In an AI-driven world, the Mean Time to Respond is emerging as a big winner for state and local agencies. While endpoint detection tools have been around for a while, the integration of large language models (LLMs) in endpoint detection and response (EDR) tools is revolutionizing the speed and quality of response.
Security analysts can now query LLMs much like they would ChatGPT, making it easier to gather threat intelligence in real time. This conversational approach to threat analysis is proving invaluable for agencies pressed for time and resources.
AI is also being used to stitch events together in security operations centers, helping teams address the root cause of problems rather than chasing alerts. Additionally, generative AI chatbots are simplifying onboarding processes for cybersecurity experts.
For larger agencies, custom-built AI solutions like Retrieval-Augmented Generation (RAG) are being developed to cater to specific security environments. These bespoke LLMs allow for direct and tailored queries, enhancing cybersecurity efforts.
However, organizations must be cautious about de-prioritizing AI for cybersecurity. While publicly accessible LLMs can be tempting, a clear AI policy is essential to prevent unauthorized data sharing. It’s important to understand the governance of third-party LLMs integrated into EDR solutions.
As AI continues to evolve and see rapid adoption, it’s crucial for agencies to carefully consider the implications and take a measured approach to incorporating AI into their cybersecurity strategies.