How Cyberuptive Uses GenAI to Close the Cybersecurity Skills Gap

Trellix Wise for DLP Design Partner Program will enhance product collaboration and feature development.

By Chuck Lerch, CXO at Cyberuptive · November 18, 2024

After nearly 30 years in this industry, I've seen a lot. I got my start in this field at 17, working for a defense contractor back when industrial espionage was a big threat. The landscape has changed drastically since then. Today in cybersecurity, there are too many alerts, too few people, and investigations that take too long to complete.

Right now, AI is a major topic of conversation in cybersecurity. It's both a powerful ally and a looming challenge. For us in cybersecurity, the real question is how we can use Generative AI (GenAI) to close the skills gap and help our teams work smarter, faster, and more effectively so they can hunt threats and stay ahead of attackers.

You need GenAI that is more than a chatbot

At Cyberuptive, we've been using investigative tips through Helix Connect back when FireEye and Mandiant first developed it. When I think about the evolution of these tools, one thing stands out to me, you need a tool that is more than a chatbot.

SOCs need something that doesn't just offer answers, but provides the context and reasoning behind them, dramatically speeding up detection, investigation, and remediation. They need a virtual agent designed to guide analysts through the most complex investigations, helping them do their job better and faster.

Elevating analysts, speeding up growth

GenAI can help analysts grow faster and tackle tasks that once required much more experience. In fact, at Cyberuptive, our Tier 1 analysts can now operate at Tier 2 or even Tier 3 with the help of AI-driven insights.

In a typical SOC, new analysts might take a long time to build the proficiency needed to tackle advanced investigations. By walking analysts through investigative processes, GenAI isn't just doing the work for them—it's teaching them and connecting the dots in an expedited manner.

For example, instead of struggling to piece together disparate alerts, Trellix Wise helps them understand the patterns and indicators of compromise more intuitively. It's giving them the skill set of a seasoned analyst much sooner in their careers, which is incredibly valuable as we look to close the skills gap.

Combating burnout: from alert overload to efficiency

Let's talk about burnout. When your day is filled with thousands of low-priority alerts, it's easy to feel overwhelmed. GenAI helps alleviate this by cutting through the noise, correlating data, and surfacing only the most critical incidents that truly need attention.

When we implemented Trellix Wise, we saw immediate improvement in efficiency. And that's the key here—efficiency. GenAI automates repetitive tasks, like decoding malware or investigating alerts, saving us valuable time. In fact, it's already saved us hours on manual processes.

It has filtered out irrelevant information and helped analysts focus on the real threats, reducing their cognitive load by automating time-consuming tasks like malware decoding, freeing up our team to focus on high-value work—such as threat hunting and incident response.

Speeding Up Investigations and Incident Response

At the end of the day, speed matters. Every second counts when responding to an incident, and GenAI helps us burn down the haystack to find the needle faster.

By surfacing key insights quickly, our analysts can act rapidly, preventing incidents from escalating and mitigating risks more effectively. With enhanced visibility, analysts can spot potential threats that might have slipped through the cracks, connecting the dots and speeding up our incident response.

Gain the competitive edge with GenAI

Like every tool, there's a double-edged sword that cuts both ways. Attackers are getting faster, and you will be behind if you're not utilizing GenAI. It's not just about having AI—it's about making it work for you. GenAI is the competitive edge SOC teams need not just to keep up but also to get ahead. And the time to start is now, before the next major incident forces you to realize just how critical these tools have become.

At Cyberuptive, we're not just leveraging Trellix Wise and GenAI to uplevel our analysts; we're empowering them to better handle and understand tomorrow's threats.

Hear my conversation with Trellix CTO Ashok Banerjee and Trellix Director, Strategy & AI Zak Krider at the GenAI Powered Responsible Security Virtual Summit on demand.