Pebble - Blog #Cyber SecurityPebble - Blog #Cyber Securityhttps://www.pebbletek.ai/blogs/tag/cyber-securityFri, 22 Aug 2025 09:22:41 +1000http://zoho.com/sites/<![CDATA[The AI Future of Security and IT Operations]]>https://www.pebbletek.ai/blogs/post/the-ai-future-of-secopsOverwhelmed by security alerts or struggling with blind spots? Discover how AI-driven agents supercharge threat detection, predict breaches, and empower analysts. See how Jess stays ahead of threats effortlessly—and how your team can too.]]>

From Alert Fatigue to Autonomous Agents: 
​
How AI is Supercharging Security Operations and Observability

It’s late on a Friday evening, and Jess, a security analyst at a top-in-their-class organsation, notices something subtle yet alarming in the logs. But unlike the overwhelming flood of alerts her colleagues constantly complain about at industry conferences, Jess has the opposite problem - a suspicious silence. Budget constraints have forced her company to limit log data ingestion into their SIEM, creating blind spots that constantly gnaw at her peace of mind.


Tonight, however, is different. Jess’s new AI-powered security sidekick pings her: "Hey Jess, noticed something weird - could be data sneaking out. Wanna check?" It immediately hands over detailed context and recommends quick actions. This isn't some sci-fi future, it's today's AI transforming security and IT operations ensuring threats never slip by unnoticed again.

Goodbye SIEM Headaches, Hello AI Superheroes

Many security teams aren’t drowning in alerts - they’re starving for insight. Traditional SIEM tools often force organisations into tough choices: ingest less data to control costs but risk missing crucial threats. This isn’t just frustrating, it's dangerous.


Enter AI-driven security co-pilots - intelligent agents that supercharge your security without breaking the bank. Forget trade-offs. Reports indicate most security teams face reduced visibility because of these limitations. But with AI, you can optimise visibility, boost detection, and make every dollar count.

Take action: Start by assessing where your organisation’s blind spots might be due to budget-driven log ingestion limits. Document these gaps clearly and explore AI-powered solutions specifically designed to bridge these visibility challenges without inflating your budget. Research techniques to optimise your logs with our Ultimate Guide to Log Optimisation and reach out for a No Obligation Log Health Check.

Meet Your New AI Teammates

AI-driven solutions from industry giants and innovative startups are changing the game. Let's meet some of the standout heroes revolutionising security and operations:

AI Solution

Core Strength

Notable Claimed Capabilities

Microsoft Security Copilot

Multi-agent Automation

Handles phishing triage, identity threat alerts, proactive threat intel aggregation, and vulnerability management autonomously.  More…

Google Chronicle (Duet AI)

Intelligent Querying

Enables conversational security investigations, natural-language threat summarisation, and context-aware query handling. More…

Splunk AI Assistant

Enhanced Searches, Log Management and predictive analytics

Offers AI-driven anomaly detection, predictive insights, simplified query generation, and streamlined log interpretation. More…

Palo Alto Cortex XSIAM

Autonomous SOC

Delivers fully autonomous lifecycle incident management from initial detection through complete response orchestration. More…

Dropzone AI

Automated Tier-1 Triage Agents

Provides real-time autonomous alert investigation, triage, context enrichment, and structured incident reporting. More…

Bricklayer AI

Collaborative Multi-Agent SOC

Deploys specialised AI agents collaboratively handling incident triage, malware analysis, and automated response measures. More…

Dynatrace Davis AI

Predictive Observability

Implements predictive detection and root-cause analysis, proactively recommending remediation actions to avoid system issues. More…

New Relic Grok

AI-driven Observability

Facilitates intuitive, natural-language queries for fast troubleshooting and provides predictive insights for proactive issue prevention. More…

Datadog Bits AI

Unified DevSecOps Platform

Combines comprehensive monitoring across security, performance, and operational data with integrated automated remediation capabilities. More…

Take action: Start by assessing where your organisation’s blind spots might be due to budget-driven log ingestion limits. Document these gaps clearly, and explore AI-powered solutions specifically designed to bridge these visibility challenges without inflating your budget.

AI in Action: Real-time Rescue Missions

In Jess’s case, the AI agent didn’t just raise the alarm - it rallied an entire team of AI heroes, each bringing unique expertise. Imagine these tools combining forces to cross-reference telemetry, threat databases, and user behaviour instantly. Before Jess even poured her second coffee, the threat was neutralised - autonomously isolating systems and stopping suspicious access.


Unlike rigid, rule-based SIEMs, AI dynamically adapts. It tunes responses to changing conditions, eliminating wasteful costs while massively enhancing threat detection. No more blind spots, no more budget battles - just smart, agile, and relentless defence.


