There are too few aspects of modern progress that have remained unaffected by the spread of AI in the last few years. The technology is no longer experimental, but sufficiently advanced to take center stage in the ongoing digital transformation. Generative AI is sparking a new phase in the development of intelligent systems because, unlike other types of AI, generative AI is actually specialized in creating new content, helping to generate ideas and strategies.

Naturally, the models are limited by the volume and type of information they are trained on, but the coined term “creative modeling” actually describes the capabilities of generative AI extremely accurately^[1]. The consequences are diverse, which is true for a number of technologies. In the context of cybersecurity, generative AI is already widely used in malicious activities on the internet, while for the needs of cyber defense, ways for secure mass deployment are still being sought.

In this sense, this subchapter aims to reveal the specifics of generative AI and to outline the ethical dilemmas, risks, and functionality of the technology in the context of the concept of cybersecurity. The historical path of AI, as an avant-garde technology, is clearly traceable, and the periods of its evolution are distinguishable.

Even in the earliest stages of AI development, the technology found applications in terms of security, as its role in the analysis of encrypted texts during the Second World War and the cracking of the “Enigma” code can be pointed out. Nowadays, AI is gaining widespread use both in defensive and malicious activities without the need for significant resources and technological skills. It is necessary to examine the existing definitions of AI to clarify the essence of the technology.

History recognizes Alan Turing as one of the most important pioneers in the creation of AI and the foundation of computer science. In 1936, Turing defined the abstract “Turing machine,” which performs computational operations based on set rules, and through which the same calculations performed by modern computers can be carried out. During the Second World War, Turing applied his discoveries to the analysis of encrypted text and automated the decryption of messages encoded with “Enigma.” Thus, he was able to take advantage of the superiority of computers over human speed and accuracy in complex intellectual tasks.

In 1950, the mathematician raised the question “can machines think?” and proposed an experimental framework through which to conduct a check, known as the “Turing test”^[2]. The essence of the test consists of conducting a conversation using natural speech between a human evaluator and an unknown participant, who may be a machine. If, during the test, the evaluator cannot definitively distinguish whether they are contacting a human or a machine, it is considered that the machine exhibits intelligence. This criterion for “intelligence” is set out in Turing’s article “Computing Machinery and Intelligence,” in which the author additionally hints at fundamental ideas regarding AI that find manifestation at a later stage.

One of the ideas is that machines could learn from past experience, mentioning the concept of a “child machine” that would be educated and trained over time. Such an insight at that time, that the ability to learn is as necessary as logical reasoning for the presence of intelligence, was an early signal that machine learning is possible at all^[3]. The aforementioned two Turing discoveries—the “Turing machine” and the “Turing test”—reveal the enormous potential of the new technology and the new horizons that a number of scientists at the time were embarking upon. The practical proof of the idea that machines are capable of reproducing cognitive functions typical of humans was the catalyst for the creation of the multidisciplinary and multi-vector science of AI, and Alan Turing earned the recognition as its foundational figure.

The speed at which AI is developing requires the finding of a coherent and meaningful definition that will not cause misunderstanding and ambiguity over time. A precise definition of AI, however, continues to be sought due to the growing spectrum of new capabilities, the continuous discovery of additional applications, and different philosophical interpretations.

For the purposes of this monograph, it is extremely important to derive a clear working definition. In this regard, it could be noted that AI is the ability of machines to perform activities typical of human intelligence. Such a formulation does not contradict already made attempts to point to activities such as reasoning, learning, problem-solving, perception, and speech understanding^[4], as typical of the presence of AI.

In 2021, the European Commission derived its own definition of AI, defining it as a program that can generate content, make predictions, provide recommendations, etc., after certain goals set by a human factor have been provided^[5]. The common thread among the diverse definitions of AI is that they concern an attempt to replicate cognitive activity typical of humans through machines, but one must keep in mind the broad-spectrum purpose of existing models at this moment. Their activity can involve the execution of simple instructions or the generation of complex end results requiring the existence of autonomous systems.

An observed trend in the development of the technology is increased complexity with a reduced need for human intervention, for which machine learning and deep learning can be cited as examples. In these cases, the models adapt their behavior according to available datasets without human configuration.

Of course, the question may arise here as to what distinguishes conventional computer calculations from AI? The differences are significant and include autonomy, adaptability, ability to generate results, and others. The latter is particularly important for generative AI and makes possible the dual-use of the technology, which has already entered activities such as diagnosing in healthcare, improving transportation systems, and strengthening some activities in cybersecurity.

The reverse is also true, because the use of generative AI as a weapon in cyberattacks and disinformation campaigns is already widespread. It is precisely this duality that necessitates accepting AI not only as a tool but also as a strategic capability with possible profound consequences for digital security. Understanding these fundamental features of the technology is necessary for a better understanding of its emerging role as a catalyst for opportunities, but also as a bearer of risks and a vector for attacks in the contemporary digital environment.

