Artificial intelligence is being explored as a tool by corporate cybersecurity experts and cybercriminals. 

Cybercriminals are actively using AI “in a whole bunch of ways” and it is being used in companies “partially because this is the only way to keep up with the velocity of the changes that the bad guys are throwing at us,” said Alan Brill, Secaucus, New Jersey-based senior managing director and founder of Kroll Cyber Risk, a division of Kroll LLC. 

“If you’re standing still, you’re falling behind,” he said. 

For criminals, finding a cyber vulnerability is manually intensive, said Andreas Kuehlmann, CEO and executive chair of San Jose, California-based cybersecurity company Cycuity Inc. AI will give them another tool that will increase their productivity, he said. 

The technology can also be used to eliminate the revealing mistakes that non-native English-speaking criminals sometimes make in phishing attempts. It turns out AI “is really good at it,” said John Dwyer, Pittsburgh-based head of research at IBM Security X-Force. 

Meanwhile, “a lot of companies are implementing AI and putting in new processes without a full understanding of what they’re doing,” said Jeffrey Wheatman, cyber risk expert and evangelist with Boston-based Black Kite Inc. 

He referred to a reported instance in which a company official uploaded internal financial data into Chat GPT to help with a financial analysis, unaware it could have been accessed. 

But some experts say AI does not yet represent a significant threat to companies. 

The concern is “a little overblown” at this point, said Daniel Blackford, Pittsburgh-based senior manager, threat research, at Proofpoint Inc. 

AI is a two-edged sword that will also benefit companies by helping them improve their cybersecurity, experts say. 

“It’s going to be an important tool,” enabling companies to identify threats as they appear and quickly assess them, said Michael Driscoll, New York-based senior managing director at FTI Consulting Inc., who is a former assistant FBI director. 

Cybersecurity teams are trying to use the technology to improve cyber defense and response with automated detection and prioritization of cyber threats, and AI is one of the more popular ways to do so, said Joe Nocera, Chicago-based partner leader, cyber risk and regulatory marketing, for PricewaterhouseCoopers International Ltd. 

Companies are still experimenting with AI, but a year from now they will have developed a “clear set of practices” outlining how to leverage it, he said.