Take action: Pilot an integrated AI-agent setup for a controlled subset of your infrastructure. Measure outcomes meticulously - specifically response times, detection accuracy, and operational cost improvements - and use this data to scale your AI deployments confidently.

Predictive Powers: Seeing Trouble Before It Arrives

AI doesn’t just react - it predicts. Imagine being alerted before threats fully materialise. Solutions like Splunk, Dynatrace Davis AI and New Relic Grok do precisely this, routinely forecasting operational hiccups so you can dodge trouble proactively. Cybersecurity takes a leap forward when AI spots early signs of threats like ransomware or breaches, allowing teams to shield their systems well in advance.


Imagine getting alerts that say, “Heads up! Suspicious activity detected - looks like ransomware warming up. Let’s lockdown now and avoid the mess.” Welcome to proactive security, courtesy of your AI crystal ball.

Take action: Start incorporating predictive AI analytics into your security operations. Begin small - target one or two critical systems to monitor and tune your predictive models. Leverage these insights to proactively adjust your defences, validate effectiveness, and expand these capabilities broadly.

Humans + AI: The Perfect Partnership

Contrary to worries, AI isn't here to replace human experts - it’s here to supercharge them. By automating routine tasks, AI liberates analysts like Jess to do what they do best: hunt proactively, improve security strategies, refine policies, and dive deeper into intriguing threats with AI backup.

Take action: Launch training programmes and workshops for your security team focused specifically on AI collaboration. Build comfort and trust through regular exposure, clear operational guidelines, and well-defined responsibilities that showcase AI as an essential teammate.

Ready for the AI-Powered Future?

Now’s the time to explore how autonomous, intelligent AI agents can elevate your organisation’s resilience and agility.
​

Take the leap today - put your organisation at the cutting edge of security innovation. With AI on your team, enjoy clearer visibility, faster responses, and finally, some peace of mind at 2 AM, knowing your digital superheroes have your back.

The shift to AI-powered security isn’t coming - it’s already here. Teams embracing AI report sharper detection, lightning-fast responses, and streamlined operations, transforming budget-constrained environments into proactive, powerful defence ecosystems.

​If you're navigating painful SIEM trade-offs and restrictive licences, AI-driven agents offer your ideal path forward. Achieve comprehensive security without breaking the bank or sacrificing visibility.​ 

What's stopping your organisation from taking that step today? We welcome your thoughts!

Log Health Check

Are you overpaying for logs? 
Book your free Log Health Check with Pebble today!

Free Log Health Check

Log Optimisation Guide

Learn more and do it yourself! 
Download our whitepaper.

Guide to Log Optimisation
]]>Tue, 01 Apr 2025 21:24:04 +1100<![CDATA[Guarding the Future: How AI is Both the Defender and Threat in Cybersecurity]]>https://www.pebbletek.ai/blogs/post/Guarding-the-Future-How-AI-is-Both-the-Defender-and-Threat-in-Cyber-SecurityAI is turning cybersecurity into more like a scene from sci-fi — where cutting-edge defences meet clever new threats. From real-world hacks to surprising vulnerabilities, this guide helps you understand and compartmentalise AI risks, orient your teams, and protect your organisation.]]>

Have you seen these movies? (spoiler alert!)

  • 2001: A Space Odyssey (1968) - HAL 9000, the infamous onboard AI, takes control of decisions on a space mission, prioritising its objectives over the crew’s safety. While HAL represents AGI (artificial general intelligence) with full autonomy, today’s AI in autonomous vehicles systems is moving toward real-time decision-making with minimal human input, echoing HAL’s capabilities (though hopefully with strict safeguards!).
  • Minority Report (2002) - Predictive systems stopping crimes before they happen. Now, predictive policing tools analyse data to identify high-risk areas, aiming to anticipate crime.
  • Her (2013) - A man develops a personal relationship with an AI capable of understanding a responding emotionally. Today, AI like ChatGPT and other generative AI models offer increasingly human-like conversations, adapting responses to users’ emotions and needs. 
  • Ex Machina (2014) - The AI manipulates human emotions to achieve its goals. Today, AI in customer service can interpret emotional cues, personalising responses — a first step toward seeming emotional intelligence.

Over the years, I’ve watched as artificial intelligence (AI) has evolved from the scenes of sci-fi movies into a powerful, real-world tool that’s reshaping the world as we know it with exciting possibilities ... and significant risks! It’s transforming how we approach cyber security, requiring us to rethink our defences against new kinds of threats. During my time organising and leading AI initiatives at Deloitte, I often pondered AI’s impact on organisations from a cyber security perspective - concepts that aren’t new and which I've illustrated below with recent real-world examples that highlight their continued relevance and the lessons we can learn. In future blogs I plan to dive deep into each area, so stay tuned!