Subscribe now

Share

^[1] Goodfellow, I., Bengio, Y., & Courville, A. (2016). Deep Learning. MIT Press.,

https://www.deeplearningbook.org/

^[2] Turing, A.M. (1950) ‘I.—COMPUTING MACHINERY AND INTELLIGENCE,’ Mind, LIX(236), pp. 433–460. https://doi.org/10.1093/mind/lix.236.433

^[3] Muggleton, S. (2014) ‘Alan Turing and the development of Artificial Intelligence,’ AI Communications, 27(1), pp. 3–10. https://doi.org/10.3233/aic-130579

^[4] Russell, S.J., Norvig, P. and Davis, E. (2010) Artificial intelligence: A Modern Approach. Prentice Hall., https://people.engr.tamu.edu/guni/csce625/slides/AI.pdf

^[5] European Commission, (2021), Laying Down Harmonised Rules On Artificial Intelligence (Artificial Intelligence Act) And Amending Certain Union Legislative Acts, Article 3, 1, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52021PC0206 (accessed 06.05.2025)

Cybersecurity practices are a consequence of already discovered threats, prescriptions for mitigating the consequences of attacks, and restoring systems after breaches. This hitherto non-alternative approach puts organizations in a permanent defensive position and leaves the initiative to malicious actors. Widely used tools at the moment, such as firewalls, antivirus programs, intrusion detection and intrusion prevention systems, work against already known malware and indicators of compromise. In such a case, an adequate response to protect systems often comes after hackers have already established unauthorized access to networks.

Generative AI shows potential to shift this paradigm and place cybersecurity practices in a proactive context, establishing itself not only as an important tool but also as an active autonomous participant in the processes of analysis, prevention, and forecasting of risks and threats. This new role of generative AI is implemented in three main steps, and its integration successfully complements current cybersecurity practices without replacing them:

- From detection to prediction: through the rapid processing of large data sets using large language models (LLMs), cyber systems are capable of running scenario simulations and predicting attack probabilities, thus enabling rapid correlation between hidden indicators of compromise.

- From asset protection to knowledge and asset management: security is no longer just a collection of technical controls and sequential steps to be followed under predetermined circumstances. It is now sought through a flexible and intelligent system for high-speed data processing and context-aware analysis with automated tools for rapid decision-making.

- From human reaction to machine collaboration: AI does not replace human expertise, but rather multiplies its interpretation capabilities and frees it from repetitive routine tasks.

The aforementioned transition does not have only technical dimensions. It is accompanied by organizational and ethical dilemmas and requires expert preparation for building a predictable and secure cybersecurity system, assisted by AI. The change requires a fusion of already established system elements, such as cyber intelligence, machine learning, and strategic risk management. Thus, this activity can evolve into an offensive one and be carried out simultaneously by a human factor and AI with clearly distinguishable roles.

The ability of AI to process vast amounts of data transforms cybersecurity into a dynamic self-learning system, the essence of which is to continuously change its approaches according to the incoming flow of information. With the help of AI, cybersecurity activities shift from the position of a last line of defense to the vanguard of the digital battlefield. All this, however, does not come without risks, some of which will be discussed in the following pages.

Subscribe now

Share

Modern understandings of cybersecurity are based on concepts and practices systematized over decades. They are the result of an upgrade aimed at reflecting the rapid changes in technology and the methods used to commit cybercrime. The internet, constructed as an open system for the free exchange of information, was not created with a priority on security. The need for security in cyberspace, however, became apparent almost immediately.

The first malicious actions following the free distribution of the internet to users were documented in the 1980s. The nature of these actions illustrates that online security is not a one-time act and an established state, but an insecure balance requiring constant effort. The emerging need for a systemic approach to digital security is at the heart of the many modern rules, policies, and guidelines recommended and imposed by governments, international institutions, and expert organizations. The principal requirements underlying cybersecurity have a universal character, and their knowledge and application mark the boundary between relative security and potential losses.

With new technologies and circumstances, the principles of cybersecurity are also undergoing dynamic changes. They are not a static property[1], but their development is occurring to some extent with insufficient speed and efficiency. The lightning-fast entry of AI into almost all spheres introduces its own specificity to the qualitative changes in cybersecurity practices. They cease to be merely an escalating set of technical standards and take on the role of ethical and strategic guidelines. Through them, answers are sought to the dilemmas caused by automation with the spread of AI. In this chapter, the main principles of cybersecurity and their change caused by generative AI will be analyzed.

Confidentiality, Integrity, and Availability (CIA) of information are the cornerstone of the modern understanding of cybersecurity. Violating any of these states of information would mean compromise and losses. They are important because they reflect a specific state, imperative for digital security, where information is a primary asset and its protection is a priority. Confidentiality concerns protecting information from unauthorized access and ensuring it is available only to subjects with appropriate access rights. Integrity concerns the completeness of information, which can only be modified by authorized subjects according to prescribed rules. Availability should ensure access to information at any time when needed by those authorized to access it.

