Cybersecurity has long been a field where machine learning works quietly in the background. Well before chatbots, spam filters and antivirus software used statistical models to recognise what was suspicious. Today artificial intelligence, language models included, gives those who defend networks and systems new tools, above all for tackling the sector's biggest problem: too much data and too few analysts.
The underlying problem: volume
Even a mid-sized organisation generates millions of events every day: logins, network connections, processes started, emails received. Almost all of them are normal. Finding the few events that point to a real problem is like looking for a needle in a haystack, and human analysts risk alert fatigue: receiving hundreds of alerts, most of them false positives, they end up ignoring the important ones too.
This is exactly where AI helps: it does not replace the analyst, but filters, ranks and enriches information so that human attention goes where it is needed.
Main defensive applications
Anomaly detection
A model learns what "normal" behaviour looks like for a user, a server or a network, and flags deviations. Typical examples:
- an account that usually logs in during office hours suddenly downloading large quantities of files at three in the morning;
- a server starting to communicate with addresses it has never contacted before;
- an unusual number of failed login attempts followed by a successful one.
The advantage over fixed rules is that the model adapts to each context. The drawback is that "unusual" does not always mean "malicious": an employee travelling or a software update can generate harmless anomalies.
Phishing and spam filters
Modern filters analyse text, sender, link structure and attachments. Language models improve the ability to recognise messages crafted to seem urgent or authoritative, even when they are written in flawless language and contain none of the words typical of scams.
Malware analysis
Models can classify suspicious files based on their characteristics and on how they behave in isolated analysis environments, helping to recognise variants of known threats even when the code has been modified.
Support for analysts
This is the area where language models have brought the most novelty:
- summarising an incident from dozens of correlated events;
- explaining in plain language a command or script found on a compromised machine;
- turning a question into a query for the log collection system;
- drafting reports for management or for mandatory notifications.
A practical example
Imagine a small professional practice with ten workstations. An endpoint protection system with machine learning components reports that on one computer a newly opened document has launched a process trying to download a file from the internet. The system blocks the action, isolates the workstation from the network and sends a summary. The technician receives a clear description: which email delivered the document, what it tried to do, which other mailboxes received the same message. Within minutes they can remove the email from the other mailboxes and warn colleagues.
Limits worth knowing
| Limit | Consequence | How to manage it |
|---|---|---|
| False positives | Pointless alerts, loss of trust | Calibration and periodic review |
| False negatives | Undetected attacks | Several layers of defence, not just AI |
| Dependence on data | New environments poorly protected | Learning period and monitoring |
| Language model errors | Wrong explanations of an event | Analyst checks against the original data |
There is another aspect not to forget: attackers use AI too, for example to write more convincing phishing messages. This makes defences that do not depend on recognising text, such as multi-factor authentication, even more important.
AI as a new target
Introducing AI tools into a business also creates new surfaces to protect. An assistant connected to internal documents must respect the same permissions as users; an agent that reads email may be exposed to instructions hidden in messages. In my own security work, the rule I repeat most often is simple: every AI system should be treated as a privileged user, and therefore given minimal access, activity logs and periodic checks.
The basics are still the basics
No model makes up for missing fundamental measures:
- regular updates of systems and applications;
- multi-factor authentication on important accounts;
- tested backups kept separately;
- permissions limited to what is necessary;
- training people to recognise suspicious requests.
AI makes these measures more effective; it does not replace them.
In short
- AI helps defenders above all to cope with the huge volume of security events.
- Anomaly detection, anti-phishing filters and malware analysis are well-established applications.
- Language models support analysts in summarising, explaining and documenting.
- False positives and false negatives remain: several layers of defence are needed.
- AI tools must themselves be protected, with minimal access and logging.
