Diversity Is Key To Combating Gen-AI Hackers

This year, a Hong Kong business fell victim to a sophisticated cyber attack, losing $25 million after an employee was deceived by a deepfake video call impersonating their CFO. This incident highlights just how much generative AI (genAI) is changing the complexity of cyber attacks. 

While not all threats reach this level of sophistication, the Brirish  National Cyber Security Centre warns that AI is increasingly being used by a range of threat actors including state or non-state, highly skilled or even less experienced.

The adoption of AI in cyber attacks is reshaping the threat landscape, making vigilance and innovation in defence more critical than ever. 

Balancing Threats & Opportunities 

GenAI is creating a dynamic and challenging threat landscape for cyber teams. Issues such as misinformation and deep fakes are becoming more common, complicating efforts to protect organisations. As genAI tools become more widely integrated into workplaces, data protection has emerged as a critical concern, particularly for organisations using open-source AI tools. These developments demand more robust strategies to mitigate risks effectively. 

However, it’s not just the criminals using genAI to their advantage. Cyber leaders are harnessing the technology to identify weaknesses in their attack surfaces and to improve their detection and triaging of attacks and malicious campaigns. 

They’re also getting on the front foot by establishing clear policies on the appropriate uses of AI in the workplace and prioritising training in AI literacy and safety for employees so security risks can be avoided. This can include the workforce not falling foul to voice clones or using insecure third-party chatbots that may give attackers unauthorised access to networks. 

The Importance Of The Makeup Of A Cyber Team 

Adapting technologies and policies to address the emerging threat landscape shaped by the rise of genAI is crucial. But this alone will not be enough to battle AI-armed hackers. Just as important is the makeup of a cyber team itself. Why? While the AI threat may be digital, its driver is human. That means you need people who can get into the minds of hackers. To understand them. And, to outthink them. 

Diversity is key to this. Teams must be formed of people from different backgrounds and who have different experiences and skill sets, so they approach AI threats in innovative ways. This will enable teams to avoid blind spots by bringing together different perspectives and critical thinking to tackle new challenges with creativity and ingenuity. 

The Issue With Traditional Hiring Routes 

If you work in cyber, though, you’ll already know that many teams aren’t diverse. Sometimes this is down to the broader issue of the UK skills gap, given 30% of cyber firms in the UK say they have faced a problem with a technical skills gap. We also know that a catalyst for this skills gap is a grassroots issue that inhibits more diverse representation into this traditionally white male-dominated career path.  

It is also a hiring issue. When a cyber role is advertised, you’ll see heavy emphasis placed on the candidate having completed a relevant degree and even for an entry-level position, having some level of industry experience (sometimes three years!). 

Continuing in this vein means that hiring managers risk narrowing the talent pool and continuing to hire the same ‘cookie cutter’ version of what they think is an ideal cyber security employee. The homogeneity of a traditional cyber team, made up mostly of white, middle-class men can jeopardise an organisation’s security.

With a host of similar worldviews, these teams may lack the diversity of skills and ideas to tackle rising genAI threats and get into the minds of hackers.   

The Industry’s Need For Impact Skills 

The hiring process is a place where a lot of this progressive change can happen. Ensuring hiring managers are prioritising skills and experience over qualifications can help encourage career changers and those from non-traditional cyber routes into the industry. By prioritising these types of candidates, cyber leaders can bring unique insights into how cyber threats impact different business areas. 

Organisations are often well-versed in placing experienced hires, graduates or apprentices. However, they often lack a defined path for experienced professionals with new cyber skills. For example, project managers transitioning to cyber project managers often don’t fit into predefined hiring categories.

By opening these paths, organisations can leverage the experience of individuals who can apply their knowledge to cyber-specific challenges.

This approach also means the hiring focus does not solely focus on individuals with advanced technical skills, aligning with the outdated perception that only individuals equipped with this will succeed. In reality, those skills are often the easiest to teach and continuous technical training is needed, regardless, because of the new threats emerging thanks to genAI and other technologies. What the industry needs is impact skills, which range from creativity and problem-solving to critical thinking, which aid teams to get into the minds of the hackers using genAI. 

Breaking Down Barriers 

Addressing the risks posed by genAI in cyber security demands removing barriers to professional education and expanding access to the field. The UK’s cyber security workforce faces a critical skills shortage, limiting its ability to identify and mitigate threats effectively. To close this gap, hiring practices should prioritise candidates with diverse skills and non-traditional backgrounds, broadening the talent pool. 

By assembling teams with diverse perspectives and expertise, organisations can not only mitigate AI-related cyber risks but also innovate and gain a competitive edge in the digital age.

Dr. Andrea Cullen is CEO &  Co-Founder of CAPSLOCK

Image: Ideogram

You Might Also Read: 

One Third Of Cyber Criminals Are Women:  


If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

 

« British Spy Agency Opens A New Cyber Centre
The Corporate CISO Role Is Evolving  »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

EC-Council

EC-Council

EC-Council is a member-based organization that certifies individuals in various e-business and information security skills.

AirCUVE

AirCUVE

AirCUVE provide authentication and access control solutions for networks and mobile security.

Niksun

Niksun

Niksun's forensics-based cyber security and network performance monitoring products provide customers with actionable insight into security threats, performance issues, and compliance risks.

Custodio Technologies

Custodio Technologies

Custodio Technologies was established as a Singaporean R&D Centre of Israel Aerospace Industries (IAI) in order to spearhead R&D activities in the field of cyber early warning.

Avira

Avira

Avira provide a portfolio of antivirus, security and performance applications for Windows, Android, Mac, and iOS.

Calian Group

Calian Group

Calian is a diverse Canadian company offering professional services in areas including Advanced Technologies, Health, Learning and IT & Cyber Solutions.

miniOrange

miniOrange

miniOrange is a cloud and on-premise based identity and access management (IAM) solution provider.

Black Hills Information Security (BHIS)

Black Hills Information Security (BHIS)

Black Hills Information Security provide security testing and vulnerability assessment services.

Qasky

Qasky

Anhui Qasky Quantum Technology Co. Ltd. (Qasky) is a new high-tech enterprise engaged in quantum information technology industrialization in China.

Conversant Group

Conversant Group

Conversant Group is an IT infrastructure and security consulting company, providing technical, organizational, procedural, and process consulting internationally.

Surfshark

Surfshark

Surfshark is a cybersecurity company focused on developing humanized privacy & security protection solutions to secure people's digital lives.

RADICL

RADICL

RADICL's mission is to give SMBs that serve America's Defense Industrial Base (DIB) access to strong, enterprise-grade cyber security protection.

Vultara

Vultara

Vultara provides web-based product security risk management tools for electronics manufacturers.

One Step Secure IT

One Step Secure IT

One Step provide Managed IT Services, Cybersecurity Protections, and Compliance to businesses in the USA nationwide.

tmc3

tmc3

tmc3 is an award-winning, people-centric consultancy that is transforming cyber security from an overhead into an organisational enabler.

Spektion

Spektion

Spektion are transforming how organizations meet the challenge of third-party software risk.