The three principles are an indivisible whole in the context of cybersecurity, where there is a wide range of measures to protect them from traditional and asymmetric threats. The emergence of generative AI, however, has introduced new uncertainty into cyberspace. Regarding the principle of confidentiality, it has been established how generative AI models can reproduce confidential information with which they have been trained[2]. Furthermore, generative AI exerts pressure on guaranteeing integrity due to the ability of models to create program code, images, and information indistinguishable from the original.

This makes possible the rapid spread of false information that penetrates official channels and causes confusion. Such risks provoke proposals by some authors for the introduction of so-called “trust chains” through which to algorithmically track the sources of any information[3]. Information availability is a particularly vulnerable and attackable circumstance, because through generative AI numerous vulnerabilities can be exploited for the purpose of taking down sites or databases. Some of the example methods are blocking access to information via DDoS[4] attacks and writing malicious programs.

In this regard, the National Institute of Standards and Technology (NIST) recommends dynamic risk management related to safeguarding the security of the CIA triad[5] and applicable against threats stemming from the misuse of AI. Generative AI poses new challenges to the CIA triad, but simultaneously underscores its importance and relevance, and provokes the development of new protection methods. This principle remains fundamental in the effort to increase cybersecurity and serves as a basis for the development of physical infrastructure, which is the focus of the analysis in the next principle.

Subscribe now

[1] ENISA, Best Practices For Cyber Crisis Management, February 2024, https://www.enisa.europa.eu/publications/best-practices-for-cyber-crisis-management

[2] ENISA, ENISA Threat Landscape 2023, October 2023, p.83 https://www.enisa.europa.eu/publications/enisa-threat-landscape-2023

[3] Whitman, M. E., & Mattord, H. J. (2009). Principles of information security (p. 656). Boston, MA: Thomson Course Technology.

[4] Distributed Denial of Service

[5] NIST, Artificial Intelligence Risk Management　Framework (AI RMF 1.0), January 2023, AI Risk Management Framework | NIST

The expectation that if the unipolar model were replaced, international harmony and a “just” order would prevail in its wake is deeply flawed and cannot serve as an argument in the analysis of international relations. Regardless of whether we are dealing with one, two, or multiple dominant powers, international relations retain their principles as a whole. Drawing a parallel with history, a multipolar model would mean an extremely tense and volatile system in which four or more equal actors would dominate certain regions, view each other with suspicion, and constantly test each other’s intentions and readiness to defend their interests.

Subscribe now

Medium and small states would fall, voluntarily or not, under the influence of one of these powers, and thus their relations with the others would be incomplete. The competition between the great powers would be clearly visible in all aspects of international relations, including within international organizations, and the risk of confrontation would be increased. A multipolar order does not mean understanding and harmony, but confusion and disagreement—an order in which several Great Powers would constantly seek ways to gain superiority over the others and expand their sphere of influence. This might still lead to containment among a few of them, but “containment” does not at all mean an absence of confrontation. The clearly visible power hierarchy in the unipolar model is the primary factor that makes it more stable compared to the multipolar alternative, which has not yet arrived, if it happens at all.

The opinion that America and the West are in decline along with the unipolar order is highly reminiscent of Fukuyama’s claim about the “end of history,” but with a reversed sign. Both claims are equally wrong precisely because history does not end, and the US and the countries under its leadership have not ceased to exist. The economic crisis of 2008, the two wars of the past decade, and especially the “rise of the others” are cited as evidence for the end of American exceptionalism. The significance of each of these three reasons actually seems exaggerated, because the economic crisis is not the first such situation facing the US, the two wars have not made its military weaker, and placing “the others,” who have actually benefited from the American order, into a unified and coherent category hides risks for accurate analytical results.

It is difficult to argue that the rise of India and Brazil is a factor deteriorating American leadership when both countries are close economic partners of the US, and India is even strategically engaged with America. Both countries are more part of the liberal international order, unlike China and Russia, which traditionally oppose it but do not fail to take advantage of its positive aspects. China demonstrates reluctance and a lack of readiness to challenge Washington’s geopolitical dominance in East Asia, let alone on a global scale. What is happening in Russia could hardly be called a rise, and Moscow demonstrates arrogance based on a dangerous overestimation of its real capabilities.

America and the West as a whole have not finished generating ideas, concepts, and worldviews shared by societies around the world; on the contrary, their principles of democracy, individual liberties, and the rule of law remain extremely resilient and, with the spread of knowledge, become a threat to non-democratic regimes around the world, which include some of the most prominent contenders for global leadership. Therefore, the role of the US and the West is not at all erased, and the assertion that we are already living in a “post-American” or “post-Western” world seems untenable.

