Prioritizing Impact: Building an AI-Driven Security Strategy

In the evolving landscape of cybersecurity, organizations are reevaluating their approaches to security operations in light of resource constraints. The traditional SOC Triangle, which balances quality, consistency, and cost-efficiency, often limits a team's ability to deliver effective security. However, the integration of AI can amplify a team's capabilities, allowing for deeper insights and a more consistent approach without necessarily increasing headcount.

The key question many security leaders face is: Where to begin this integration of AI? The starting point must revolve around understanding security outcomes that are vital to the business. Many security teams are familiar with the concept of "good security," but the real challenge often lies in delivering that consistently amid limited personnel, skills, budgets, and available technology.

Focusing on Critical Outcomes

Before diving into technology applications, it's essential to pinpoint the core systems, identities, data, and processes that the organization relies upon to maintain customer service. This exercise offers a framework for determining which security areas require the most attention, creating a clear boundary defined by business needs. Once these boundaries are established, security questions can be articulated more concretely: Which identities access critical systems? What detection methods indicate potential attacks? What evidence is necessary for effective incident investigation? Furthermore, how quickly must a response occur to mitigate risks to crucial business processes?

Structuring AI efforts around business-defined outcomes shifts away from merely organizing efforts by technology types—such as endpoints, identities, and cloud solutions—and instead aligns them towards preserving business operations within acceptable risk levels.

Identifying Constraints

Having clarified the essential outcomes, the next step involves mapping out the constraints that hinder the security program's delivery. During collaborations with security teams, I've observed three recurring types of limitations. First, personnel constraints emerge when alert volumes surge beyond the capacity for thorough investigation. Second, skill constraints manifest when valuable threat intelligence exists, yet no team member possesses the expertise or availability to put it into action. Third, financial constraints appear as the cost of security data escalates, often without a parallel increase in visibility.

Time constraints introduce their own set of challenges as detection rules can become outdated, especially as environments and threat tactics evolve. Moreover, technology limitations can force analysts to navigate between disparate systems, which hampers efficiency. It's also worth considering that organizational dynamics come into play, as security teams vie for attention and resources amid competing business priorities.

Continuous Processes and Value Creation

To identify prime areas for AI application, look for security activities that yield the most benefit when performed continuously, yet are currently infrequent or inconsistent. One effective example is posture management. Given that exposure fluctuates as applications and configurations change, AI can provide continuous assessment to determine which vulnerabilities are most pertinent to business-critical systems.

Additionally, detection engineering exemplifies a valuable area for AI intervention. Rules designed many months ago may no longer trigger useful alerts today. By continuously evaluating the fidelity and coverage of detection mechanisms, organizations can make gradual adjustments without necessitating a dedicated expert for every system.

Even threat intelligence benefits from this continuous approach, as teams often possess high-quality sources but struggle to translate reports into actionable insights quickly. AI can interpret new intelligence, highlighting relevant tactics for specific environments, and streamline associated hunts.

The context around alert investigation also stands out. Humans generally need to aggregate various data points to reach conclusions, an increasingly untenable task as alert volumes grow. AI can automate much of this evidence collection and correlation, reducing the burden on analysts and enabling more efficient investigations.

Selecting Meaningful Starting Points

Transitioning to AI implementation doesn't necessitate a complete overhaul of existing processes. Instead, it's beneficial to select one key operational outcome that aligns with business priorities and identify the specific constraints that impede regular performance. If, for instance, user-reported phishing cases take up significant analyst time, focus initially on streamlining alert investigations. If the influx of new intelligence outpaces your team's capacity to act, direct efforts toward threat hunting improvement. Aligning AI use cases with concrete operational challenges simplifies governance and ensures clarity around what AI is authorized to manage, under what conditions human intervention is needed, and how success should be measured.

Measuring Progress and Improvement

AI initiatives can sometimes devolve into mere metrics for activity count, such as processed alerts or generated queries. While these statistics indicate utilization, they do not provide insight into whether the security program is genuinely progressing. Evaluation should revert to the defined outcomes. For instance, when assessing alert investigations, the focus should shift to the quality of investigations, time to completion, the quality of escalations, and the effort required from analysts. Similar metrics can be adopted for threat intelligence and detection engineering, emphasizing the importance of contextual relevance and alignment with organizational risk.

Tackling Execution Gaps

The ideal starting point for a resource-strapped team may often be lying in plain sight. By identifying security tasks that they recognize should be executed but aren’t consistently performed, teams can uncover execution gaps ripe for AI intervention. Perhaps investigations are delayed due to a backlog of alerts, or detection rules remain unrefined because there's no allocated time for tuning them. Addressing these points of friction can create discipline and ensure every AI implementation directly improves the security posture of the organization.

Ultimately, an AI-native security program starts not with a flashy technology roadmap, but with practical steps aimed at enhancing specific security tasks that require improvement. Prioritize these tasks to truly harness the potential that AI brings to your security strategy.