Artificial intelligence is lowering the barriers to entry to high-level cybercrime and helping bad actors launch sophisticated attacks at scale. In fact, AI-assisted cyber-attacks have increased by 56% according to IBM.

But it's not all bad news. Enterprises are also using AI themselves to protect against these growing threats. IBM's own use of AI to enhance mainframe security is helping it improve vulnerability discovery, allowing it to identify twice as many software vulnerabilities between Q1 and Q2 of this year. Over the same period, it also used frontier large language models like Anthropic's Mythos to remediate three times as many vulnerabilities.

IBM presented this data in a recent webinar, Detect Faster, Respond Smarter: Secure the Core in Frontier AI Era, featuring Bryan Childs, principal product manager for IBM Z Security.

Bryan explains how powerful frontier AI models are now reshaping cybersecurity, highlighting key ways in which enterprises should adapt their security strategies to keep pace with the proliferation of threats. He also covers the key features and benefits of a new threat management solution, IBM zSecure Detection, designed to help mainframe customers expand and strengthen threat detection and response in the AI era.

With October being Cybersecurity Awareness Month, here are five key learnings from the webinar.

1. Use AI to fight AI

Since bad actors are now using AI to accelerate cyber-attacks, enterprises can no longer continue to rely on traditional manual security processes, such as sending out patches manually days or months after vulnerabilities have been discovered; performing manual compliance fixes after failed audits; or remediating cyber vulnerabilities only after those weaknesses have already been exploited.

In fact, many IBM z/OS customers are already shortening the time to respond to cyber threats by using AI and automation. Bryan mentions a global retail, commercial, and investment bank that is reducing security patch development timelines from months to days, and a wealth-management firm using AI and automation to shrink the time to review and prioritize vulnerabilities from days to minutes.

In the future, enterprises need to move toward continuous threat management, including autonomous patching to prevent future risk, and security policies that are continuously enforced and validated rather than relying on periodic compliance checks or audits.

2. Assume every user ID is a potential threat

When considering insider threats, an enterprise's biggest concerns would have traditionally revolved around the risk of employees with legitimate privileged access to internal systems or data (such as someone on the IT team) either maliciously exposing or stealing sensitive information or facilitating a ransomware attack - or being tricket into doing so.

But with AI, it's now even easier for cyber criminals to compromise anyone with a user ID to engineer a privilege-escalation exploit, giving them unauthorized access to confidential data. Moreover, there's the worrying possibility that any user with malicious intentions could become an insider threat by using generative AI to perform activities that previously required specialist security expertise.

Strong authentication of user IDs therefore becomes even more important, as does granular monitoring and control over who can access specific information and systems, something RACF has supported on z/OS for many years.

Organizations also need to stick closely to the principle of least privilege, meaning users' access rights should be restricted to only the information and resources they need to perform their job - and nothing more. At the same time, be aware of 'privilege creep', which can happen when users accumulate broader access to resources than their current role requires because their job and responsibilities have evolved over time while their permissions have not been updated accordingly.

3. Monitor abnormal behaviour assisted by AI

It's impossible to predict what the next attack will look like or where it will come from. But it is possible to detect abnormal activity that could indicate that something suspicious is going on.

Bryan emphasizes the importance of using AI to monitor and analyze the IT environment for anomalous behaviour that could indicate an attack. Everything from unusual network traffic flows, user access patterns, privilege escalations, system and file integrity, and more should be tracked, he suggests.

Why is a particular user who normally accesses a relatively small amount of information suddenly reading huge volumes from a sensitive dataset? Why are changes being made to files and systems outside of a designated patch window? And why are access privileges for a specific user being escalated?

Any of these could be an early warning of an unfolding attack. For mainframe customers, the new zSecure Detection uses AI and machine learning to monitor activity that could be a threat.

4. Reduce the gap between detection and containment

It's all very well detecting normal activity, but the speed of AI-assisted attacks means that security teams now must be able to react immediately. What's the point of detecting a fast-moving attack if the alert then sits in a queue for hours? As the attack window shrinks, the gap between detection and action needs to shrink too.

Which is why, when systems like IBM's zSecure Detection detect abnormal activity, they can now be configured for automated containment. This includes suspending jobs that are deemed to be suspicious or restricting a user ID's credentials while the security team diagnoses exactly what is happening. If the issue turns out to be legitimate activity, the containment actions can be reversed.

The key point is that monitoring and tracking must be tied to clearly defined, rapid responses, ideally in near real time. It is no longer helpful to simply send out alerts that can sit in a backlog until someone notices. The faster a problem can be detected and contained, the greater the chance of minimizing damage.

5. Security and resiliency must now be closely connected

Preventing every possible attack is very likely impossible now. Enterprises can spend heavily on firewalls, endpoint security, patching, encryption, authentication and more - but with bad actors increasingly using sophisticated AI, it is very likely that some attacks will still get through.

Which is why enterprises today should aim to prevent what they can but also to ensure preparations are in place to withstand whatever gets through, and to recover quickly so the business can continue operating.

Measures to stop ransomware attacks would be labelled 'prevention', while ensuring the enterprise has access to clean protected copies of critical data - using data snapshots, immutable backups, versioning and point-in-time recovery - to restore data and operations quickly would be labelled 'resiliency'. Enterprises today need to be developing both and ensure they are closely coordinated and operate in sync.

This blog was originally published on the IBM Community.