The emergence of generative AI has put new resources in the hands of both attackers and defenders, and in 2024, Imperva believes the technology will have an even greater impact. Understanding how attackers are leveraging the technology will be critical for organizations seeking to keep themselves—and their data—protected.
In this piece, our experts and thought leaders will explore the ways in which organizations will evolve to address the emerging challenges associated with generative AI, API vulnerabilities, and the ever-changing security market.
Generative AI Disrupts the Cyber Threat Landscape
Karl Triebes, Imperva SVP and General Manager, Application Security, says it’s easy to envision a future where 70% or even 80% of all web traffic comes from bots. He notes that one of the biggest factors driving that growth will be generative AI solutions, which operate by using automated web crawlers to scrape websites and collect information from across the internet.
As both businesses and individual users grow more comfortable using generative AI, there will be a significant spike in activity associated with those crawlers. Imperva Senior Product Manager Lynn Marks agrees, noting that data scraping is “becoming more of an issue for organizations” as their data is used to train the large learning models (LLMs) that inform generative AI tools.
Triebes points out that generative AI will make its presence felt in other areas, as well—including a shift toward AI-based coding in the future. Director of Technology within the Office of the CTO Peter Klimek agrees and says that “new and/or junior developers will benefit greatly” from AI-enabled development tools, increasing productivity and output by automating routine tasks. However, he acknowledges that those same tools will “help script kiddies graduate into skilled hackers capable of carrying out more complex exploits.” In the near term, Triebes believes generative AI will primarily be used to perpetrate fraud.
“It will be much easier for fraudsters to masquerade as somebody else—at least online,” explains Triebes. “AI will lead to a new breed of fraud and social engineering attacks. A fraudster could scrape the internet for information about you and then weaponize a voice recording of you. Through generative AI, they can create a pseudo version of you. If they package that effectively, they could contact your bank and request a password reset.”
Ron Bennatan, Imperva Fellow, Data Security agrees. He expects to see an increase in attacks as attackers leverage AI to fool their victims, noting, “because LLMs are so good at both understanding humans and creating text communications that really look like they were created by humans, attackers will be able to target and ‘hack’ individuals far better than before.”
Alan Ryan, AVP, UK & Ireland, notes that as attackers invest in AI, so too must defenders. Bad actors are investing heavily in AI in an attempt to gain an upper hand over defenders, which means organizations need to ensure they are investing in these solutions as well. Ryan says AI doesn’t necessarily “change the balance of ‘good vs. evil,’” but instead just represents the next evolution of the ongoing cat and mouse game between attackers and defenders.
API Security Will Take on Greater Prominence
As attackers target APIs with greater regularity, organizations will be forced to take a more proactive approach toward identifying, classifying, and protecting all API endpoints in production. This is particularly true for large organizations: enterprises with a revenue of at least $100 billion USD are between three and four times more likely to experience API insecurity than small or midsize businesses.
Unfortunately, while API ecosystems are expanding rapidly, most organizations are still in the early stages of understanding how to effectively protect them. Although it’s common for today’s businesses to have between 50 and 500 APIs in production, many don’t know where they are deployed or what data they are accessing. That put the organization, and their valuable data, at extreme risk.
Peter Klimek says “most organizations are still in the early stages of understanding API security and don’t yet have a nuanced strategy for protecting their APIs”. Further, he believes organizations “haven’t implemented the right defenses or controls in place to manage identity and access management.”
Lebin Cheng, VP, API Security, Imperva, believes that will start to change this year. “In 2024, as pressure to mitigate API-related security incidents continues to grow, security leaders will look for, and invest in, solutions that integrate seamlessly into their existing Application Security technology stack,” says Cheng. “This approach will give organizations a more coordinated and unified view of automated threats that target APIs and critical applications—all of which connects to data stores where the businesses’ data is located.”
Alan Ryan predicts that relying on homegrown, in-house API and bot management will be a “risky strategy” as automated attacks become more sophisticated and adept at evading simple defenses. According to Ryan, global vendors have an opportunity to leverage the vast amount of data they collect from millions of endpoints around the world to provide customers with the actionable insights they need to effectively defend themselves against modern threats.
How Organizations Approach Data Security Will Change
In 2024, businesses won’t just continue to invest in the same old solutions—they will increasingly look to innovate in ways that help them stand out from their competitors. Many will invest in new analytics capabilities or leverage new or expanded cloud workloads—and they will assume the risk that comes along with them.
Dan Neault, SVP and GM of Data Security, believes organizations will need to explore new data security technologies that can “help them understand and manage their data risk and actually make their overall IT more secure.” Neault also points out that the rise of hybrid and multicloud environments makes it even more imperative for customers to have effective data security protection, insights, and risk mitigation across all of these systems.
There will also be a shift toward consolidation. Moshe Lipsker, SVP, Product Development, states that industry consolidation will lead to a rise in comprehensive solutions, creating end-to-end solutions that empower CISOs to “deliver a layered model of protection.”
Terry Ray, SVP, Data Security GTM and Field CTO, agrees, pointing out that “niche and single solution products and vendors find themselves increasingly in demand for acquisition and partnerships as consumers look to answer data security and regulatory requirements while minimizing necessary expertise, costs, and effort.” Ray expects consumers to see “rapid increases in enterprise data asset coverage, decreased skill requirements, and better collaboration between technologies that were traditionally segmented.” For most businesses, that’s good news—consolidation will allow them to streamline their security solutions and rely on fewer vendors.
Adapting for an Continued Change
The continued rise of generative AI and increased focus on API security will be trends to watch in 2024, as will the consolidation of the security market and shift in the way organizations approach data security. We look forward to having further discussions with our partners and customers to see what their biggest concerns and priorities are as we move into 2024.
A version of this article also appeared in the December 2023 issue of Cyber Defense Magazine.
Try Imperva for Free
Protect your business for 30 days on Imperva.
