## 2 Background and Related Work
### Background
#### 2.1.5 Generative AI in Cybersecurity  
Generative AI (GenAI) has emerged as a valuable tool for social engineering, mainly because large language models (LLMs) can understand and generate human-like language. This makes them useful for identifying potential victims of targeted phishing (spear phishing) and crafting convincing, personalized messages [27]. According to a recent report by the UK's National Cyber Security Centre (NCSC), AI is expected to enhance the social engineering capabilities of a wide range of cyber threat actors [28]. This includes state-sponsored hackers with advanced skills, organized cybercriminal groups with some limitations in resources, and even less-experienced opportunistic hackers.  
Since GPT-4 became publicly available in March 2023, there has been no noticeable spike in the discovery of new types of malware in the wild. This suggests that, while GenAI has potential, it does not yet have the technical ability or training needed to autonomously develop fully functioning malware. The NCSC supports this view, noting that AI in cyberattacks represents more of a gradual change in threat level, rather than a sudden, game-changing shift. It is also worth noting that not every cyberattack involves malware. In fact, 75% of the attacks detected last year did not use malware at all [29]. Instead, cybercriminals have increasingly focused on identity-based attacks--like phishing and social engineering--because they are often more effective and harder to trace. Improved antivirus tools, better platform security, and faster response systems have made traditional malware attacks more difficult and less appealing to sophisticated attackers.  
That said, there is still a chance GenAI could tip the scales back toward malware-driven attacks in the future. It is of vital importance to summarize how GenAI might one day be used to automate the creation of malware, discover software vulnerabilities, and shape the longer-term evolution of cyber threats.  
* Threat Intelligence and Adaptive Threat Detection: Generative AI refines threat intelligence by efficiently filtering vast data to prioritize organization-specific risks, reducing noise, and learning from interactions to detect anomalies, enabling rapid adaptation and clear AI-generated risk summaries [30].
* Predictive and Vulnerability Analysis: GenAI predicts future cyber threats and identifies critical vulnerabilities by analyzing past attacks, enabling organizations to prioritize high-risk areas, proactively strengthen security, and reduce exposure to potential exploits [31].
* Malware Analysis and Biometric Security: Generative AI enables researchers to create synthetic data and realistic malware samples, safely studying threat behaviors and enhancing biometric security, ultimately strengthening cybersecurity measures through controlled experimentation and analysis [32].
* Development Assistance and Coding Security: Generative AI assists developers by providing real-time feedback, promoting secure coding practices, and flagging risks early. It learns from past examples to prevent errors and enhance software security throughout development [33].
* Alerts, Documentation, and Incident Response: Generative AI streamlines alert management by summarizing complex data, improving clarity and response time. It helps cybersecurity teams prioritize threats accurately and offers actionable recommendations for effective risk mitigation [34].
* Employee Training and Education: Generative AI creates interactive training modules to educate employees on cybersecurity and protocols, reducing human error and strengthening organizational defenses by promoting awareness and adherence to security best practices [35].