‘They don’t understand hackers’: Cybersecurity pros explain why everyone panicking about AI-powered hacks is wrong
As head of counter-adversary operations at CrowdStrike , Adam Meyers has a front-row seat to the threats facing companies. Yet even for him, a recent trip to South Korea was out of the ordinary. As he was preparing to sleep on the flight from the United States, Meyers received a message from colleagues informing him that six Korean banks had been hacked and that he would likely face questions…
Adam Meyers, head of CrowdStrike's counter-adversary operations, recently returned from South Korea where six banks were hacked. His team swiftly identified and recovered data from the attack, which was committed using AI tools Artex and various large language models. Meyers argues that the current panic over AI-powered hacks is misplaced, stating that "it's just speed and volume."
The AI hasn't discovered new exploit paths or vulnerability classes; it's simply utilizing existing methods more rapidly and in greater volume. However, this rapid advancement has caused significant alarm within the cybersecurity industry. Ciaran Martin, former head of the UK's National Cyber Security Centre, insists that these discussions have become detached from the realities of cybercrime, as companies have focused on the theoretical potential of AI without considering the motivations and constraints of actual attackers.
Eerke Boiten, a cybersecurity professor, points out that while AI accelerates vulnerability discovery, the ability to exploit them lags behind. The cybersecurity industry has become overly reliant on the Common Vulnerability Scoring System (CVSS) to assess risks, but Meyers argues that severity scores shouldn't be the sole determinant for response.
Instead, organizations should focus on vulnerabilities that are actively exploited. Boiten remains optimistic, believing that collaboration in vulnerability identification could eventually lead to AI-assisted coding that reduces the number of introduced flaws. However, he cautions that humans remain the most significant vulnerability in cybersecurity.
Written by urgent.news from Fast Company's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
