As AI becomes an increasingly important part of our everyday lives, the role it plays in cybersecurity for both attackers and defenders is coming under rising scrutiny.
Microsoft recently released its Digital Defense Report (DDR) highlighting the role that AI is playing in crafting new and more devious cyberattacks, with businesses being hit with more threats than ever before.
But Microsoft is also using its own AI tools such a Copilot to help support its digital crimes unit, showing that the attackers won’t have all the advantages.
At the recent Microsoft Frontier Tour London event, I spoke to Dr Jon Davies, Chief Security Adviser, Microsoft UK, to find out more.
AI threats are here
“Frontier AI is transforming the threat landscape,” Davies tells me. “Right now, AI threats are real, it’s not an urban myth, or something we’re going to see in 2030.”
The DDR found that as AI becomes more widely available, the barrier of entry into cybercrime is being lowered, allowing hackers to launch a record number of campaigns against consumers and businesses alike.
The UK was particularly affected, becoming the most targeted country for nation-state and geopolitical cyber activity in Europe, facing 76 observed events in the past year, and ranking fifth in the world for countries where customers are most frequently impacted by cyber threats.
Davies notes that the AI threat has been building for a while, as attackers turn to automation to carry out more advanced attacks – with so-called “swarm attacks” becoming particularly more common as attackers get agents to do their dirty work
“We’re getting to the point where the technology, compute, and storage is catching up with the ambition of the attacker,” he says, pointing out that defenders are embracing AI too.
“We’ve been solving one problem at a time as (threats) have evolved,” he adds, “the opportunity with agentic AI is to elevate the human up into the orchestration.”
But despite all the AI intelligence being funneled into creating new and more complicated attacks, more “basic” forms of scam like phishing are still proving incredibly effective, showing that the human will always remain the weakest link when it comes to cybersecurity.
The DDR found phishing attacks jumped globally from 7% to 23% of incident-response intrusions year-over-year, with attacks using fake meeting invites and calendar markers among the scams on the rise, and Davies highlights how criminals are taking information gathering on specific C-suite individuals to a new high in order to get them to click on a link.
“An attacker has no ethical line,” he points out, “phishing…is still the front door for any organization…(and) I don’t think it’s going to go away – with AI on its side, it’s only going to get more real and harder to detect.”
So where does the responsibility lie when it comes to awareness? Davies says it should be a combination of individual and collective culpability – which means those annoying phishing tests your employer sends you are probably here to stay.
“The whole point of those training exercises is to help educate us, show us what the attackers are doing…I don’t think we should be embarrassed if we’ve clicked a link in one of those exercises, as the point is to educate and train.”
“It’s everyone’s responsibility to put a seat belt on, you are accountable to it, and regardless of who you are in your personal life, you are responsible for cybersecurity. We’re at that step change now where it’s not just the cybersecurity teams responsible for security – it is everyone within the organization.”
Davies notes that “security can be the seatbelt for AI transformation,” likening it to the introduction of the seatbelt in cars – as although they worked from day one, it still took some time to catch on.
“Security is the same way for enterprises – we can buckle up,” he adds, noting that the seatbelt doesn’t slow the car down, and eventually the change happened, making seatbelts (and safety overall) a key reason why we might buy a specific car.
So with the huge amount of threats facing cybersecurity defenders on a daily basis, how can security professionals stay positive?
“It’s really tough,” Davies says, “the threat landscape is evolving extremely, extremely fast at the moment. It has to be embedded from top to bottom – from the board level downwards through the C-suite and down to the employees – but it also then needs to be trained up from frontline staff.”
He adds that given the number of widespread cybersecurity stories hitting the headlines these days, more and more C-suite executives are becoming aware of the need to stay protected – and challenging their CISO about what they plan to do about it, and how they can recover if the worst happens.
“We’re having these conversations quite regularly,” he says, “as a member of the security profession, we’ve asked for a seat at the table for a number of years – and we’ve finally got that.”
Davies points out that the DDR isn’t just a commercial or PR exercise – it is Microsoft’s view from the front lines of the battle against the latest cybersecurity threats.
“We’ve got skin in the game,” he says, “there is no other organization on the planet that can do this at that level, it’s giving back what we’re able to share to help organizations measure their risk and threat.”
“The physics of cyber are changing,” he concludes, “we’ve got variables that we can change – but they (attackers) also have variables they can change on their side…it’s a scary place out there…the world that we’re living in right now is very dynamic.”
