Akshay Bhushan, Partner at Tola Capital and Myke Lyons, Chief Information Security Officer (CISO) at Cribl
The security landscape is becoming increasingly complex as the volume of alerts surge. Security teams are becoming thinly stretched as more issues require a higher level of expertise, and that expertise is becoming progressively more difficult to source. Security teams are evolving and the need for automated responses, providing rapid solutions, enabling teams to work at higher efficiency levels, has never been more pressing.
Enter the AI Security team. This emerging concept envisions human and AI security teams that leverage advanced technologies to automate routine tasks, enhance threat detection, measure control efficiency and accelerate response times.
There are four key functions challenging the traditional security team – security operations, vulnerability management, governance, risk and compliance, and application security – where the transformative potential of autonomous solutions are emerging by both startups and incumbent security companies.
Let’s look at the ways that AI is revolutionizing tasks like alert triage, information retrieval, and ongoing process monitoring; and how teams are using AI to free up security analysts to focus on critical, more strategic, and high-value activities.
Functions in Enterprise Security Teams: Challenges and AI Opportunities
The Autonomous Security Operations Center (SOC)
We expect the SOC to be transformed with a mix of copilot (AI aiding humans) and pilot (full automation or agentic) solutions with several personas (Tier 1, Tier 2, and Tier 3 analysts) whose work will all be transformed by automation in the midterm. The central challenge of all SOC analysts can be sorted into these areas:
- Alert Triage: Which of the 10 alerts that I received over the past 24 hours are the most important?
- Information Retrieval and Processing: What query could run on my internal systems to determine what something is, who built it, who knows about it, and what’s the most current information?
- Ongoing Process/Operational Monitoring: is it possible for certain SOC teams to measure what a good ops team looks like from a ticket/alert/work product basis?
While Tier 1 analysts are usually handling basic triage of vulnerability scans and event logs, creating JIRA tickets and ensuring existing tools are configured appropriately, the vast majority of alerts and events created within the SOC are ignored. AI can automate both the triage and low level remediation of certain Common Vulnerabilities and Exposures (CVEs) to allow for better throughput for lower members of the SOC.
Startups starting with Tier 1 analyst personas in mind are AirMDR, Swimlane, and Andesite, all of which focus on initial triage and remediation of tasks suited for entry level analysts.
We are also seeing various SOC startups begin with a distinct approach: a knowledge base for security operations teams with the long-term goal of completely automating key workflows in the SOC over the long term, starting with Tier 2 and Tier 3 analysts. These companies are targeting core workflows across endpoint, networking, and phishing with a copilot-esque interface suited for more experienced analysts.
Dropzone is a well known entrant into the Tier 2/3 market with a chatbot and knowledge assistant for analysts.
While promising, challenges for startups in this space will be the depth of integrations required to go beyond low-level automation and the majority of SOC spend is on-premise and concentrated in the F1000. This requires a complex deployment model that demands significant upfront investment to compete with the likes of Palo Alto Network’s Prisma AI and Sentinel One’s Purple AI platforms.
The counterpoint is that these solutions are black boxes in terms of data autonomy and require that analysts operate within the walled gardens of Palo Alto Network or Sentinel One, and in this category, we are excited about on-premise solutions that fits over analyst workflows (akin to a Chrome plugin).
Crogl, founded by Monzy Merza and David Dorsey, focuses on information retrieval and triage in the hands of threat hunters and security analysts alike.
Crogl integrates with existing Security, Orchestration, Automation and Response (SOAR) solutions, and can elevate and modify existing remediation playbooks. Because the solution is only touching relevant data and sits over existing workflows, it’s helping companies build an AI-ready knowledge base to enable full automation over the long term.
Vulnerability Management
AI models are showing competence at understanding and generation of code, and we hope (and expect!) this to be leveraged both from an application security and a software supply chain perspective. We believe startups will serve engineering leaders by improving security practices within developer teams.
The vast majority of startups in software supply chain security are not yet leveraging improved state of the art (SOTA) models for code generation. In the next two to three years, we expect in-IDE or CLI based interactions for remediation of code via suggested fix or auto-fix. While we believe Microsoft will have a competitive offering with GitHub Copilot, we also see an opportunity for startups that have fine-tuned on specific vulnerabilities and codebases (and enable private, company specific CLI tools for developers).
Once a codebase is ingested and understood by AI, we believe that many of these services, if not already available, may soon be achievable in the future:
- Automated documentation based on existing code
- Automated rule generation for future use cases
- Risk scoring
- Summarized views based on specific threat models
- Automated updated of library dependencies and subsequent test writing creating an AI QA function
We believe that frontier models will soon be able to scan and remediate existing code holistically rather than scan simply at a function or snippet level. We expect the existing code analysis/scanning market to be revolutionized with incumbents, well suited to dominate these markets given their existing data moats. Network, endpoint, and application scanning will see step function improvements. While we may not trust AI to do so yet, we also expect to see new automated patch deployment solutions.
Coana.tech is a new open source vulnerability scanner using AI to add reachability analysis to prioritize which vulnerabilities teams can address.
Governance, Risk, and Compliance (GRC)
In contrast to the primarily reactive postures of SOC analysts, GRC managers are positioned to be proactive and help us help ourselves. They drive policy and process development and implementation, then monitor the effectiveness of their processes in order to make adjustments.
But adjustments historically do not happen automatically. In most companies, including those with healthy GRC functions, this team is capacity-constrained and locks into a set auditing and reporting cadence by necessity. We see automation expanding GRC capacity across the board.
