Protecting systems.
WHERE IT HELPS
Detecting anomalous behaviour in logs and traffic Prioritising alerts Summarising incidents Threat intelligence processing Phishing detection
THE ALERT PROBLEM
Security teams are overwhelmed by alerts, most of which are not incidents.
Reducing that volume is where AI adds most value.
WHAT TO BE CAREFUL WITH
Tuning that reduces alerts by learning from past dismissals, which teaches the system to miss what was previously missed.
FOR ANOMALY DETECTION
Effective where normal behaviour is stable.
Produces noise where it is not.
FOR PHISHING
Detection has improved. So has the quality of phishing, because attackers use the same tools.
Generated phishing no longer has the spelling errors people were trained to notice.
WHAT THIS MEANS FOR STAFF TRAINING
The old advice about poor grammar is obsolete.
Train people to verify requests by an independent channel instead.
WHAT MUST REMAIN HUMAN
Incident response decisions Determining whether to disclose Anything with legal consequence
