Artificial intelligence (AI) is coming to take your cybersecurity job. Or, AI will save your job.
Well, which is it?
As with all things security-related, AI-related and employment-related, it’s complicated.
How AI creates jobs
A major reason it’s complicated is that AI is helping to increase the demand for cybersecurity professionals in two broad ways. First, malicious actors use AI to get past security defenses and raise the overall risk of data breaches. The bad guys can increasingly use AI-based tools for improved reconnaissance and target profiling. It enables more sophisticated social engineering tactics, including deepfake impersonation and large-scale disinformation campaigns, while also facilitating the evasion of detection systems through adversarial AI techniques. Plus, AI helps attackers automate vulnerability scanning, exploitation and data exfiltration processes, making complex cyberattacks more accessible to less skilled individuals and potentially increasing the scale and impact of breaches.
Second, the deployment of AI expands the attack surface at organizations and the number of vectors available for attackers to exploit. According to IBM’s 2024 Cost Of A Data Breach Report, “The continuing race to adopt gen AI across nearly every function in the organization is expected to bring unprecedented risks and put even more pressure on… cybersecurity teams.” The report found that the rapid adoption of generative AI will likely increase the workload and pressure on cybersecurity teams, potentially exacerbating staffing shortages.
Third, “AI requires huge amounts of data to both train models and inform a model’s output at inference time (in a technique called Retrieval Augmented Generation [RAG]),” according to Sam Hector, Senior Strategy Leader at IBM Security. “The proliferation of data across multiple environments to feed AI increases the complexity of securing it and necessitates further specialized skills, increasing job demand.”
The use of AI by malicious actors, cybersecurity professionals and professionals of all stripes creates new specialty areas in cybersecurity.
So, AI creates cybersecurity jobs, right? Well, not so fast.
Read the 2024 Cost of a Data Breach Report
How AI takes jobs away
As generative AI is integrated into cybersecurity tools and becomes more capable as an informational chatbot, development tool and more, the need for people to do a wide range of tasks diminishes.
On a basic level, AI is becoming more proficient at automating routine tasks, such as log review and analysis, initial threat detection, vulnerability scanning and basic incident triage.
“While the need for what we regarded as traditional entry-level staff work will be reduced by automation and AI, it will also fundamentally shift the skills we require, said Hector. “Humans will focus more on strategy, analytics and program improvements. This will necessitate continuous skills development of existing staff to pivot their roles around the evolving capabilities of AI.”
“Human judgment remains a critical part of the cybersecurity process, especially in complex and high-pressure environments like breach response and when ethical and regulatory considerations come into play,” he said.
Generative AI tools can augment human knowledge with quickly accessible knowledge. Gartner predicts that by 2028, “the adoption of GenAI will collapse the skills gap, removing the need for specialized education from 50% of entry-level cybersecurity positions.”
AI is also expected to greatly lower the need for manual code review in the hunt for vulnerabilities as it gets better at doing this automatically and suggesting remedies.
AI tools will partially automate penetration testing, reducing demand for lower-level or entry-level pen testers.
AI threat intelligence is already a huge boon to security teams. AI can process and analyze vast quantities of data much faster than people, potentially reducing the demand for threat intelligence analysts.
AI is also adept at monitoring, detecting and flagging suspicious user behavior, and once detected, it passes on identified user sessions to humans.
An uncertain answer to the jobs question
Ten years ago, experts were divided on whether AI would create or eliminate cybersecurity jobs in the next decade.
Oddly, that divided, mixed and ambiguous prediction was right.
What wasn’t known a decade ago was the enormous impact of the generative AI revolution on both sides of the equation.
The skills cybersecurity professionals require are shifting towards data scientists and those with experience in AI, plus the necessity for the creation of interdisciplinary roles to bridge the gap between cybersecurity, AI and data science, according to Hector. Plus, new regulatory and compliance challenges emerged from AI’s rapid innovation.
It’s clear that AI is reducing the need for cybersecurity professionals to perform a large number of tasks that can be automated. AI is also greatly increasing the capabilities of staff by empowering them to do far more work in a shorter amount of time than without AI. But it’s also radically expanding the complexity of the overall project of cybersecurity.
The expanding attack surface, the rising costs of data breaches and cyber criminals’ use of AI are greatly increasing the need for cybersecurity in general. New job specialties are emerging, including AI cybersecurity specialists and cybersecurity data scientists.
While AI handles threat detection, log analysis, vulnerability assessments and the like, the human skill set will continue to shift towards strategy, planning, problem-solving and decision-making. It may be that a high-level architectural expertise will become more valuable than a low-level knowledge of programs, code and scripting, according to Hector. There will be a shift in skills demand towards data security and data governance to support the growing burden of feeding AI.
The skills gap remains, and opportunities in the cybersecurity field are myriad and expanding. While AI is a powerful and increasingly indispensable tool, human expertise, skill and judgment are still necessary.