How IBM’s new AI assistant is taking cybersecurity to the next level

IBM’s latest advancement in cybersecurity technology promises to transform how security threats are managed and mitigated. The tech giant has introduced a cutting-edge generative AI capability to its managed Threat Detection and Response (TDR) Services, aimed at bolstering the efficiency and effectiveness of IBM Consulting analysts in safeguarding clients against cyber threats. This new development, built on IBM’s watsonx data and AI platform, is set to accelerate and enhance the process of threat identification, investigation, and response.

Enhanced Threat Detection with Generative AI

IBM’s new Cybersecurity Assistant integrates generative AI technology into its existing TDR Services, enabling IBM Consulting’s security experts to streamline operations and improve client security outcomes. This assistant is part of IBM Consulting Advantage, the company’s AI services platform, which focuses on delivering consistent, high-quality, and rapid solutions to clients.

Mark Hughes, Global Managing Partner of Cybersecurity Services at IBM Consulting, highlighted the challenges faced by security teams in the modern threat landscape. According to Hughes, cyber incidents are evolving into complex, multi-dimensional events, putting a strain on security resources. The introduction of generative AI aims to alleviate these pressures by reducing the need for manual investigations and operational tasks, thereby allowing analysts to focus on proactive and precise threat responses.

Boosting Efficiency with Historical Correlation Analysis

The new Cybersecurity Assistant enhances threat investigations through advanced historical correlation analysis. By examining past threat activities and cross-referencing alerts from various sources such as SIEM, network, EDR, vulnerability, and telemetry, the assistant provides a comprehensive approach to threat management. This integration helps security analysts become more proactive, offering a timeline view of attack sequences and auto-recommending actions based on historical patterns. The result is a reduction in alert investigation times by 48% for some clients, ultimately leading to quicker responses and reduced dwell times for attackers.

Revolutionising Operational Tasks with Conversational AI

A key feature of the Cybersecurity Assistant is its advanced generative AI conversational engine. This component offers real-time insights and support for operational tasks, responding to client and analyst requests with efficiency. The conversational engine can open or summarise tickets, execute queries, pull logs, and enrich threat intelligence. By clarifying complex security events and commands, it reduces operational noise and enhances the efficiency of Security Operations Centres (SOCs).

Craig Robinson, Research Vice President for IDC’s Security Services Research Practice, praised IBM’s advancements, noting that businesses will benefit from a technology that continuously learns and adapts from specific security environments. This dynamic learning process enables more accurate and rapid threat investigations, which is critical given the current shortage of security resources and the increasing number of vulnerabilities.

A Collaborative Development

Developed in collaboration with IBM Research, the IBM Consulting Cybersecurity Assistant leverages IBM’s generative AI capabilities. The assistant is based on IBM’s Granite foundation models, integrated into IBM watsonx.ai, and utilises IBM watsonx Assistant for its conversational interface.