|
Listen to post:
Getting your Trinity Audio player ready...
|
Today, Cato is furthering our goal of simplifying security operations with two important additions to Cato SASE Cloud. First, we’re leveraging generative AI to summarize all the indicators related to a security issue. Second, we tapped ML to accelerate the identification and ranking of threats by finding similar past threats across an individual customer’s account and all Cato accounts.
Both developments build on Cato’s already extensive use of AI and ML. In the past, this work has largely been behind the scenes, such as performing offline analysis for OS detection, client classification, and automatic application identification. Last June, Cato extended those efforts and revolutionized network security with arguably the first implementation of real-time, machine learning-powered protection for malicious domain identification.
But the additions today will be more noticeable to customers, adding new visual elements to our management application. Together they help address practical problems security teams face every day, whether it is in finding threats or communicating those findings with other teams. Alone, new AI widgets would be mere window dressing to today’s enterprise security challenges. But coupling AI and ML with Cato’s elegant architecture represents a major change in the enterprise security experience.
Solving the Cybersecurity Skills Problem Begins with the Security Architecture
It’s no secret that security operations teams are struggling. The flood of security alerts generated by the many appliances and tools across your typical enterprise infrastructure makes identifying the truly important alerts impossible for many teams. This “alert fatigue” is not only impacting team effectiveness in protecting the enterprise, but it’s also impacting the quality of life of its security personnel. In a survey conducted by Opinium, 93% of respondents say IT management and cyber-security risk work has forced them to cancel, delay, or interrupt personal commitments.
Not a good thing when you’re trying to retain precious security talent. A recent Cybersecurity Workforce Study from ISC2 found that 67% of surveyed cybersecurity professionals reported that their organization has a shortage of cybersecurity staff needed to prevent and troubleshoot security issues. Another study from Enterprise Study Group (ESG) as reported in Security Magazine, found that 7 out of 10 surveyed organizations (71%) report being impacted by the cybersecurity skills shortage.
Both problems could be addressed by simplifying enterprise infrastructure. The many individual security tools and appliances used in enterprise networks to connect and protect their users require security teams to juggle multiple interfaces to solve the simplest of problems. The security analyst’s lack of deep visibility into networking and security data inhibits their ability to diagnose threats. The ongoing discovery of new vulnerabilities in appliances, even security appliances, puts stress on security teams as they race to evaluate risks and patch systems.
Everything You Wanted To Know About AI Security But Were Afraid To Ask | Watch the WebinarThis is why Cato rethought networking and security operations eight years ago by first solving the underlying architectural problems. The Cato SASE Cloud is a platform first, converging core security tools – SWG, CASB, DLP, RBI, ZTNA/SDP, and FWaaS with Advanced Threat Prevention (IPS, DNS Security, Next Generation Anti-malware). Those tools share the same admin experience and interface, so learning them is easier. They share the same underlying data lake, which is populated with networking data as well, providing the richest dataset possible for security teams to hunt for threats. The Cato platform is always current, protecting users everywhere against new and rising threats without overburdening a company’s security team.
Across that platform, Cato has been running AI and machine learning (ML) algorithms to make the platform even simpler and smarter. We combine AI and ML with HI – human intelligence – of our vast team of security experts to eliminate false positives, identify threats faster, and recognize new devices connecting to the network with higher precision.
Two New Additions to Cato’s Use of AI and ML
It’s against this backdrop that Cato has expanded our AI work in two important ways towards achieving the goal of the experience of enterprise security simpler and smarter. We recognize that security teams need to share their insights with other IT members. It can be challenging for security experts to summarize succinctly the story behind a threat and for novice security personnel to interpret a dashboard of indicators. So, we tapped generative AI to write a one-paragraph summary of the security indicators leading to an analyst’s given conclusion.
Story summary is automatically generated by generative AI.
We also wanted to find a way to identify and rank threats even faster and more accurately. We tapped AI and ML in the past to accomplish this goal, but today we are expanding those efforts. Using distancing algorithms, we identify similarities between new security stories with other stories in a customer’s account and across all Cato accounts.
This means that Cato customers directly benefit from knowledge and experience gained across the entire Cato community. And that’s significant because there’s a very, very good chance that the story you’re trying to evaluate today was already seen by some other Cato customer. So, we can make that identification and rank the threat for you faster and easier.
Story similarity quickly identifies and ranks new stories based on past analysis of other similar stories in a customer’s or third-party accounts.
A SASE Platform and AI/ML – A Winning Combination
The expansion of AI/ML into threat detection analytics and its use in summarizing security findings are important in simplifying security operations. However, AI/ML alone cannot address the range of security challenges facing today’s enterprise.
Organizations must first address the underlying architectural issues that make security so challenging. Only by replacing disparate security products and tools with a single, converged global platform can AI be something more than, well, window dressing.
For a more technical analysis of our use of Generative AI, see this blog from the Cato Labs Research team.