- Auditing and reporting – GRC can’t do anything without regular data collection. Healthy teams can monitor their KPIs on an ongoing basis, but deep data analysis that can inform corresponding policy updates is still the domain of experienced professionals. AI can automate this data analysis and proactively raise issues outside of the regular reporting cadence.
- As auditing becomes more automated via automated data collection and testing we expect to see broader usage around auto-audit.
- In the longer term this could lead to better actuarial data for ensuring good cyber practices.
- Policy development and monitoring – An LLM fine-tuned on a company’s existing, vetted documentation and data is a natural fit as a GRC copilot. Managers can prompt a chatbot for a given change or even a target outcome and instantly generate a change management punch list for their review. An agentic system could also compare the stated policies with existing configurations and processes to flag misalignments suggesting or developing a more policy-as-code practice. While the friction could be significant in the onset, longer term this could drive policy and regulation. GAAP for cyber may be an achievable goal.
- Training – We don’t anticipate AI will replace regular scheduled security trainings and refreshes; ritual and repetition still help keep security in-mind in every part of an organization. We do expect AI to improve access to security policies and protocols, especially if GRC teams begin using it to help them update policies on a continuous basis. In addition to the aforementioned punch list, a GRC copilot can draft org-wide communications about out-of-cadence changes and serve policy answers on-demand (chatbot-style). A GRC agent can also push policy reminders proactively in response to a spike in a given incident category.
We also see AI transforming 3rd party risk management processes, both outbound (answering security questionnaires) and inbound (parsing vendor responses). Most companies handle their vendor security assessments with static questionnaires that are either generic and incomplete or comprehensive to the point of exhaustion. On the outbound side, companies who build libraries of security responses are constantly working with out-of-date answers. Both ends of this spectrum encourage compliance theater to nobody’s benefit.
AI and copilots like the ones deployed by Trustcloud enable true programmatic 3rd party risk assessments for all stakeholders.
As sophisticated as modern GRC tools are, none of them offer complete real-time views into an enterprise’s security posture. For most companies, the status quo is checklists and regular reminders with some simple automation. LLMs and agents that integrate with these tools offer the prospect of true real-time governance and risk management. Compliance and security leaders may not trust these views yet, but as our relationships with agents evolves quickly, confidence will build in this capability.
One of the primary obstacles to unlocking the potential of this integration is the wide array of data sources that can feed these models. Even with the flexibility of LLMs that can understand natural language, it will be imperative to unify SOC, GRC, and even AppSec through a common data interface.
Leen is leading the way by providing a unified API and prebuilt connectors for security teams
Incorporating as much structured, normalized security data as possible is key to mitigating LLM hallucinations and allowing GRC teams to leverage these agents and copilots on the vast amount of unstructured, qualitative data in their scopes.
Application Security (AppSec)
Without exaggeration, generative AI represents a complete transformation in development with AppSec in mind. Its introduction raises the base level of attack volume and quality as well as the acceptable floor for vulnerability management. The scalability of generative AI for malicious attacks, whether via social engineering and phishing or through easy analysis of publicly-visible code, can only be met by equally scalable defenses.
The most pressing response for AppSec is for engineering organizations to bring AI into DevOps pipelines and IDEs to actively detect application vulnerabilities and, in some configurations, automatically remediate them. These can take the form of either copilots suggesting fixes or autonomous agents implementing fixes automatically – the choice depends on organizational priorities for near-term developer productivity and developer growth opportunities over time. What is becoming clear is that in IDE interactions are commonplace amongst larger organizations.
CISOs and Product leaders may also consider the sensitivity of data that could be exposed in a breach and the tradeoffs they need to make between security and accessibility. This is where clarity on vulnerability remediation metrics becomes very important. AI does not change the nature of the basic metrics (TTR, MTBF, and recurrence rates), but in the early stages of deploying AI for DevSecOps, security and engineering leaders must pay particularly close attention to false positive rates and changes in distribution of vulns by severity. AI-driven threat models may be automated, but they should still be fine-tuned based on your organization’s preferred security posture. Automatic rule generation for future detections is a powerful capability and CISOs need to decide how and when to lean on it. GenAI will produce significantly more code and faster, further compounding vulnerabilities. Whether or not GenAI produces more secure code than humans is a separate issue – the basic issue around detection remains the same.
Regardless of who pushes a security fix, we expect automatic code documentation, application architecture diagramming, and query-friendly documentation will be table stakes for AppSec and DevOps AI products that aspire to grow beyond point solutions. One part of unifying AppSec, SOC, and GRC is bringing AppSec up to the level of documentation and accountability that SecOps and GRC teams are accustomed to. The modern CISO is at least as much a distributor of ownership as a concentrated sink for it and that needs to be reflected in the design and implementation of AI App Sec products.
AI is enabling – or native to – the next generation of cyber security startups, and while security teams are currently working hard to manage the evolving threat landscape, their abilities to focus an where they are most needed are being augmented by the new AI security team that is automating and triaging, aiding the analysts where they most need assistance.
We see tremendous opportunity for the enterprise to benefit from these emerging technologies and are excited to invest in this sector of companies.
Akshay Bhushan is a Partner at Tola Capital where he is focused on the future of security, infrastructure and software as enabled by AI
Myke Lyons is the Chief Information Security Officer (CISO) at Cribl, responsible for building practices, tools, and processes that allow customers to succeed. Prior to joining Cribl, Lyons held CISO positions at Snyk, the leader in developer security and Collibra, a leader in data governance and catalog software.