Using generative
AI to strengthen
cybersecurity
How IT professionals can balance
its risks and rewards

kpmg.comExpectations for generative AI in cybersecurity
Companies have been using artificial intelligence (AI) tools, particularly machinelearning, in a growing number of functions and tasks. Generative AI, which
has robust natural language processing capabilities and can be used by nontechnical employees, promises to make AI significantly more accessible
and widely adopted—including in security applications. To better understandhow business and technology leaders are thinking about generative AI, in
March 2023 KPMG surveyed 300 global executives and senior managers
at companies of various sizes across industries. (We conducted a follow-up
survey in June and highlight notable differences where relevant.)
Respondents overwhelmingly viewed generative AI as a potentiallytransformative technology. Two-thirds predicted that generative AI will havea significant impact on their companies within the next three to five years;
31 percent anticipate high impact on enterprise risk management, including
cybersecurity, and 64 percent expect moderate impact. And in our June
survey, 81 percent of the 200 US respondents ranked generative AI as the
top emerging technology that will impact their businesses over the next
18 months.
More than 70 percent of information technology (IT) professionals say they
have prioritized cybersecurity application, and 63 percent say generative AIin cybersecurity will likely have the greatest impact on their organization; 64
percent expect to use generative AI in cyber in the next six to 12 months.
Business and IT leaders are also aware of the risks: 92 percent of respondents
said there will be moderate to high risks in implementing generative AI.
The No.1 risk cited was cybersecurity (54 percent), followed by privacy(53 percent), and liability (46 percent). But in the June survey, 77 percent ofrespondents said they had confidence in their ability to address and mitigate
the risks.

© 2023 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent
member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.

IT professionals have high expectations for generative AI

72%

Say that cybersecurity applications will be a toppriority for generative AI adoption

63%

See cybersecurity as the area of greatest potential
for generative AI

64%

Expect to implement generative AI applications in
six to 12 months

Using generative AI to strengthen cybersecurity2

IT/security executives are focused on risk
management
Respondents point to data privacy and cybersecurity, and uncertain regulatory
landscape among their top areas of concern:

23%

Data privacy andcybersecurity

24%

Respondents are moving quickly to strengthen
generative AI governance. In March, only 3 percent ofrespondents reported that they had mature responsible
AI governance in place, while in June, 46 percent said
they had implemented it:

Regulatory landscape

3%

46%

Professionals increasingly consider cybersecurity and personal data privacy aspriorities for risk management:

53%

62%

53%

Cybersecurity as a high priority

Privacy concerns with personal data asa high priority

But as professionals become more familiar with generative AI capabilities, they
are gaining greater confidence in their ability to mitigate risks:30%… considered risk
mitigation a highconcern in implementing
generative AI

28%… claimed theircompany has or will havea comprehensive risk
management approachto generative AI

77%… said they are highly
confident in theirorganization’s ability toaddress and mitigate
risks associated withgenerative AI

79%… of respondents who
deployed a generative
AI solution showed highconfidence in their risk
mitigation ability

Respondents also firmly believe data security and privacy credentials to be themost important capabilities when considering partnerships:

30%

34%

… were looking to collaborate
with external partners… considered data security and privacy
credentials as a key capability while partneringwith or investing in other companies forgenerative AI

Note: Findings are based on KPMG surveys on generative AI from March and June 2023; the comparative March survey data points are based on 225 US respondents.
© 2023 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent
member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.

63%

March survey

June survey

Using generative AI to strengthen cybersecurity

3

Opportunities for generative AI-enabledcybersecurity
Like other top leaders in their organizations, Chief Information
Security Officers (CISOs) are looking into how generative AI canbe effectively applied in their functions. While it is early days, we
see that the new technology shows promise in four areas:

11
Forensics andresponse

2
Security
operations

3
Identity andaccess4
Third-party
supply chain
management

Forensics and response

Threat detection and rapid response
One of the biggest challenges in cybersecurity is detecting and responding
to threats quickly and accurately. Generative AI can synthesize, interpret, andreport on large amounts of data from multiple different sources—network logs,
endpoints, and applications, for example. Where generative AI could reallymake a difference is its ability to rapidly gather and summarize data in response
to natural language queries.
The generative AI program can incorporate knowledge of a vast range of thirdparty application terms (such as error codes) as well as internal organizationspecific definitions and process protocols (such as how a “log-in” is definedor what signal constitutes a particular level of risk). It can access information,
research, and generate reports more efficiently, rapidly, and accurately than
any manual method, freeing analysts to further interpret data, drive better© 2023 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent
member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.

responses, and improve security. A human with experience, intuition, andinsider knowledge is still essential for picking out hard-to-detect anomalies.
But generative AI provides a huge head start.
In addition, generative AI can be used for alert triage. For example, based on
past incidents, a generative AI application could create a predefined checklist
that an analyst could review before deciding the best course of action. And theapplication could function as a security advisor, pointing out how such threats
have been dealt with in the past by others, whether inside or outside theenterprise. Finally, generative AI could be used to validate manual responses.
It is already being integrated into leading endpoint detection and response
technologies that largely automate the efforts of security operating center(SOC) analysts.

