Stu Sjouwerman, the CEO of Clearwater-based cybersecurity unicorn KnowBe4, has an immediate concern for security in 2024: the breakneck speed at which artificial intelligence is being developed. It's hard to imagine, Sjouwerman said.
"The general population has no good visibility on the power of AI and how fast it is developing," Sjouwerman said. "This is what you call a strategic inflection point. ... We're living in the middle of it — this is an earthquake, a technology earthquake."
With Tampa Bay expanding as a cybersecurity hub, its leaders are expert voices in the industry. Sjouwerman and others from some of Tampa's largest cyber firms shared their biggest concerns and predictions for cybersecurity in the coming year with Tampa Bay Inno.
And the coming year won't be typical. If 2023 was a notable year for cybersecurity and tech, the Wall Street Journal describes the cybersecurity risks in 2024 as "2023 on Steroids."
Tampa Bay Inno pulled together these cyber-related considerations in the new year.
1) Artificial intelligence
AI technology is causing an inflection point for the world, Sjouwerman said. It's accelerating cybercrime and manipulation, and the technology will be "10 to 100 times" more powerful in 2024. Cybercriminals will soon be using it constantly, he said.
Phishing is still the main tool behind data breaches and ransomware infections, and AI serves to make the tool more efficient and sophisticated. The technology allows bad actors to reach a larger scale of influencing, manipulation and social engineering, Sjouwerman said.
Chad Loeven, a vice president at OPSWAT, said AI will be used to easily and quickly create credible fake identities and phishing sites, as well as break CAPTCHA and voice recognition. He's already seen "questionable LinkedIn invites" that seem to come from AI-generated profiles, he said.
On the other hand, generative AI will support security. It can help automate decision-making but more importantly, help build defense and detection protocols that work in real-time. Research on using generative AI against common cyberattacks, like ransomware or phishing, is a top focus for ReliaQuest, Chief Technology Officer Joe Partlow said.
"These are the more common attacks we see and are the ones that have the potential to spread the fastest, so having the ability to block or alert more proactively (as opposed to the reactive nation now) will be a big win for AI use cases," Partow said in a statement. "Bad actors being able to use AI for fast, automated attacks will be something we will definitely see in 2024, so we need to be able to counteract these attacks at the same speed and in real-time."
2) Industries and systems that will be most affected
Cybercrime affects everybody in some way. But Sjouwerman points to 2023 being a record year for attacks on U.S. hospitals.
Public and private entities housing private data will need to take greater precautions as cybercrime develops. Health care and retail spend less on cybersecurity than other industries, according to research from Ians Research and Artico Search. That means companies might need to take further caution going forward or find support in new ways, the WSJ reports.
Cybersecurity leaders also emphasize caution in supply chain security. The interconnected systems will become more vulnerable to cyberattacks, Edwards of OPSWAT said.
"Organizations will need to implement stricter cybersecurity measures for vendors and partners to mitigate the risk of supply chain attacks and remain compliant," Edwards said.
Cloud computing will also be a critical cyber battleground, Raj Samani, a senior vice president and chief scientist at Rapid7, wrote in a blog post.
"Combatting this threat requires more innovative solutions, such as those leveraging AI and advanced automation techniques — as well as heightened vigilance — in the cloud," Samani said in the post.
3) Regulation and best practices
Stephen Gorham, the chief operating officer of OPSWAT, points to regulation and responsibility as a big change in the coming year.
"Cybersecurity responsibility is going upstream in 2024 — boards and executives now have a higher expectation for not just the cybersecurity protection of their organizations but to fully understand the risks to their organizations and how they are actively mitigating them," Gorham said in a statement.
A recent ruling from the U.S. Securities and Exchange Commission against the chief information security officer of IT company SolarWinds underscores that shift, Gorham said. The company was charged with fraud in October. The instance of being held "criminally accountable for lapses in cybersecurity" shows the new approach and expectations the regulatory body considers — companies affected by cybercrime aren't always victims; they're negligent as the protector of investor dollars.
"Businesses are truly going to have to spend more time than ever determining their risk profile, and subsequently thinking about the tools and services that they will need to address the risks," Sabeen Malik, a vice president at Rapid7, wrote in the blog post.
4) Spending and insurance
Not only will companies need to spend more time considering cybersecurity protections, but they'll also be faced with securing insurance.
Cybersecurity insurance is now increasingly difficult to access; it costs more and coverage is sparse. The trend will only continue, Gorham said.
"With higher expectations and potential barriers to cyber insurance coverage, leaders will have no choice but to take cybersecurity seriously and not just as a 'check-the-box' exercise," Gorham said.