Countries like Japan and South Korea, which are not part of the West, have actually adopted many of its traditions and support the current international order. Significant obstacles to US foreign policy are often pointed out, but it is overlooked that most of them are actually obstacles for other states as well. The conviction that the Chinese rise will continue seamlessly at the same pace for decades to come is unrealistic, just like the expectation that every country on the rise will continuously increase its capacity to project power abroad. In this regard, it is more likely that we will soon see the end of the Chinese rise than the withering away of the leading role of the US and the West in shaping the world in which we live.

The Zero Trust principle is strictly necessary due to the inability to clearly distinguish between external and internal system environments. According to this principle, every participant in the system is potentially malicious, and continuous identity verification is the approach used to prevent and limit a breach. The main idea is never to rely on trust, but always to verify the credentials of subjects within the system. The concept was initially introduced in 2010 as a “zero trust model,” where trust is a dynamic variable based on context and behavior, rather than the attribute of whether the subject’s origin is systemic or extra-systemic^[1].

Later, the concept was further developed and recommended for implementation in the security systems of institutions and organizations^[2]. The essence of the zero-trust principle is outlined through three main provisions. The first is identity verification at every attempt to access system resources, as each one is treated as potentially risky. The second is least privilege access and network segmentation, where the participant is granted the right to perform only strictly defined activities related to specific tasks. Network segmentation is performed to limit the movement of a potential intruder who has managed to penetrate it. The third provision is continuous monitoring and adaptability, where the behavior of subjects is tracked continuously, and the adaptability of access policies reflects the context of the security environment at a given moment.

The principle is influenced by generative AI in several ways. Increased risk is one of them, as automated systems that use language models for database analysis typically operate in highly connected environments—cloud, hybrid, shared Application Programming Interfaces (APIs), and others. This connectivity increases the attack surface and multiplies potential losses. In this case, language models represent a risk vector of attack and a potential point of compromise in themselves. A major negative effect is the possibility that generative AI might make a mistake when writing code for applications, which could then be exploited by hackers for attacks and system breaches.

The process of constant monitoring and verification, however, generates huge volumes of information that need to be analyzed. In this process, generative AI has the potential to take on some of the workload from the human factor related to identifying anomalies and generating alerts for breaches. These circumstances are extremely close to the recommendations of the US Cybersecurity and Infrastructure Security Agency (CISA) for integrating the zero-trust principle into the work of organizations^[3]. The zero-trust principle is fundamental in modern cybersecurity practices, but the risks hidden in premature automation via AI are extremely dangerous. Malicious actors, however, are gaining additional ways to carry out attacks, assisted by generative AI, as well as attacks against already integrated models.

These principles aim for the rational management of access to resources and the structuring of responsibilities in a delineated and definable way. The two principles complement each other to ensure a work environment in which employees or processes do not have resources beyond what is necessary to perform a specific job (least privilege) while having clearly defined responsibilities and duties (separation of duties). The principle of “least privilege” is cited as foundational^[4] and extremely effective in limiting potential losses in the event of a successful attack, as it prevents resources from falling into the hands of hackers.

There are several mechanisms for access delegation, based on a role-based principle, on held attributes, or through dynamic identity management. All of them take into account the nuances of needs when performing different activities in the system. Systems have even been developed that provide the necessary rights for a precise amount of time in which to perform a specific activity, after which the subject loses access to the temporarily entrusted resources. Similar properties are useful when working in modern cloud systems, due to their scalability and automation, which imply significant losses in the event of a potential breach.

The existence of artificial intelligence agents that operate autonomously in cyberspace is a prerequisite for a thorough revision of this principle. The reason is the need to eliminate the possibility of such an agent gaining broad access to network resources, while at the same time being subject to control through strictly applied rules. The principle of “separation of duties” provides for all activities to be strictly distributed and for none of them to be performed by a single subject.

The goal is to avoid the possibility of compromising the system with the participation of a single employee. An example of this is the creation of an account in a certain system, where the one who creates it has no right to activate it. Activating the account is a designated duty of a second employee, who in turn has no right to create accounts. This principle is defined as extremely efficient for reducing the risk of abuse, fraud, or errors committed by trusted participants[5].^[5].

In the context of generative AI and automation, this boundary is blurred. Generative models are capable of performing tasks typically carried out by humans, such as code analysis, verification, and application installation. In the absence of a clear separation of functions for AI agents, the principle may be violated. The trend toward implementing ‘Machine Separation of Duties’ (MSoD) is becoming increasingly imperative and recommended.

The goal of both principles is to bring balance to activities and primarily to prevent human-originated errors. It is imperative that these principles be applied to generative AI models, as well as to autonomous systems operating in a digital environment. They must be subject to the same controls, restrictions, and monitoring in order to minimize the additional risks arising from interconnected systems.

‘Security by Design’ is necessary because every system must be designed from the initial phases with a presumption of security, so that it does not require securing afterward. The goal is to minimize vulnerabilities by using defensive practices during the design of the architecture, program, and process.

