees about AI usage and set out a clear governance structure for how data will be used by any AI models.

At the macro – or societal – level, our AI and Democracy work examines how expanding AI capabilities make it easier for bad actors to mislead citizens and the steps we can take to neutralize targeted local voter suppression, language-based influence operations, and deepfakes.

HA: Our AI Cyber Defense Initiative outlines how AI can be used to tip the security scales in favor of the professionals tasked with protecting our infrastructure and the critical software we depend upon every day. AI can help today’s defenders in scaling their work in threat detection, malware analysis, vulnerability detection, vulnerability fixing and incident response. We also outline a proposed policy and technology agenda that can help to secure AI, encourage a balanced regulatory approach to AI usage and adoption, and advance research.

Shared Futures: The A.I. Forum

Aspen Digital