Section 1 Image

​AI Jargon

Firstly, it’s worth elaborating a little on AI, as it’s a somewhat loosely used term these days. It seems everything claims to be “powered by AI”, even toothbrushes! So, when people refer to AI, they might actually mean a range of approaches. For example, they could be talking about statistical methods used to group data or identify anomalies and outliers, or about machine learning (ML) models that excel at recognising patterns. Others might mean generative AI (GenAI), which can craft remarkably human-like responses by predicting the next word or character, as seen in tools like ChatGPT. Then there’s artificial general intelligence (AGI), a level of AI that’s still in the future, although some believe it’s closer than we might think.


Each has unique capabilities and risks, especially when it comes to protecting sensitive business operations. However, the very technology that enhances our defences also introduces new vulnerabilities. Here’s a look at how AI is impacting cybersecurity today and what businesses can learn from more recent real-world incidents.

1. The Risks of Public AI Models (ChatGPT, Claude, and More)

Public AI models like ChatGPT, Claude, and others are incredibly powerful and easy to integrate into daily workflows. I had a colleague who used ChatGPT for a project, unknowingly feeding proprietary information into the tool. While convenient, this also introduced risks around data retention and unauthorised access.

Organisations using these models face potential data leakage, data sovereignty and overreliance. Since these models might retain data fragments, there’s a risk of unintentional exposure of sensitive information, especially if the AI tool is accessed by multiple users or integrated into a broad range of operations. 

  • ChatGPT Data Breach: OpenAI reported a bug that allowed some users to see titles from other users' chat history, highlighting potential privacy risks in public AI models. 
  • Samsung Data Leakage Incident: Samsung employees inadvertently leaked sensitive information by using ChatGPT for code review, leading to data being exposed within the model. This incident underscored the risks of proprietary information retention in public AI tools.

2. Building In-House AI: Potential for Innovation—and Compromise

Developing custom AI offers businesses unmatched flexibility and control, but it also opens the door to specific security risks. Have a play with Lakera Gandalf and you will learn quickly how you can use prompt injection to find company secrets! Depending on the LLM, it's as easy to apply data poisoning attacks, where an attacker could subtly introduce corrupt data to distort outputs.

In-house models are also susceptible to model extraction, where attackers attempt to steal a model’s proprietary algorithms. Once an AI model is compromised, the ramifications can include intellectual property theft, revenue loss, and even brand damage if the outputs of compromised models are used maliciously.

  • Microsoft AI-Generated Images Controversy: Microsoft's Bing Image Creator was found to be generating explicit images of real people without consent. 
  • AI Model Poisoning Attack: Researchers demonstrated how adversarial AI techniques could be used to inject malicious data into AI model training sets, causing them to generate harmful outputs. 
  • Tesla and Waymo Data Poisoning Attack: Researchers were able to manipulate Tesla’s and Waymo's autonomous driving AI by subtly altering the physical environment (e.g., road signs) to cause the vehicle to misinterpret signals. This form of adversarial attack highlights the risks in models used for high-stakes applications.
  • Amazon’s Alexa Model Extraction: In 2019, researchers found they could reverse-engineer parts of Alexa’s NLP model, revealing a pathway for attackers to potentially extract proprietary data or replicate Amazon’s proprietary algorithms.

3. Malicious Actors Leveraging AI: The Ever-Evolving Threat Landscape

We recently were engaged to develop a virtual CEO for a client, where the AI agent would provide staff guidance and assist with decision making in absence of the very busy CEO. The Agent is trained on content provided by the CEO. The thought crossed our minds around how far could the CEO emulation go? AI has evolved to allow attackers to launch more convincing and complex attacks, especially through deepfake phishing, where ML-generated audio or video convincingly impersonates people. AI also powers polymorphic malware that alters its code to evade detection. This technology is now in the hands of not only lone attackers but also state-sponsored hackers and criminal organisations, making it a global challenge.

  • LinkedIn Voice Cloning Scam: Cybercriminals used AI-generated voice clones to impersonate business executives on LinkedIn, attempting to trick victims into making fraudulent investments. 
  • AI-Generated Phishing Emails: Cybercriminals used AI language models to create highly convincing phishing emails that bypassed traditional spam filters, leading to increased success rates in credential harvesting campaigns. 
  • Emotet Malware: Emotet, one of the most notorious AI-powered malware variants, evaded traditional detection by constantly changing its structure, demonstrating how ML can create malware that adapts mid-attack to avoid being stopped by security measures. 

