In an AI-driven world, the Mean Time to Respond is emerging as a big winner for state and local agencies. While endpoint detection tools have long been in use to speed up mean time to detection, the integration of large language models (LLMs) in endpoint detection and response (EDR) tools is taking response times to the next level.
Security analysts can now query these LLMs, much like they would ChatGPT, to quickly gather threat intelligence in real time. This conversational approach vastly improves the speed and quality of response, especially for agencies with limited time and resources.
AI is also being used to stitch events together in security operations centers, making it easier to address the root cause of a problem rather than chasing alerts. Additionally, generative AI chatbots are helping cybersecurity experts navigate EDR tools more efficiently.
For larger agencies, creating a custom Retrieval-Augmented Generation solution allows them to query their own LLMs for curated cybersecurity data. This bespoke solution caters to the specific needs of a particular environment, providing security personnel with direct answers to their queries.
While the benefits of AI in cybersecurity are clear, organizations must also be cautious about the risks of de-prioritizing AI. It’s important to have a well-defined AI policy to prevent unsanctioned use of public LLMs and ensure data governance when using vendor-specific LLMs.
Ultimately, while it’s important to approach “next-gen” AI products with caution, dismissing AI entirely would be a mistake. Rapid adoption and iteration of AI technology suggest that it’s here to stay and will continue to shape the future of cybersecurity efforts.