Lee Rossey is CTO of SimSpace, advancing AI proving grounds to help orgs prove cyber readiness.
By the time Captain Chesley Burnett “Sully” Sullenberger III successfully landed U.S. Airways Flight 1549 on the Hudson River after a bird strike took out both of the Airbus A320’s engines, he had almost 20,000 flight hours under his belt.
Yet even that much real-world experience couldn’t expose him to every emergency he might encounter in the air. He and his first officer, Jeffrey Skiles, saved the lives of the 155 people onboard that day after facing a combination of circumstances few pilots will ever experience.
That’s why pilots don’t prepare for emergencies through real-world experience alone. Flight simulators allow flight instructors to introduce dangerous scenarios in a risk-free environment during training so pilots are prepared if they ever encounter such situations in real life.
Cybersecurity professionals can learn a lot from this approach, especially as AI-powered attacks introduce never-before-seen variables or combine known attack methods in new ways. Just as pilots can’t prepare for the worst using only situations they’ve encountered during real flights, security teams shouldn’t prepare for the next attack based only on their knowledge of past attacks.
Historical Data Isn’t Enough For Training
Historical telemetry has long been a useful tool for security teams. Knowing the types of attacks that have occurred in the past can inform scenarios to test in a simulated environment and assess how well defenses hold up against them.
But historical data becomes more limiting when attackers are constantly learning new ways to circumvent defenses. That becomes even more true as AI expands the number of attack paths adversaries can explore.
Anthropic offered an early glimpse of this when it announced the first preview of Mythos and revealed it had identified decades-old vulnerabilities that had never been detected, such as a 27-year-old vulnerability in OpenBSD. The company also shared that Mythos chained four different vulnerabilities together to create a more complex exploit.
These examples, as well as what we’ve seen in the months since, illustrate a growing challenge for defenders. AI can explore combinations of vulnerabilities or techniques that defenders may never have anticipated, leaving organizations with little or no historical telemetry representing those attack paths.
Preparing both humans and AI systems for threats that don’t appear in existing datasets requires practicing preemptive security, an approach in which security teams investigate plausible adversary actions and prepare defenses before those actions are ever observed in production. That means asking not only what attackers have done before but also what they could plausibly do next, based on emerging techniques, vulnerabilities and changes in the environment.
Create The Data You Don’t Have
Historical security data is valuable precisely because it comes from real events, but that means defenders have to experience an attack before they can collect data from it.
An alternative is hyper-synthetic data, which is artificially generated security data representing plausible attack scenarios. A security team may understand how an emerging identity-based attack technique works but have no examples of it in its historical data. Instead of waiting for an attacker to provide the first one, the team can re-create environmental conditions, execute the attack and capture the resulting signals, such as authentication events, endpoint activity and network traffic.
They can then use the generated data to train security AI systems and give analysts the opportunity to understand key signals before an attack occurs in production.
Teams can also vary those scenarios by changing the timing, sequence or surrounding activity to see how these differences affect the outcome. For example, a detection may work when an attack follows an expected sequence but miss the same activity when the timing changes or individual actions occur in a different order.
Testing different versions of the same attack can help expose gaps in detection and response, giving security teams an opportunity to adjust their processes.
Encounter The Attack Before The Attacker
No amount of training could have re-created every detail Captain Sullenberger and his crew faced when Flight 1549 lost both engines after takeoff. But the first time the pilots thought through an emergency was before 155 lives depended on their response.
Cybersecurity teams should aim for the same advantage by using hyper-synthetic data to explore attacks they haven’t faced yet so they can determine how best to respond in real-life situations.
When security teams have that training and preparation, it’s less likely that an attacker gets to teach the defender something for the first time.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?