AI makes cyberattacks easier for almost anyone

Artificial intelligence is making it easier for cybercriminals to find and exploit weaknesses in computer systems, Arnar S. Gunnarsson, director of security solutions at OK, told mbl.is.

He said companies were losing the time and advantage they previously had to update systems and fix vulnerabilities before attackers could exploit them.

“The speed of AI development enables cybercriminals to break into companies and steal data without extensive expertise,” Arnar said. “It is almost possible to say that Jón and Gunna down the street can now do this.”

Much easier to find vulnerabilities

Companies have generally had between 30 and 90 days to update their systems and address vulnerabilities after discovering them. That window is now disappearing because weaknesses are much easier to find and exploit, Arnar said.

Cybercriminals have long had an advantage because they are not bound by the same procedures involved in developing and implementing solutions. Companies are now also beginning to use AI for defence.

“The defences are finally able to deal with this. But fundamentally, we still need to change how our companies operate so we can use these new defences,” he said.

Trend already visible in Iceland

OK is already seeing this development in Iceland and sometimes receives four or five companies a week seeking help in responding to cyber intrusions, Arnar said.

Small companies are no less exposed than larger ones. AI has made it easier to identify businesses that have invested little in cybersecurity.

“If a small ice cream shop in the countryside has a sales system and an employee system but is perhaps not focusing on this, it is much easier to find it today using AI,” he said.

Arnar said Icelandic companies generally spend too little on cybersecurity and are therefore behind companies elsewhere in the Nordic region, Europe and the United States.

Many of the necessary defences are not expensive, he said, although the cost can still be a barrier for some companies. Protection for a company with seven to 10 employees currently costs around 12,000 to 15,000 Icelandic krónur per month.

Development measured in weeks and months

Arnar said cyber threats were developing much faster than previously expected.

“We previously expected this to take several years, but we are already seeing it happen. We are talking about weeks and months in this development. It has become that fast,” he said.

Despite the rapid development, he said the situation was not hopeless. Companies can take many steps to protect themselves, and there is no reason to reject the use of AI.

“We simply need to train people to use it safely and configure things correctly,” Arnar said.