According to NIST, security by design is an approach that emphasizes security at every stage of the development of network architectures or software, anticipating the emergence of possible vulnerabilities in the design, implementation, and maintenance phases at a later stage^[6]. This principle meets the contemporary need for a proactive approach to seeking security in cyberspace.

CISA establishes the approach as an imperative in software development^[7]. Generative AI can play a dual role, due to the fact that it is increasingly used in programming new applications. First and foremost, the safety of the generative AI used for writing code must be ensured, as well as the reliability of the data with which it is trained. Subsequently, it is imperative to ensure the security of the generated program code and to adhere to the requirements for securing the process. Pre-defining the “security by design” principle is extremely important in such cases because every project is different and its content varies.

The “keep it simple and secure” principle supports the idea that the more complex a system is, the more insecure it is. Maintaining, monitoring, and controlling complex systems is a challenge in itself and carries a high risk of errors being made and compounded. This principle also aims for maximum transparency and traceability of processes, encouraging the creation of simplified and functional systems without unnecessary elements. Such a circumstance can make automation significantly easier, and the rules by which AI would operate in the corresponding system would be visible and clearly defined. Another advantage of systems constructed with this principle is significantly faster and easier recovery during crises and incident response.

Subscribe now

^[1] Kindervag, J. (2010) No More Chewy Centers: The Zero Trust Model of Information Security. Forrester Research Inc, Cambridge, https://media.paloaltonetworks.com/documents/Forrester-No-More-Chewy-Centers.pdf

^[2] NIST (2020), NIST Special Publication 800-207, Zero Trust Architecture, https://doi.org/10.6028/NIST.SP.800-207

^[3] CISA, Zero Trust Maturity Model v2, April 2023, Zero Trust Maturity Model Version 2.0

^[4] National Institute of Standards and Technology (NIST). (2020). Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations. Security and Privacy Controls for Information Systems and Organizations

^[5] International Organization for Standardization, ISO/IEC 27001:2022, https://www.iso.org/standard/27001

^[6] NIST, NIST SP 800-160 Vol. 1 Rev. 1 Engineering Trustworthy Secure Systems, November 2022, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v1r1.pdf

^[7] CISA, Secure by design. Shifting the balance of cybersecurity risk. Principles and approaches for secure by design software. 2023 https://www.cisa.gov/sites/default/files/2023-10/SecureByDesign_1025_508c.pdf

Known in military strategy since antiquity, defense in depth has been carried over into cybersecurity and essentially represents a strategic application of numerous overlapping access controls. A key property of these is independence, which aims to prevent a domino effect in the event of a breach. It is typical of the strategy that if one of the controls fails or is compromised, the others remain unaffected to prevent the attempted unauthorized access to the system. There are a large number of controls that can be systematized into four basic types: physical controls, managerial, technical, and operational.

Physical controls are applied to actions requiring physical interaction with security systems, which includes the surrounding infrastructure and building stock. Examples of physical controls include the use of fences, cameras, checkpoints, etc. Managerial controls focus on creating and implementing policies to neutralize threats. Risk management and project management can be cited as examples. Operational controls are broad activities related to people—mainly training, testing, and others. Technical controls are related to the ways of using technical devices and hardware, as well as available software. Firewalls and encryption are typical examples of technical controls.

Defense in depth in cybersecurity is an established necessity due to the multidimensional nature of threats and the huge attack surface, which makes accurately predicting the type of imminent attacks extremely difficult^[1]. Organizations that actively prescribe standards, baselines, and controls directly related to defense in depth in cybersecurity are NIST^[2] and the International Organization for Standardization (ISO). The latter prescribes highly effective standards, such as ISO/IEC 27001:2022 and ISO/IEC 27014:2020.

Generative AI poses serious challenges to the established concept of defense-in-depth, and the search for viable practices to neutralize vulnerabilities continues. While hackers are finding ways to automate their attacks against security controls, defense systems are struggling and are far from achieving secure and reliable automation. Defense-in-depth requires a reformatting of the positional approach to the use of controls and a transition to a dynamic, adaptive, and intelligent system in which the numerous controls are not isolated elements, but connected, adaptive parts of a complex and changing whole.

In cybersecurity practices, AI systems are used for specific tasks, such as real-time network traffic analysis and automated threat response. Their proliferation is limited and necessarily requires human factor intervention in their operation and decision-making. The cautious inclusion of AI in specific elements of defense-in-depth outlines the contours of a comprehensive, next-generation adaptive cyber defense strategy, in contrast to the usual practice of statically placing individual controls.

Subscribe now

^[1] Singer, P. W., & Friedman, A. (2014). Cybersecurity and Cyberwar: What Everyone Needs to Know [eBook edition]. Oxford University Press. Retrieved September 20, 2024, from https://books.google.bg/books?id=9VDSAQAAQBAJ

^[2] Joint Taks Force. (2020). Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53, Rev. 5). National Institute of Standards and Technology (NIST), US Department of Commerce, from https://doi.org/10.6028/NIST.SP.800-53r5

Placed within a unified operational framework, the three components are vital for maintaining resilience during pessimistic scenarios. Their interconnection integrates them into a comprehensive sequence to ensure damage is minimized. The goal is rapid recovery of operations without halting organizational processes. Risks of incidents and attacks are inevitable, but these principles enable preliminary preparation and prescriptions for how to overcome them with minimal damage, which is rarely only material.