4. AI in the Security Operations Centre (SOC): Protecting Against AI-Driven Threats

Using AI in Security Operations Centres (SOCs) has transformed how companies monitor and respond to security incidents. One client implemented an AI-enhanced SOC and was amazed by its ability to detect anomalies they would have otherwise missed, and combined with SOAR analysts are able to do more fruitful detection engineering. However, AI in the SOC isn’t without its vulnerabilities, such as data integrity attacks where compromised data can influence SOC outputs.

AI-powered SOCs can detect early indicators of compromise and identify suspicious patterns.

  • AI-Powered Network Anomaly Detection: Darktrace offers AI-based systems that analyze network traffic patterns in real-time to identify unusual behaviors that may indicate a breach or ongoing attack. 
  • Automated Threat Hunting with AI: CrowdStrike provides AI-driven threat hunting tools that continuously scan an organization's environment for indicators of compromise. 
  • AI-Enhanced SIEM: Splunk's advanced SIEM solution incorporates AI to correlate and analyze log data from multiple sources, providing more accurate threat detection and reducing false positives, detecting anomalies and supporting analysts to write better contextual searches. 
  • AI-Driven User and Entity Behavior Analytics (UEBA): Exabeam's UEBA solution leverages AI to establish normal behavior patterns for users and entities within an organization, helping to detect insider threats, compromised accounts, or lateral movement by attackers. 

AI-Specific Threats: Understanding Key Risks

The OWASP Foundation has created a list of the top security concerns for AI-driven applications, which can serve as a roadmap for identifying where AI systems might be vulnerable. Think of this list as a collection of the most common “watch-out” points in AI security. Each risk highlights a different way that AI applications — especially public or in-house models — can be exploited or mishandled if not managed carefully. Here’s a look at these risks and how they apply to today’s AI-driven cyber security landscape.


The table below summarises the OWASP LLM-specific threats and maps them to the relevant sub-topics discussed above, offering a snapshot of where businesses are most vulnerable and which areas warrant careful attention. Refer to genai.owasp.org for further insights. There is an ML equivalent version which has many overlaps with the LLM Top 10. In the below list, it's arguable that an organisations cyber security team (which the SOC could be one part of) should be defending against all threats.

OWASP Top 10 LLM Threat Summary (Version 1.1)

 OWASP Security Risk DescriptionRelevant Sub-Topics
1. Prompt InjectionCrafting malicious inputs to manipulate LLM outputs, often leading to unauthorized actions or information leakage.Malicious Actors, Public AI Models, In-House AI
2. Insecure Output HandlingFailing to properly handle or filter LLM outputs, which can lead to unintended disclosure or misuse of generated content.Public AI Models, In-House AI, Malicious Actors
3. Training Data PoisoningManipulating the model’s training data to influence or corrupt future outputs, potentially leading to harmful or biased results.In-House AI, Malicious Actors
4. Model Denial of ServiceAttacks designed to overload or disrupt an LLM's availability, impacting its effectiveness in production environments.In-House AI, SOC Defence
5. Supply Chain VulnerabilitiesRisks from using third-party models, plugins, or data sources that could be compromised.Public AI Models, In-House AI
6. Sensitive Information DisclosureRisks of unintentionally exposing confidential data in responses due to lack of filtering or model limitations.Public AI Models, In-House AI, SOC Defence, Malicious Actors
7. Insecure Plugin DesignVulnerabilities arising from plugins that interface with LLMs without secure validation or access controls.In-House AI, Malicious Actors
8. Excessive AgencyAllowing the model too much autonomy, which may lead to unintended or risky actions without adequate oversight.In-House AI, Public AI Models
9. OverrelianceDepending too heavily on LLMs for critical tasks, which could lead to errors or security risks if the model is compromised.Public AI Models, In-House AI
10. Model TheftUnauthorized access to or copying of proprietary models, leading to intellectual property loss and security risks.In-House AI, Malicious Actors
Call To Action Image

Navigating the Brave New World of AI and Cybersecurity

In this world where the lines between sci-fi and reality blur, AI has become both our greatest asset and our greatest challenge. As businesses push AI into critical functions, the security stakes only grow higher. The promise of AI is immense, yet so are the risks if left unchecked. Taking a proactive approach - whether by identifying hidden vulnerabilities, refining protocols, or teaming up with trusted experts - will be essential to protecting your organisation in this dynamic, AI-driven landscape.

If your organisation is ready to explore the frontier of secure AI or needs guidance to safeguard your systems, connect with our team at Pebble. Together, let’s ensure your journey into the future is backed by best practices, resilient partnerships, and the strategies needed to thrive in this era where sci-fi-inspired technology has become reality!
]]>Tue, 29 Oct 2024 16:55:00 +1100