What SOC-Tools miss at 2:13 pm: Gen ai Attack Chains Exploit Telemetry Lag-Part 1

It is 2:13 am on a Sunday and the worst nightmares of the SOC teams are about to get out.

Attackers on the other side of the planet launch a complete attack on the infrastructure of the company. Thanks to several non -patched endpoints that an update has not seen since 2022, they blew through his perimeter in less than a minute.

After Active Directory, attackers with the skills of a nation state team are to lock the entire network and at the same time create new privileges at admin level that will lock any attempt to close them. In the meantime, other members of the attack team unlock Legions of Bots that are designed to harvest gigabytes of customer, employee and financial data through an API that was never eliminated after the last major product release.

In the SOC, warnings start to relieve consoles such as the latest Grand Theft Auto on a Nintendo switch. SOC analysts are pinged on their mobile phones and try to sleep for a six-day week in which many have clocked for almost 70 hours.

The CISO is called around 2:35 am from the MDR provider of the company that says there is a large-scale infringement. “It’s not our dissatisfied accounting team, right? The man who tried an” office space “isn’t it again?” The Ciso asks half awake. The MDR team Lead says no, this is income from Asia, and it’s great.

CyberSecurity’s Coming Storm: Gen AI, Insider Threats and Rising Ciso Burnout

Generative AI creates a digital diaspora of techniques, technologies and TradeCraft that everyone, from rogue attackers to cyber armies that are trained in the art of Cyberwar. Insider threats also grow, accelerated by employment and growing inflation. All these challenges and more fall on the shoulders of the Ciso, and it is no wonder that has more to do with burnout.

AI’s meteorical rise for opponents and legitimate use is in the middle of all this. Getting the most important advantage of AI to improve cyber security and at the same time reduce the risk is what pushes boards from drivers to reach.

That is not an easy task, because AI security evolves very quickly. In Gartner’s newest DataView about security and risk managementThe analyst company has tackled how leaders respond to Gen AI. They thought that was 56% of organizations already implement Gen AI solutions 40% Significant gaps in their ability to manage AI risks effectively from security leaders.

Gen AI is used the most infrastructureTucture security, where 18% of companies are fully operational and 27% Nowadays actively implement Gen AI -based systems. Second is security operations, where 17% of companies are fully in use on Gen AI -based systems. Data security is the third most popular use case, with 15% From companies that use AI-based systems to protect cloud, hybrid and on-premise data storage systems and data lakes.

Insider threats require a first response

Gen AI nowadays completely re -ordered the internal threat of every company, so that insider is made Threats more autonomous, treacherous and CHallingen to identify. Shadow AI is the threat vector that had not thought CISO would exist five years ago, and now it is one of the most porous threat surfaces.

“I see this every week”, Vineet Arora, CTO at WinwireVenturebeat recently told. “Departments jump on non -sanctioned AI solutions because the immediate benefits are too tempting to ignore.” Arora quickly points out that employees are not deliberately malignant. “It is crucial for organizations to define strategies with robust security and at the same time enable employees to effectively use AI technologies,” explains Arora. “Total prohibitions often drive AI use underground, which only increases the risks.”

“We see 50 new AI apps a day, and we have already cataloged more than 12,000,” said Itamar Golan, CEO and co-founder of Fast securityDuring a recent interview with Venturebeat. “About 40% of this standard in training on all data you feed, which means that your intellectual property can become part of their models.”

Traditional rules -based detection models are no longer sufficient. Leading security teams shift to Gen-AI-driven behavioral analyzes that determine dynamic basic lines of employee activities that can identify deviations in real-time and contain risks and potential threats.

SellersIncluding fast security, Proofpoint Insider Threat Management, And Varonis, Quickly innovates with AI-driven detection engines of the next generation that correlate in real-time file, cloud, end point and identity stemetry. Microsoft Purview Insider Risk Management is also AI models of the next generation of embedding to identify autonomously risky behavior between hybrid workforce.

Conclusion – Part 1

SOC teams are in a race by time, especially if their systems are not integrated together and the more than 10,000 reports per day they generate do not synchronize. An attack from the other side of the planet at 2:13 am will be a challenge to comprehend legacy systems. Because opponents are ruthless in their refinement of TradeCraft with Gen AI, more companies have to get up and be smarter to get more value from their existing systems.

Push cyber security suppliers to deliver the maximum value of the systems that have already been installed in the SOC. Get integration well and should not turn seats on the SOC floor to check the integrity of the alert from one system to the next. Know that a burglary is not a false alarm. Attackers show a remarkable capacity to reinvent themselves immediately. It is time for more SOCs and the companies that trust them to do the same.