The results in practice are promising, as Gérard Bauer, Vice President for the EMEA region at Vectra, reports.

Why is artificial intelligence playing an increasingly important role in cyber security?
GérardBauer: AI is used in many areas of cyber security because it can process and analyze complex data at a scale and speed that exceeds human capabilities. This enables the automated detection of new, hidden threats and attacks. The threat landscape is rapidly diversifying and the attack surface is growing exponentially. At the same time, cyber security is suffering from a lack of personnel and resources. AI saves security teams valuable time to prevent attacks and fix problems before they develop into serious compliance breaches. AI does not replace humans, but enables them to work more efficiently to reduce and manage cyber risks.

The Vectra software dashboard allows cybersecurity experts to keep track of attacks. Artificial intelligence helps with detection.

© Vectra

What specific solutions do you offer?
We have developed a comprehensive suite of detection algorithms based on supervised and unsupervised learning as well as deep learning. They are optimized to identify a specific type of attacker behaviour throughout the lifecycle of an active attack: Command and Control*), Reconnaissance, Privilege Escalation & Cross Movement, and Data Manipulation & Exfiltration.

Each of these behaviors or phases provides multiple opportunities to detect the hidden attacker at work. The algorithms then assess the incidents according to risk and security relevance. In addition, the AI correlates the behavior over time back to the affected hosts. This makes it possible for security analysts to quickly, easily and in real time identify those hosts that require immediate attention. A final layer of AI correlates which hosts are involved in the overall attack campaign, providing a complete picture of the attack across the entire organization.

What are the benefits of this?
In live operation with customers, we have seen a 32-fold reduction in analysis time. When security analysts respond quickly and effectively, they can stop attacks before they become business-critical.

What about acceptance? Do users trust AI tools?
With AI software constantly adapting itself, it is difficult to understand how a result is ultimately achieved. It is therefore important that users have a certain level of basic knowledge.

And when it comes to purchasing a specific tool?
Here it is advisable to ask the AI manufacturers some insightful questions about their tools in advance. For example, which and how many machine learning algorithms a product uses and how these are categorized and updated. How long does it take for the recognition software to be ready for use? How many algorithms are needed for a learning phase and how long does it take? How are the algorithms trained, what is the source and origin of the training data?

In addition, a live evaluation on site can prove the effectiveness of the software. Knowledge and practical experience form a solid basis for building trust in an AI tool.

What are typical applications for such tools in the production environment?
There are a number of applications related to the use of AI to automate threat detection and response. For example, such AI tools can detect active but unknown and hidden threats within the corporate network that bypass security controls and defenses. To date, this has often been a blind spot. Another field of application is the detection of threats in the cloud and in the data center. This is because virtualization and the cloud present unique security challenges, including a high percentage of communications that are invisible to traditional security controls.

Ultimately, it's also about reducing the burden on the security team, which has to deal with a flood of alerts. Automation using AI has been proven to significantly increase the efficiency and effectiveness of security operations.

Can you give us a specific application example?
The Vetropack Group, a manufacturer of glass packaging, has chosen the AI platform 'Vectra Cognito' to protect its key assets and optimize security operations. The company realized that network perimeter security measures alone would not be able to cope with today's cyber threats. To quickly detect and stop cyber attackers before they damage or steal critical assets, visibility into the network was needed.

Today, the AI-based cyber security platform provides Vetropack with seamless, automated threat hunting and attacker detection in real time, supported by AI and continuously learning behavior models. The intelligent technology automatically prioritizes the highest-risk threats in the company-wide network, which spans offices, production sites and distribution centers in several European countries. This enables Vetropack to quickly and proactively stop cyber threats.