Navigating the Impact of AI on Cyber Security: A Policy and Technical Perspective

The U.S. government is facing a complex dilemma when it comes to the impact of AI on cyber operations. While officials believe that AI can give an edge to cyber defense, there are also concerns about its potential to enable powerful offensive cyber operations. The rapid advancements in AI are expected to significantly change the landscape of cyber operations, creating both opportunities and risks for cybersecurity.

One of the key areas where AI is expected to make a difference is in vulnerability discovery. By using large language models, the time and resources needed to discover vulnerabilities in code could be dramatically reduced, potentially automating the process. However, the question of whether this will ultimately benefit cyber offense or defense depends on how quickly vulnerabilities can be exploited versus patched.

The U.S. government is exploring how AI can augment its cyber capabilities and bolster cyber defenses. Initiatives such as the AI Cyber Challenge and the AI Security Center are part of broader efforts to leverage AI in cyberspace. However, incorporating AI into national cyber strategy requires a nuanced approach that goes beyond the traditional offense versus defense balance.

The focus should be on identifying vulnerable targets and understanding the marginal effects of AI on various phases of a cyber operation. For example, while AI can scale up vulnerability discovery, the benefits may vary depending on factors such as how quickly vulnerabilities can be remediated. Similarly, the use of generative AI in phishing operations may benefit certain threat actors more than others, highlighting the need for targeted defense measures.

In conclusion, the impact of AI on cyber security is a policy problem as much as a technical one. By understanding the mediating factors and incentives that drive the development and use of AI, policymakers can prioritize focus on the most impactful AI-enabled cyber threats and leverage AI capabilities to decrease the attack surface effectively. The key lies in shaping the conditions that can influence the changing distribution of cyber threats in the age of AI.