AI Matters: Hammers & Nails
Ever heard the old adage, "When all you have is a hammer, every problem looks like a nail"? It pops into my head every time I have a conversation about using AI (the hammer) to solve problems in cyber operations (the nails). Don't get me wrong, I am stoked by the potential of Generative AI (GenAI). The buzz is contagious. In some ways, it feels like we are living in a modern Renaissance. A fountainhead of creativity, experimentation and insight, if you will. However, I am also a weathered practitioner and aspiring curmudgeon who knows there is no such thing as a silver bullet. Responsible AI is not easy or cheap, full stop!
Shouts out to Chris Roberts, as this post was inspired by a conversation we had, and this line from his recent LinkedIn post positing: "Do we need AI to solve our problem? If so, why?"
To that end, I've compiled a short list of observations and possible approaches you should consider when determining if using AI will actually solve a problem — or create new problems to solve.
Intertia and status quo
In my experience, most organizations struggle with the fundamentals. Once they find a path that "works," they resist change because it's "good enough." #statusquo. This line of thinking is unfortunate because it means people lose their ability to imagine the world of possibilities; it builds a perceptual blind spot for seeing better alternatives.
Improving the fundamentals is always a good thing. Incremental changes are often more valuable than "big bang" projects or transformations that take months or years to complete. Optimizing existing workflows as a normal practice can yield more benefit/value at higher frequencies. However, you must proceed with caution, as the way to fail at scale is to automate a broken business process. Please don't make that mistake.
It takes a village
The key to creating a pipeline of cyber operations optimization candidates (aka innovations) is to understand the "wicked problem" you are trying to solve. I mean really understand it. You should be able to explain it to a 12-year-old or an executive. If you need to role play that conversation, this would be a good time to confer with your favorite chatbot. [Insert Prompt Here: "Explain to me as if I am a 12-year-old why passwords are important but not executive friendly."]
Next, you will need to identify your core stakeholder community. Three to five stakeholders will typically give you the perspectives needed to find critical mass and, more importantly, governance and resourcing support. You need to understand what motivates your key stakeholders, what they value and how they are graded. Ensure your innovation candidate selection criteria and KPIs resonate with your stakeholders, and your stories are tailored to them. Make it real to them when describing the possibilities of a new approach. Be disciplined and ruthless once selection criteria are agreed upon.
Move quickly with purpose. Don't get distracted with "bright shiny things" that do NOT align with your selection criteria. Each use case should tell a story that appeals to at least 75 percent of your stakeholder community. Less than that and inertia will make it too hard to realize value in a timely manner. Move on quickly without regret from candidates that do not make the cut; there should be a continuous pipeline of other opportunities to be reviewed.
Latent capabilities: Take the easy wins first
Once you have a vetted pipeline of innovation candidates, it's time to determine if you can extract incremental value using the AI features or embedded capabilities already in place. This is most easily accomplished by looking for keywords like BIG DATA, Behavioral Analysis, Machine Learning, Neural Network, LLM or (Generative) AI. It's very likely you have been using AI-enabled tools already. If so, how are they performing? If they are available but you aren't using them, why not? Of course, if capabilities were available and you weren't aware of them or there are commercial considerations, then we need to quickly determine what level of effort is needed to implement. If it doesn't pass the sniff test, move on to the next candidate. Leverage your suppliers to educate but temper their claims with real-world testing and assessment.
What's next?
Look for opportunities to integrate, optimize and automate at scale for operational improvement, which could include AI force multipliers such as security co-pilots, organizationally aware GPT agents or automated hackbots. We will look at these use cases in future blogs.
So, do we need an AI to solve our "wicked" problems? The simple answer is probably not. However, there are "wicked" problems that AI can address and you should be looking for those opportunities too. Because AI matters. Stay tuned.