Robocop for Cybersecurity: How AI and LLMs Are Redefining Digital Defense

The Convergence of Cyber and AI

Cybersecurity, the police of your business IT network. They make sure that nothing criminal is occurring, they monitor the network like traffic cops and test you on your cybersecurity awareness skills on an annual basis. Sometimes they play dirty and try to entrap you with a corporate phishing email just to tell you that you need to take cybersecurity awareness training again if you fail their test.

The leader of this IT police gang, the Chief Information Security Officer (CISO), reviews everything that comes into the organization, everything that leaves the organization, drafts IT Security policies, prevents risky actions and downloads, and makes sure that the organization is using multi-factor authentication. His police force consists of Information System Security Analysts, a Security Operations Center (SOC), a Penetration Testing Team, Application Assessment Teams just to name a few. The force relies on information from their Mecca – NIST – to provide guidance on the correct cybersecurity controls they should put in place and enforce.

Now throw some AI into the mix…and we have Robocop! 😊What does Robocop do? He takes control of the situation and uses his AI brain to hunt down and arrest the malicious packets and stop any malicious behaviors within your network. Robocop is a force to be reckoned with… So how do you create Robocop and get him working in your environment?

At my organization we planned and executed our Zero Trust Architecture with the intent of utilizing AI where appropriate to aid in the protection of our network. Reviewing and analyzing tools through technology evaluation boards made up of the CIO, CISO, and technical cyber analysts to determine what portion of the Zero Trust Architecture this covered and what benefit any AI solution brought to the table.

Yes, the intent was for AI to augment the information system security team to create a more effective and efficient operation while reducing threat vectors and increasing speed of incident response. A key factor was to ensure that the humans remained in charge and the AI assisted them in their duties. Remember, even Robocop had a boss.

Bring out your tools and build a Robocop

So, what could an organization incorporate in their environment and how would AI impact their operations?

This chart lists the controls that could be put in place by a product, lists the enforcement surface, and the AI capability of the tool that could be incorporated into a cyber tech stack. The product names are left out, but listed is the generic product description.

Many of the cybersecurity tools added – wait for it -- yep, you guessed right – Generative AI. This common AI integration creates a natural language user interface with the cyber tool allowing for any layman to easily question what it finds. Put in the hands of a trained Information System Security Officer and you have Sherlock Holmes crossed with Robocop. Quick to research and find issues and quick to snuff them out.

There are some other great cyber system implementations as well from natively designed and developed machine learning solutions other than just the bolted-on Gen AI LLMs.

Robocop (Infected)

What happens when Robocop’s LLM is infiltrated and corrupted by an outside malicious force? We must protect our LLMs and AI tools from undue influence. In April, The Washington Post and The Times (London, UK) reported on Russia’s plan to seed chatbots with lies, making them less reliable. This is called LLM grooming. And they, Russia, are sharing their playbook with other likeminded nations such as China.

Now you don’t only have to worry about hallucinations (the chatbot making up information because it doesn’t know how to say that it doesn’t know), but you have the opportunity of it feeding you misinformation – or lies – orchestrated with malicious intent (because the information that the chatbot is trained on is a lie). If you have seen the movie Mountainhead and/or read Mustafa Suleyman’s book The Coming Wave, this playbook of chatbots providing misinformation should resonate and be rather eye opening for you.

Let’s take this a step further and assume that bad actors can inject misinformation or instructions through poison prompts into the LLMs that your cybersecurity tools use to guard your environment. This is a whole different way of compromising your network. Before, your cyber team was looking for zero-day exploits, perimeter weaknesses, gaps in your defense...etc. Now you must ensure that the tools that your tools use are secure – this becomes an AI supply chain risk. But this risk is even harder to protect against because the LLMs train on information from all over the Internet and most security vendors don’t build foundation models from scratch – it is faster to bolt proprietary telemetry and guardrails onto other models.

To combat this, you must ensure that the LLM used by your cyber tool is locked down and the information that it uses is regulated. Some ways to accomplish this:

· Ensure that every prompt pings a restricted vendor managed data source - such as a product’s data lake.

· User content is not fed back into the model for training.

· Create a guardrails or validation agent to check responses for hallucinations or policy violations

· Do external LLM security testing – treating it as an attack surface

As more and more models come to fruition, it makes sense that vendors will look to be able to diversify their enterprise offerings by providing the option of integrating with various LLM solutions. You must stay vigilant, review the vendor’s roadmaps, and ensure that the appropriate testing and guardrails are put in place.

You can build Robocop and get him in place. You can let him loose and have him monitoring the environment, chasing down bad packets and stonewalling hackers. The tools are out there and can provide you a secure environment. But even though you have all the tools in place, implemented, and working, your cyber team still needs to remain vigilant, and testing may be expanding beyond your normal penetration testing and red teaming of your network, it may also include doing the same to your tools and their LLMs to ensure total security. The convergence of AI and Cyber provides many great possibilities, but it can also provide many threats if you aren’t careful. Nobody wants a rogue Robocop.

Stay tuned for Robocop 2