Security Teams Save Time on Tasks but Spend More Time Checking AI’s Work
In an era where artificial intelligence (AI) and machine learning are increasingly integrated into cybersecurity, new research from ISC2 reveals a paradoxical trend: rather than alleviating the workload of cybersecurity professionals, AI is compelling them to spend more time validating its outputs. This presents a new set of challenges for the industry as professionals grapple with the intricacies of trusting AI-generated recommendations.
Research Findings on AI’s Impact
The findings, drawn from a survey of 856 cybersecurity professionals conducted in May, shed light on the profound impact AI has had on the field. The research indicates that while organizations are automating various tasks—like triage, log analysis, reporting, and vulnerability prioritization—this shift has not necessarily resulted in a reduction in overall workloads. Nearly two-thirds of the surveyed professionals reported spending more time deliberating whether to trust or act upon AI recommendations. Importantly, a significant 63% stated they now dedicate additional resources to validating or reviewing the outputs generated by AI technologies.
Compounding the issue, the high stakes of cybersecurity make these deliberations particularly pressing. A staggering 89% of those surveyed acknowledged having encountered instances where an AI recommendation led to an inaccurate outcome. This underscores a troubling reality: when errors occur, 50% of respondents indicated that the responsibility falls on the human decision-maker, further complicating the accountability landscape in cybersecurity teams.
Scott Beale, the CEO of ISC2, highlighted the dire implications of this dynamic. "Often, AI isn’t right, and when it’s wrong, about half the time our members find that humans are held responsible," he explained. This situation creates a double-edged sword; while AI can make processes quicker and more efficient, it also heightens the burden of human oversight.
A Burden on Employees
The increased scrutiny over AI outputs has led to heightened stress levels among cybersecurity professionals. Nearly 50% of respondents noted that their use of AI has lessened work-related stress over the past year. Yet, paradoxically, 32% reported an increase in stress levels. Among those feeling additional stress, 76% cited that they were spending more time deliberating over which AI recommendations to trust, while 74% indicated they were dedicating more effort to reviewing AI outputs.
The disparity in stress levels suggests that while AI can streamline some tasks, the reliability and transparency of its operations are still in question. Beale expressed concern about this imbalance, suggesting that defenders in the cybersecurity realm are not receiving sufficient support to leverage AI effectively. "The challenge is that the defenders aren’t getting the support that they need to fully understand and leverage it in a way that’s effective," he noted.
The Evolution of Entry-Level Cybersecurity Roles
Contrary to assumptions about diminishing job opportunities due to AI integration, the study indicates that demand for cybersecurity roles remains robust. The entry-level landscape is evolving rather than disappearing. In fact, although 56% of respondents reported a reduction in the need for junior positions over the past year, 53% believe that AI is simultaneously creating new entry-level opportunities.
Interestingly, while 48% expressed optimism regarding long-term career prospects in cybersecurity, perspectives on hands-on learning opportunities are varied. A slight majority—62%—assert that AI has not diminished the necessity for foundational skills in cybersecurity. Organizations may need to adapt their training methodologies to bridge the gap created by automation, emphasizing the importance of simulations, supervised investigations, and mentoring.
Beale remarked on the future trajectory of cybersecurity professionals, noting, "As people enter cybersecurity, they’ll be filling different roles, but they’re going to have to learn how to do cybersecurity with AI." He underscored the need for newcomers to be well-versed in the technologies that are becoming commonplace, including cloud systems.
Conclusion
As artificial intelligence continues to transform the cybersecurity landscape, organizations must navigate the complexities of integrating this technology into their operations. The ISC2 research indicates that while AI offers a pathway to enhance efficiency, it simultaneously introduces a burden of accountability that could impact the well-being of cybersecurity professionals. As organizations leverage the power of AI, they must also invest in training and support systems that empower teams to validate AI outputs effectively. In doing so, they can foster a more secure cyber environment while mitigating the risks associated with this evolving technology.