Despite 65% of IT leaders using generative AI, 89% of IT leaders are concerned that flaws in genAI cybersecurity tools could put their organisation at risk.

This is according to Sophos’s new report which surveyed 400 IT leaders for its report highlighting the scepticism surrounding generative AI and its application in security.

New research from Sophos X-Ops also cited the slight but noteworthy shift in the way cyber-criminals use AI. After investigation several underground forums, Sophos X-Ops found that while there is still scepticism about GenAI, some criminals are using it to automate mundane tasks, such as crafting bulk emails and analysing data. Others are incorporating it into spam and social engineering toolkits.

“As with many other things in life, the mantra should be ‘trust but verify’ regarding generative AI tools. We have not actually taught the machines to think; we have simply provided them the context to speed up the processing of large quantities of data,” said Chester Wisniewski, director, global field CTO, Sophos.

“The potential of these tools to accelerate security workloads is amazing, but it still requires the context and comprehension of their human overseers for this benefit to be realized.”

With some form of AI embedded in the cybersecurity infrastructure of 98% of organizations surveyed, IT leaders expressed concern about potential over-reliance on AI, with 87% of respondents stating they were concerned about a resulting lack of cybersecurity accountability.

Further, while 75% of IT leaders agree that the costs of GenAI in cybersecurity products are hard to quantify, 80% believe that GenAI will significantly increase the cost of cybersecurity tools.

Recommended reading

• Cybersecurity in 2024 | The High Cost of Innovation
• IT and Security Leaders Admit Hardware Cybersecurity Gap
• Comment | Get Ready For New Cybersecurity Legislation on Connected Devices

Still, most organisations believe GenAI offers a path to lowering overall cybersecurity expenditure, with 87% of respondents believing the savings of GenAI will offset the costs.

GenAI and Reducing Burnout

Different-sized organizations expressed different priorities for utilizing GenAI. While large organizations (those with more than 1,000 employees) are prioritizing improved protection, respondents with 50-99 employees rated reducing burnout as their top desired benefit from GenAI tools. 

However, complicating matters, across all sizes of organizations, 84% of leaders surveyed said they were concerned about pressure to reduce cybersecurity professional headcount due to unrealistic expectations about AI’s abilities to replace human operators.