Our AI strategy for preemptive security
This post covers the 2023 edition of Inside the Mind of a Hacker. Read the latest edition for current data.
These findings come from the 2023 edition of Inside the Mind of a Hacker, Bugcrowd’s annual survey of the hacker community, and they capture the moment generative AI first arrived in security research. We have kept them dated rather than updating the numbers in place, because what hackers believed about AI in 2023 is itself the interesting part. For current data, read the latest edition of the report.
Every year when Bugcrowd’s flagship report, Inside the Mind of a Hacker, comes out, readers get the newest data and trends around the hacker community–from demographics to motivations. In the 2023 edition, we surprised readers with a special section all about generative AI. For so long, AI felt like a looming storm cloud–distant yet ominous. But almost overnight, generative AI became accessible to the masses. The internet is filled with fear-mongering articles covering the terrifying consequences AI could have on cybersecurity, but in Inside the Mind of a Hacker, we wanted to talk about some of the cool ways hackers are using AI to make the world a safer place. Fast rollout of advanced AI and large generative AI systems is increasing corporate attack risks. Security leaders must address these new dangers.
We compiled an infographic of some of the biggest generative AI findings, which you can check out below. Here are five of the most surprising findings:
The integration of artificial intelligence (AI) into cybersecurity practices is becoming increasingly prevalent, with a striking 94% of hackers either currently leveraging AI technologies or planning to incorporate them in the near future to assist with ethical hacking. Hackers described using LLMs for the unglamorous parts of the job: parsing large volumes of code and documentation, generating payload variations, and drafting reports. Not one of them described AI finding the bug for them.
The integration of artificial intelligence into cybersecurity has sparked extensive debate, particularly regarding its ability to mimic the creativity of human hackers. Notably, 72% of hackers maintain a skeptical view, expressing disbelief that AI could ever fully replicate the instinctual and creative intricacies inherent in human-led cyber attacks. Hackers pair classic social engineering tactics emotionally charged spear-phishing, social media pretexting, dumpster-diving intel with AI tools that accelerate campaign scale. It’s this capacity for creative problem-solving and out-of-the-box thinking that many believe AI cannot emulate. The nuanced and adaptable nature of human intelligence, particularly when it comes to manipulating various attack vectors, remains a hallmark of human ingenuity in the cyber realm. Despite AI’s advancements, these hackers argue that creativity and intuition are facets of cybersecurity where humans still have the upper hand.
In a fast-changing digital world, AI and cybersecurity meet in ways that affect both defenders and attackers deeply. A striking 91% of hackers believe that AI technologies have either already increased the value of hacking or will do so in the future, highlighting a critical paradigm shift. By leveraging machine learning models and generative adversarial networks, hackers can create convincing phishing scams, launch automated attacks, and exploit existing security gaps with unprecedented precision and speed. AI-driven exploit kits now ship with on-the-fly polymorphic malware builders, cutting custom malware development cycles from days to minutes and super-charging phishing campaigns that target unpatched environments.
This powerful tool is reshaping the way malicious scripting and vulnerability research are conducted. By employing AI-generated content, hackers can efficiently automate and optimize processes that were traditionally time-consuming. ChatGPT helps analyze security data. It lets hackers find system weak spots more easily. Furthermore, its capabilities extend to enhancing security event and incident management processes, making it a double-edged sword in the cybersecurity domain.
The landscape of ethical hacking is poised for significant transformation as 78% of hackers anticipate that AI will disrupt traditional methods of conducting penetration testing and participating in bug bounty programs. With the advent of AI-driven tools and technologies, coordinated information operations are expected to become more sophisticated, requiring ethical hackers to adapt to new challenges and methodologies. One of the most profound impacts will be seen in extended detection and response, where AI can provide real-time insights and rapid identification of potential threats. Additionally, behavioral analysis will become a key component, enabling hackers to understand the nuances of how adversarial AI operates and to devise strategies to mitigate potential risks. However, as AI continues to evolve, the ethical hacking community must remain vigilant and ensure they are prepared to address the complexities introduced by adversarial AI tactics.