“Incident response” represents a complex set of coordinated actions used to detect, analyze, contain, and remediate potential system breaches, with preparation for future ones being an integral part of the process. Preparation itself is the first of four phases in the NIST-prescribed incident response lifecycle^[1]. The subsequent phases are detection and analysis, containment, eradication, and recovery, and the cycle concludes with post-incident activities.

Each of these stages has strictly defined properties and prescribed steps for execution under specific circumstances. IBM Corporation points to three directions in which AI is used to implement the incident response plan ^[2]. By accelerating anomaly detection with the help of AI, which is a proactive process for response and forecasting of likely attacks, approximately 2.2 million US dollars on average could be saved per cybersecurity breach ^[3].

Business continuity also requires a detailed plan to ensure that essential operations remain active during a crisis. The plan contains four important components that cover not only the digital dimensions of security, but also other important domains, such as supply chains, human resources, and communications^[4]. The creation of such a plan involves conducting a business impact analysis as a core element of the risk management process. Incident response systematization is the second component, where organizations establish the execution of corresponding actions for expected or unexpected threats.

Establishing roles in the plan is the third element, which aims to organize and order the efforts of the human factor and prioritize resource utilization in a given direction. The final element is the continuous process of testing and improving the plan for the sake of the most adequate response during crises. Generative AI could be used at every stage of plan development, but in practice, its implementation could lead to over-reliance on automated systems and dangerous overconfidence by the human factor.

“Disaster recovery” is the last critical principle of the triad under consideration, which focuses on data and technical infrastructure recovery^[5]. “Disaster recovery” is inextricably linked to the previous two elements and is the final part of the efforts to address breaches and mitigate damage. To be consistent and complete, recovery is woven into the plans of the previous two principles, and in addition to them, a complete inventory of owned assets is prepared ^[6].

Without this detail, there could be no clarity in the recovery process, and for this purpose, assets are categorized as critical, important, and non-essential^[7]. The sum of these principles is the foundation of cyber resilience, and while some of the mentioned principles have a preventive nature, “incident response,” “business continuity,” and “disaster recovery” bring clarity for emerging from crisis situations through a systemic response. In this context, generative AI could play a role in each of the mentioned elements to accelerate the process of building an effective anti-crisis plan.

^[1] NIST, NIST Special Publication 800-61r3, April 2025, https://doi.org/10.6028/NIST.SP.800-61r3

^[2] Jim Holdsworth, Matthew Kosinski, What is incident response?, IBM, https://www.ibm.com/think/topics/incident-response

^[3] Ibid.

^[4] Rine Diane Caballar, Cole Stryker, What is business continuity?, IBM, https://www.ibm.com/think/topics/business-continuity

^[5] NIST, NIST SP 800-61 Rev. 3- Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, April 2025, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf

^[6]Tselkov, V., & Sredkov, G. (2023). CYBERSECURITY RESILIENCE OF STATE AND LOCAL ADMINISTRATION DURING DISASTERS, ACCIDENTS AND CATASTROPHES, Burgas Free University, http://research.bfu.bg:4000/items/75d0574e-41da-470c-b402-37d995c4619e

^[7] IBM, What is a disaster recovery plan (DRP)?, https://www.ibm.com/think/topics/disaster-recovery-plan

Киберсигурността се ръководи от правила, създадени за да пресичат и ограничават негативните въздействия, произтичащи от непредвидимата среда на киберпространството. Правните и регулаторни механизми предлагат не само унифицирани рамки по отношение на киберсигурността, но също защита от рисковете и последствия за извършителите на киберпрестъпления. Термините са посочени в йерархичен ред, тъй като са различни по генезис, цели и предназначение.

На първо място стоят законите и директивите, които се приемат от държавни субекти, международни институции и организации. Те са задължителни и неспазването им води до правни последици. Тук за пример могат да бъдат посочени „Общ регламент за защита на данните“ (GDPR) и Директива на Европейския съюз (ЕС) 2022/2555 (NIS2), които регламентират защитата на личните данни на индивидите и рамката за организирането на киберсигурността по унифициран начин. Вътрешното законодателство на отделните страни все повече обръща внимание на въпроса за сигурността онлайн, затова съществуват закони, регулиращи дейността в сферата. Пример за България е Закон за киберсигурност, който дефинира термина киберсигурност и посочва структурата, отговорностите и принципните положения, касаещи киберсигурността на страната. Законите са водещите задължителни правила от посочената поредица.

