How is AI transforming the threat landscape for cloud environments?
This is an interesting question as, of course, AI is a tool that is useful to both good and bad actors. For now, let’s focus on the bad.
Targeted threats have always been more successful (and more costly) than mass attacks. AI contributes to combining the scale and cost of a mass attack with success more aligned to the targeted approach. Specifically in the cloud world, there are multiple techniques where AI can add value, complexity, and ultimately a more successful outcome to an attack.
These include simple techniques – such as AI used to populate brute force attacks, or Generative AI used to support targeted access requests – through to adaptive malware, where AI is asked to rewrite code to bypass detection. There is also the more direct use of AI to detect and leverage vulnerable systems, or identify and exploit organisation-level misconfigurations through scanning, probing and researching at speed. Perhaps more concerningly, it can apply the same speed and techniques to shared cloud or multi-use APIs, compromising large-scale one-to-many systems.
AI can also support more targeted approaches, with its speed and ability to process data compressing attacks and their outcomes. For example, automating lateral movement, persistence and privilege escalation techniques – enabling attackers to quickly identify and acquire high-value data in large cloud storage environments, or edit log files and manipulate other data to conceal a breach and hinder its investigation.
Are traditional cloud security approaches becoming obsolete in the face of AI-powered attacks?
The previous answer goes some way to support this. Cyber security has always been a playing field biased in the attacker’s favour – the attacker only needs to succeed once, while the defender must succeed every time.
Much of the traditional cloud security approach is not aligned to the scale, speed of execution, and complexity of AI-driven or AI-supported attacks. Perhaps more importantly, much of the value organisations gain from cloud environments is built on “good enough” security measures, with point-in-time security applied after deployments and a high dependence still maintained on human factors.
Traditional approaches often rely heavily on static defences: perimeter-based edge protection, fixed rule sets, and predefined access controls. These are designed to guard against known attack vectors and assume a relatively predictable threat landscape. Coupled with reactive specialist resources that need the timeframe of human interaction to respond, our AI-powered adversaries’ eyes are starting to light up at the possibilities.
Attacks that previously took days of careful planning are now executed in seconds. Legacy defences could, in theory, address this – if everything was patched and configured correctly all the time, all resources acted perfectly all the time, and nothing was dependent on a third party or supply chain. The real world of security is very different from this ideal.
To update a piece of classic security advice: “you don’t have to be the fastest to escape the bear, you just have to not be the slowest.” In an AI-attacker-fuelled world, there could be a thousand faster, stronger, more aggressive bears chasing every organisation simultaneously. You may not even see them before they take you down.
What strategies should organisations adopt to stay ahead of AI-driven threats in the cloud?
Just like the attackers, you can augment your defences with AI.
But let’s start by doing the basics well. Move what you can to automation – for example, utilising infrastructure as code and pipelines with automated testing to remove human configuration errors, automating the execution, validation and segregation of backups, and continuously testing for exploitability of core systems. Then focus on the surrounding factors – such as identity – that are often required to breach your systems, and become more aggressive in containing and isolating suspect activity. Work to the principle of “assume breach”: segregate and aggressively monitor core systems, removing suspect access to allow time to investigate and restoring it if the activity proves benign. Plan for how you keep critical systems operating during these periods, so your services continue even if a key person’s or system’s access is temporarily revoked.
With all the focus on AI, it’s important not to discard the human factor. A key emphasis should be establishing comprehensive, continuous learning programmes to equip your security teams with the knowledge needed to understand and combat AI-powered threats. By fostering a culture of ongoing education, organisations can ensure their teams stay ahead of the evolving threat landscape and are prepared to counter sophisticated attacks that exploit AI and machine learning technologies.
Then it’s time to introduce AI-level defences.
First, use AI to build proactive defences. Consider building a private generative AI – avoid public systems, as you would essentially be training them on how to attack you – or find an evidenced, secure partner who can train and align a private generative AI to support you. Simply ask it how it would attack you, then plan your defences accordingly. Remember to evidence the removal of your data from any partner system and validate their security before sharing sensitive information. This will help align your defences and validate your controls in a digital twin environment.
Second, implement continuous cloud posture management to flag errors or misconfigurations in near real time. Take advantage of AI to drive your detections – machine learning-generated anomaly information provides a rich source of “things that could be bad, but are definitely different,” helping you sort through millions of events to find the ten that matter.
Third, use AI to drive response actions. This is the final stage and should be approached with care – active automated response can affect business continuity. However, assuming breach, removing misconfigurations, and containing (then releasing) assets to allow time to investigate, validate, and clear benign activity is the direction of travel. As always, security involves trade-offs. The most secure system is one that is switched off – but that means no business value. These types of attack require a different approach: implementing zero trust and continuous CSPM with automated responses. Done properly, this gives you the best of both worlds – response to AI-driven attacks at AI speed and scale. Done without thought, planning and experienced support, it risks creating significant business disruption.