Using generative AI to strengthen cybersecurity

4Phishing and fraud prevention
Generative AI can analyze and screen points of entry, such as emails, toidentify and flag suspicious patterns, including unusual sender addresses orcontent that includes signals suggesting that they are not authentic. Generative
AI can also analyze user behavior and detect fraudulent transactions in realtime. Another application could be analyzing accounts payable records toprevent unauthorized payments.

Insider threat detection
Generative AI can be used to monitor employee behavior and report anomalies
that may indicate a potential insider threat. By auditing and quantifyinguser activity, such as login times, file access patterns, and network activity,
generative AI can learn what is normal for each user or class of user, anddetect and flag any unusual behavior that may indicate a threat.

2

Security operations

Vulnerability management

Attack surface management

Various AI methodologies can be deployed to identify vulnerabilities in softwareand systems through which cybercriminals can gain access. Generative AI canthen add value as a digital advisor on the best ways to respond. For example, if
a vulnerability ticket is assigned for remediation, you may rely on vendor tools
to identify appropriate fixes, patches, or configurations to their applications.
But what is often missing is the organization-specific context—what groups
must provide approval? Is there a designated URL destination for generating
an exception request? Which internal team should be engaged based on thelocation of the vulnerability? Generative AI can function as a chat bot advisor,
capable of adding the organization-specific content to the vendor details,
bringing all the pertinent internal and external signals together in a prescriptive
way. It can thereby recommend tailored best-practice remediation steps.

Monitoring the perimeter—firewalls, web servers, transactions within the
publicly accessible cloud, and so on—is a huge and constantly changing
challenge. Generative AI can be deployed to parse structured data sets, reporton what is included in the perimeter surface, identify the biggest potential
surface threats, and assess the degree of risk in the attack surface at any given
time. Generative AI can be used to establish a baseline and flag what haschanged. It can also determine what information is lacking to help identify andfix external vulnerabilities, misconfigurations, and other weaknesses.

© 2023 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent
member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.

Using generative AI to strengthen cybersecurity

5Metrics, dashboards, reporting
Generative AI can be very useful in turning data into insights. A risk analyst,
for example, can write a prompt such as: “What are the three areas thathave changed in my environment this week from last year at this time?”; or“Is my risk posture improving?” Generative AI can then compile internal andexternal information to provide the update as well as recommendations andguidance. For example, it could compare how the company performs event
logging with best practices published by the National Institute of Standards
and Technology and identify gaps. It can also identify which security tools

are missing (according to industry best practices) and recommend where toinvest in new tools. It can answer questions about performance over time,compare performance over specific intervals, and generate a monthly CISO
scorecard. Overall, generative AI can serve as a security advisor for detection
and response to cyberattacks or cyber incidents, and make recommendations
for improving processes. Finally, generative AI can help create dashboards withgraphical interpretations of data for rapid assimilation of information and cangenerate reports synthesizing data from multiple internal and external sources.

3 Identity and access
Least-privilege security

Identity protection

Least-privilege security ensures that access to systems is limited to individuals
doing a particular job at a particular time. Despite significant investment,
least-privilege provisioning remains largely manual, highly discretionary, fairly
static, and not well monitored. Generative AI has the potential to automate
this process. For example, a governance platforms with generative AI could betrained on large models to assess job function, title, physical location, etc. toestablish the baseline for preliminary provisioning, amended provisioning, or
deprovisioning access by individual or class. Behavior anomalies can be flagged
for human intervention and follow-up. Security teams can now manage accessprivileges for tens of thousands of identities, across hundreds of applications
and multiple types of access, and implement continuous access management
on a huge scale.

Impersonation and other misuse of digital identities can be forestalled throughgenerative AI applications that research and report patterns of behavior,
identifying signals that point to fraud and even specific types of cyberattacks
or vulnerabilities. Suspicious behavior and anomalies in normal patterns ofengagement can be flagged for investigation.

© 2023 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent
member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.