Съществуват значителен брой международни организации с професионална репутация и признат авторитет, които са в авангарда при създаването на стандарти в дадени сфери. По отношение на киберсигурността могат да се посочат вече споменатите ISO, чийто стандарт ISO/IEC 42001:2023 регламентира също отговорното разработване на ИИ, както и NIST, който макар да е американски държавен институт, създадените от него стандарти в сферата на киберсигурността намират широко глобално приложение.

Друг важен пример е „Institute of Electrical and Electronics Engineers“ (IEEE), който предлага богат набор от стандарти, включително за киберсигурност и компютърни технологии. Тези стандарти нямат задължителен характер, но експертното ниво на изготвяне гарантира максимално добри препоръки за намаляване на риска във всеки един момент. Множество държавни закони базират част от своите положения върху препоръките, съдържащи се в стандартите. Те са неразделна част от адекватната киберсигурност и тяхното познаване е силно наложително при изграждане на планове за киберсигурност.

Политиките за киберсигурност представляват вътрешни организационни правила, които всеки субект може да изготви и адаптира за специфичните си нужди. Наличието на политики за киберсигурност също не е задължително, но липсата на такива може да се тълкува като сигнал за изоставане от актуалните тенденции и поемане на значителен риск в контекста на съвременната среда за киберсигурност. Все повече компании разработват свои вътрешни политики и следят стриктно тяхното изпълнение. Политиките в повечето случаи са отражение на стандартите и винаги съобразени със законодателството. Базовите линии са последни в йерархията.

Те предписват практически стъпки за боравене и настройка на хардуер и софтуер, конфигуриране на защитни стени и сигурни криптографски практики. Тук може да се посочи „Center for Internet Security“ (CIS), който предписва серия от практически мерки по отношение на контролите за сигурност^[1]. Регулациите и правилата дават възможност за изграждане на многоизмерна рамка за защита от киберпрестъпления и повишават отчетността в индустрията. Силна тяхна страна е, че подобряват готовността на субектите да посрещнат кризисни периоди. Поради огромното разнообразие, познаването на изброените правила е сериозно предизвикателство само по себе си, но пък е от съществена важност за изграждане на адекватни системи за киберсигурност и безопасен ИИ.

^[1] CIS, CIS Critical Security Controls Version 8.1, 2024, https://www.cisecurity.org/controls/v8-1

Появата на ChatGPT за свободна употреба през 2022 г. показа, че изкуственият интелект (ИИ) e вече факт, като адаптивна, динамична и непредвидима технология, която скоростно се вплете в тъканта на съвременното общество. За кратко време чрез ИИ бяха автоматизирани процеси в индустрията, маркетинга, образованието и много други. Сферата на сигурността също не бе подмината от технологичната революция. Въвеждането на автономни системи за сигурност с висока адаптивност стартира ударно, но в същото време се породиха условия за появата и еволюцията на заплахи от ново поколение. Особено отчетливо този процес бе катализиран в сферата на киберсигурността- домейн, в който дилемите за технологично превъзходство, информационна защита и устойчивост на критичната инфраструктура, се сблъскват с комплексни въпроси, възникнали от разпространението на моделите за ИИ в киберпространството.

Данните зад тревогата

В доклад на Майкрософт се посочва наличие на автоматизация в над 70% от регистрираните корпоративни атаки през предходните дванадесет месеца. Данните заключават, че все по-често срещано е използването на големи езикови модели в процесите на социалното инженерство, както и за създаване на зловреден софтуер^[1]. Сходни резултати представя и Агенция на Европейския съюз за киберсигурност (ENISA), която в своя доклад „ENISA Threat Landscape 2025“ отбелязва, че 82% от фишинг мейлите са създадени чрез генеративен ИИ. Технологията също се ползва за писане на злонамерен код и провеждане на дезинформационни кампании.^[2]

Subscribe now

Въпросът за интегрирането на ИИ в практиките на киберсигурността и националната сигурност придобива остра важност и приоритетна актуалност. Причината се крие в разминаването между съвременните концепции за киберсигурност и възможностите и рисковете, възникнали от навлизането на технологията. Наложително е традиционните тълкувания за национална сигурност и киберсигурност да бъдат актуализирани в контекста на ИИ. По всичко личи, че мащабите на това предизвикателство са безпрецедентни, а резултатите са невъзможни за прогнозиране.

Държавите между възможност и заплаха

Националните държави, като най-мощни субекти, притежаващи значителни ресурси, са в ситуация, в която са не само пионери, но и потенциално застрашени. Оптимален път към внедряване на ИИ в киберсигурността и елиминиране на рисковете от процеса към момента не съществува. Все повече фундаментът на сигурността зависи от сървъри, алгоритми и данни, както и от тяхната способност да функционират при различни обстоятелства. Поради тази трансформация, дилемите пред внедряването и разпространението на ИИ освен технологични, са в значителна степен и стратегически. През 2024 г. Европейският съюз прие “EU Artificial Intelligence Act”. Актът представлява цялостна правна рамка за регламентиране на системи, базирани на ИИ, акцентираща върху изисквания за прозрачност и проследимост, както и върху защита на основни човешки права.

