open share links
close share links
What you’ll learn:
AI has transformed cyberthreats: 80% of ransomware attacks examined in new MIT research used artificial intelligence, from deepfakes to AI-generated phishing campaigns.Three pillars for AI defense: Effective defense combines automated security hygiene, autonomous defensive systems, and augmented executive oversight with real-time intelligence.+++
New research from Cybersecurity at MIT Sloan and Safe Security examined 2,800 ransomware attacks and found that 80% of them were powered by artificial intelligence. AI is being used to create malware, phishing campaigns, and deepfake-driven social engineering, such as fake customer service calls. Large language models are being employed to generate code and phishing content. There is also AI-enabled password cracking, CAPTCHA bypass, and more.
Perhaps you’re thinking that the answer is to fight fire with fire by building AI-powered defenses. But that’s only part of what’s needed, according to the researchers.
“AI-powered cybersecurity tools alone will not suffice,” they write. “A proactive, multi-layered approach — integrating human oversight, governance frameworks, AI-driven threat simulations, and real-time intelligence sharing — is critical.”
The 3 AI defense pillars every organization needs
The researchers argue that a comprehensive approach to combating AI-enabled threats consists of three types of defense, all of which are essential:
Automated security hygiene, such as self-healing software code, self-patching systems, continuous attack surface management, zero-trust-based architecture, and self-driving trustworthy networks. Automating these routine tasks reduces manual workloads while strengthening protection against attacks that target core system vulnerabilities.Autonomous and deceptive defense systems, which use analytics, machine learning, and real-time data collection to learn from, identify, and counteract threats. Examples include simultaneously automated moving-target defense, and deceptive tactics and information. Both types of systems enable teams to take a proactive approach to defense, rather than getting stuck in reactive mode.Augmented oversight and reporting, which give executives real-time data-driven insights. For example, automated risk analysis uses AI to spot emerging threats and predict how they might impact an organization.What this means for cybersecurity today
Cybersecurity professionals should look at the history of successful cyberdefenses — protections against phishing, social engineering, and malware attacks, for example — and consider how familiar forms of attack could evolve with the addition of AI.
At the MIT Computer Science and Artificial Intelligence Laboratory, for example, researchers have developed a method of defense called artificial adversarial intelligence, which mimics attackers to test network defenses before real attacks happen.
“The autonomous nature of things has caused there to be a reexamination of the way in which we defend ourselves and the way in which we have to look at both old- and new-style attacks,” said Michael Siegel, the principal research scientist and director at CAMS, and an author of the report.
But it’s yet to be seen how the eternal game of whack-a-mole for security teams will change with AI both deployed regularly in attacks and employed in defense.
“Can we crack the asymmetric warfare nature of cybersecurity?” Siegel asked. “Remember that the attacker only needs one point of entry and exploitation while the defender must stop all entry points and be resilient to all exploitations.
“For cybersecurity, there are tremendous opportunities for things to go wrong,” he said. “Protecting in this new environment that is moving at light speed is challenging, but we can learn from our previous work. Many researchers and products are already addressing management, prevention, detection, response, and resilience issues.”
One example of that work: Siegel and colleagues from MIT Sloan are investigating the role generative AI is playing in both attacks on and the defense of industrial control systems.
Read the full report
The research, “Rethinking the Cybersecurity Arms Race,” was conducted by Siegel; Sander Zeijlemaker, a CAMS research affiliate; Vidit Baxi, co-founder and chief information security officer at Safe Security; and Sharavanan Raajah, a threat researcher at Safe Security.
The report provides more details on preparing a practical and comprehensive response to AI-powered cyberattacks. It also details emerging attack methods and includes a list of the top 10 AI-generated ransomware threat actors.
Learn more about Cybersecurity at MIT Sloan, including membership opportunities.
Michael Siegel is a principal research scientist at MIT Sloan. His primary research interest lies in cybersecurity management of information systems. He is the founding co-director of Cybersecurity at MIT Sloan.