Almost every other article about cybersecurity is on one of two things – AI or skilling, to meet the 3.5 million-person cyber skills gap to counter the booming cyber crime industry.
Apologies in advance – this article is about both. However, rather than focusing on how to bring more cybersecurity specialists into the sector, the big opportunity here is to talk about how AI can better support the ones we have.
Cybersecurity is unfortunately known as a profession with a high degree of burnout – professionals are essentially soldiers on the frontlines, defending against a constant, growing and invisible threat. Meanwhile, in the initial years it can also be a lot of repetitive data sifting and frankly, lacking in wow. Both can spell high rates of attrition, when the need for cyber professionals is greater than ever. The challenge is to use the latest tools at our disposal, such as AI, to make the whole industry “stickier”, to support and encourage more people to remain, while creating more excitement about what a role in cybersecurity has to offer at all levels.
This was a major topic of conversation on our recent Cyber Innovation Tour at Microsoft’s headquarters in Redmond. More than 30 CISOs and CTOs from major private and public sector organisations across ANZ joined us to learn the latest in cyber security and share ideas on how to tackle the ever-changing challenges in cyber security. The focus was on understanding how the latest developments in AI could not only help early-in-career cyber talent, but enhance senior capabilities and make adding value to the organisation easier.
The recent Microsoft Work Trend Index revealed 72 per cent of workers across the Asia Pacific region don’t have enough time and energy to get their work done, meaning they struggled with being innovative. In Australia and New Zealand specifically, 60 percent of employees and 64 per cent of managers reported feeling burnt out – that’s significantly higher than the global average at 48 per cent.
There is however optimism towards AI and the potential for it to take away some of that burden, with 78 per cent of workers across ANZ seeing the benefits that AI offers. That naturally meant Microsoft Security Co-pilot has been a big talking point among CISOs. For the first time, a security program doesn’t just do what you tell it to do – it tells you what you need to think about next, including things that may be beyond your specific skillset, acting as a co-pilot on developing security strategies, prioritising cyber events, scanning for threats and plugging vulnerabilities.
What many haven’t realised is the impact that this kind of AI-led automation can have on the type of work an early-career security analyst will be able to do. It enables them to sift through the noise faster and more effectively, so they can put their efforts towards the higher priority threats. The CISOs from the tour saw the potential in being able to delegate the critical but often mundane tasks to AI and enable these early in career professionals to get that much further, without needing to hand off to a senior person. That makes the role so much more meaningful from day one, while also giving confidence and making learning on the job easier.
At a more senior level, AI can also dramatically help ease the pressure by cutting the time it takes to triage threats. Microsoft’s data shows it takes 70 minutes from a cyber attacker getting into a company’s systems for them to access critical data. In this kind of situation, every minute counts – but these minutes are typically eaten up trying to locate the threat, leaving a fast-shrinking window of time in which to stop the attacker reaching their target. As the old adage goes, an ounce of prevention is worth a pound of cure. If AI can speed up the detection process, taking it from 15 minutes to five, that gives defenders a lot more time to act and minimise any impacts.
For example, AI can recognise trends in milliseconds, being able to spot where behaviour is out of the norm, like “impossible travel”, where it alerts if someone logs in from China when the last login was in New South Wales. For now, attackers don’t have access to internal organisational data to help them understand how the organisation and its people use technology. Nor do they have the essential compute power of the big organisations like Microsoft to leverage AI to the same extent – although it’s only a matter of time until this changes. We’re at a pivotal moment in cybersecurity, where for the first time, defenders are on the front foot.
All this paves the way for CISOs and CTOs to take an even more strategic role, freeing them to focus more on innovation, education and upskilling others (particularly at middle management level), changing mindsets and behaviours around security and preventing breaches before they occur.
Of course, AI isn’t a silver bullet. As some of the Cyber Tour delegates observed, it’s also key for businesses to look at what pathways they have in their organisation, to ensure that they’re providing opportunities for progression. Also, with human psychology just as important as tech skills in today’s criminal enterprises, it’s vital that cyber professionals also reflect the whole of our diverse society, even more than in other tech roles. Sharing different ways of thinking and embracing different cultures not only makes for much richer workplace experiences – it also creates a stronger defence.
Customers like pizza brand Domino’s have also come up with creative ideas others can learn from, like running “Nerd Days” each month. This gives team members a chance to step away from their day to day roles to focus on a business problem they wouldn’t normally get the time to work on. They say breaking the routine is a great way to bond, get re-energised and approach things with a fresh mindset. But Domino’s is also leveraging AI and automation – and they’re reporting a huge impact on staff retention and wellbeing as a result.
Perhaps the coolest thing is how Domino’s is gamifying efforts to reduce workloads through automation. Domino’s uses story points to track things like how many calls individuals have stopped because of automation. They even have leaderboards, challenging teams to think about how they can automate solutions to different challenges, while using ChatGPT to help junior staff break down the tasks they need to do to solve an issue. They’re now reporting a saving of 180 hours a month from automation, and reducing calls over the weekend from more than 60 to 12. All of that is a fantastic help when it comes to driving greater job fulfilment, reducing burnout and attrition.
While cybersecurity careers will always be fast-paced and high-stakes the powerful combination of AI and diverse human experience has the potential to make jobs at every stage not only easier, but also more fulfilling. If we can plug that cyber skills gap through better retention and support for existing workers as well as new hires, that’s a huge boost for organisations everywhere.