Директивата NIS2 поетапно влиза в сила, като тя поставя изискванията за киберустойчивост на държавните и частните структури на приоритетно място с акцент върху ИИ като ключов елемент в архитектурата на съвременната защита на електронните системи^[3]. Споменатите законодателни усилия са сигнал за осъзната геополитическа важност на ИИ като стратегически ресурс.

Новата надпревара за превъзходство

Според Бжежински^[4] и Кейгън^[5], технологичното превъзходство е изключително важно за установяването на глобална силова йерархия. Поради това обстоятелство, надпреварата за предимство в сферата на ИИ прилича на тази за разработването на ядрено оръжие през 20-и век, когато водещите сили са считали придобиването му за въпрос на оцеляване.

Водещите сили днес се стремят да изградят собствен модел на технологична и етична доминация в сферата на ИИ, за да постигнат предимство пред останалите. За своето кратко съществуване и бързо разпространение, ИИ отключи непознати форми на заплахи, почти непредвидими и невъзможни за контрол и правна регулация. За такива примери могат да се посочат дълбоките фалшификати, чрез които се манипулира общественото мнение и се накърнява имиджа на личности и организации. В същата категория спадат и зловредни софтуери, генерирани изцяло от ИИ, адаптивни в реално време и способни да заобиколят защитите на пробитите мрежи. Социалното инженерство чрез злонамерено използване на ИИ пък разкрива необятни хоризонти за осъществяване на атаки.

Кой участва в надпреварата

В резултат фишингът от ново поколение бележи върхова успеваемост. Налице са факти, показващи, че ИИ се използва в частния сектор и от националните държави, наравно с престъпни мрежи, опериращи в киберпространството, разнообразни политически актьори със собствени цели и дори терористични организации. Тези обстоятелства изискват спешно преосмисляне на концепцията за киберсигурност. Според доклада на World Economic Forum Global Cybersecurity Outlook 2024, 65% от световните лидери в областта на киберсигурността са категорични, че генеративния ИИ е технологията, която ще засегне индустрията най-сериозно^[6].

Защо темата е актуална

Актуалността на темата се съдържа не само в бързата трансформация на киберпространството, но и в наложителното преосмисляне на принципите на киберсигурността, провокирано от разпространението на ИИ. Настоящото изследване цели да се впише в този актуален контекст на преоценка на нуждите на киберсигурността, когато ИИ е не просто инструмент, а неразделна част и двигател едновременно на заплахите от ново поколение и начините за защита от тях.

Subscribe now

^[1] Microsoft Corporation, Digital Defense Report 2024. Microsoft Corporation, June 2024, https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2024

^[2] European Union Agency for Cybersecurity (ENISA), “ENISA Threat Landscape 2025”, October 2025, https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf

^[3] DIRECTIVE (EU) 2022/2555 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL, 14 December 2022, EU, 22.12.2022 г., https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng

^[4] Brzezinski, Z. The Grand Chessboard: American Primacy and Its Geostrategic Imperatives. New York: Basic Booksр 1997;

^[5] Kagan, R. The Jungle Grows Back: America and Our Imperiled World. Knopf.р 2019

^[6] World Economic Forum, Global Cybersecurity Outlook 2024, January 2024; https://www.weforum.org/publications/global-cybersecurity-outlook-2024/

Not long ago I was consulting a group of high level bank employees in the EU. In the beginning of the meeting the head of the bank’s Legal department asked me “Who is DORA for?”. He did not seek an answer such as “financial sector entities”, which he already knew. He wanted to clarify who among themselves is the most accountable when dealing with DORA requirements and compliance.

With us in the room were also the head of IT department, the Chief Risk Manager, head of HR and the head of PR. It was evident they were caught up in this discussion for some time and were seeking an opinion from outside their echo-chamber.

My short answer was “DORA is for everyone in your bank and even beyond- to the third party service providers. Because some of the employees must be at least aware about DORA. Some of them have daily operational tasks related to DORA and some carry the ultimate legal responsibility for compliance and third party risk management. So everyone in a different way.” The attendance was extensive, but that did not represent the top management body, which is responsible for DORA compliance under article 5.

They all had a role in the bank’s functioning under DORA- the legal department must follow the regulation and advise as well as prepare legal contracts with third party service providers. The IT department performs the technical aspect of mitigating risks from cyberspace, the risk management must constantly assess and manage the risks from third party service providers, the HR ensures the staff has the required level of awareness and competences, and the PR department must communicate with regulators and interested parties.

These are just a small number of aspects to consider about this deceptively simple question regarding DORA. Above all, the top governing body carries the ultimate, non-delegable responsibility for aligning the financial institution in scope of DORA in compliance with the regulation.

Subscribe now