Using generative AI to strengthen cybersecurity

6

4 Third-party supply chain management
Inherent risk profiling
Organizations may do business with thousands of third-party providers—security program providers among them—potentially sharing sensitive datain the process. To ensure that their organization is protected from third-party
risk it is essential to understand the risk posture associated with any supplier,which has been a cumbersome and time-consuming task. Due to time andbudget constraints, security teams typically have created robust security
profiles for a small share of partners.
With generative AI automating the process, companies can go back andperform risk assessments on all partners and use the tool to vet new ones.
Additionally, security and risk profiles that have been deemed satisfactory canbe extrapolated to create security checklists for future profiling as well as toinform contractual terms and conditions for engagement.
Ongoing risk management
Generative AI tools can be used to monitor compliance with agreed security
protocols, the status of any required mitigation strategies, and the impact ofchanges that alter the risk profile. Has the supplier suffered a breach? Is apartner being acquired? Are its platforms undergoing significant alteration?
Have they added new technology partners? All these what-ifs affect the risk
profile and compliance. Automated, ongoing due diligence can track what ischanging with every vendor in the supply chain and assess potential risk. In
our June survey, those who had already deployed generative AI solutions had agreater confidence in their ability to mitigate risk.

© 2023 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent
member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.

Using generative AI to strengthen cybersecurity

7

Barriers to adoption
While the promise of generative AI technologies is persuasive, CISOs andother business leaders recognize the significant barriers to its adoption. As arelatively new technology, there are many unknowns. The biggest concerns at
this early stage are exposure of proprietary and customer data, loss of control
of intellectual property, inaccurate results, and intentional—even criminal—misuse—to produce deepfakes to commit fraud, for example. As generative
AI tools and applications are adopted widely across the organization, therisks multiply. Responsible use of AI, clear guidelines and governance, andaccountability are essential—and CISOs can play a part in making sure theguidelines are understood and followed.

Secure a safe start
KPMG has identified five steps for successful deployment of generative AI
applications for cybersecurity (once the overall strategic approach has been
determined). Following these can help ensure that the organization derives themost value from generative AI investments.

As we have shown, generative AI will likely have many applications incybersecurity. We believe that CISOs that use generative AI to improvesecurity processes will have an opportuniuty to better protect theirorganizations. However, the benefits of being an early adopter must be
weighed against the risks and unknowns.

1

Align on specificuse case(s)Define desired outcomes ofthe pilot and prioritize specificarea(s) of focus

2

Gather relevant
data

Identify relevant data sourcesand validate that threat datais accurate, complete, and up
to date3

Train the model

Train the AI model(s) tounderstand the data andperform the desired analysis
and tasks© 2023 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent
member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.

4

Test and refine

Test performance and refinealgorithms by comparing
outputs to those of humans
or existing analytical models

5Integrate, monitor,and scaleIntegrate workflows via APIs,
monitor performance, andevaluate opportunities to scale

Using generative AI to strengthen cybersecurity

8

How KPMG can help
KPMG can help you apply the five-step approach to get your generative AI implementations off to a sound start and fine tune initiatives alreadyunderway. We understand the multidimensional security challenges faced by enterprises across their technology, people, processes, and partners.
Our teams of technology professionals are skilled and experienced with a diverse array of leading technologies, platforms, and modern development
practices, including generative AI applications, data science, and cybersecurity. We are well-versed in the organizational changes that are required to
extract maximum advantage from generative AI while protecting against its potential downsides. And we can help curate risk mitigation initiatives fromconceptual solution to deployment roadmap, providing a nonstop solution for cyber resiliency.
Whether it’s helping you lead a cybersecurity, business continuity, or digital transformation, KPMG creates tailored, data-driven solutions that help you
safeguard security, deliver value, drive innovation, and build stakeholder trust.

Contact us

Matt Miller

Katie BoswellPrincipal, Advisory
Cyber Security Services
matthewpmiller@kpmg.com

Managing Director, Advisory
Cyber Security Services
katieboswell@kpmg.com

Jim Wilhelm

Douglas LaGore

David Nides

Principal, Advisory
Cyber Security Services
jameswilhelm@kpmg.com

Principal, Advisory
Cyber Security Services
dlagore@kpmg.com

Principal, Advisory
Cyber Security Services
dnides@kpmg.com

Ryan Budnik

Brian Marks

Diana Keele

Director, Advisory
Cyber Security Services
rbudnik@kpmg.com

Director, Advisory
Cyber Security Services
bjmarks@kpmg.com

Director, Advisory
Cyber Security Services
dkeele@kpmg.com© 2023 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent
member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.

Using generative AI to strengthen cybersecurity

9

Related thought leadership:

Learn how KPMG can help make your generative AI implementation successful, and explore how we
can help you adopt AI in a safe, trustworthy, and ethical manner.

Some or all of the services described herein may not be permissible for KPMG audit
clients and their affiliates or related entities.
The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity.
Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it isreceived or that it will continue to be accurate in the future. No one should act upon such information without appropriate professional advice after
a thorough examination of the particular situation.
© 2023 KPMG LLP, a Delaware limited liability partnership and a member firm of the KPMG global organization of independent member firms
affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.
DASD-2023-12932.
August 2023

kpmg.com/socialmedia