Skill up your security: How defenders can harness AI

How can defenders identify and resolve security issues faster with Red Sift Radar, and what does it have to do with the movie Tenet? That was the key theme of this year’s 16th e-Crimes & Cybersecurity Mid-Year Summit education session, featuring Billy McDiarmid.

If you missed the event, don’t worry—we’ve got you covered with three quick takeaways.

Learn more on Red Sift Radar—Watch the launch video:

Cybersecurity: Complex, just like Tenet

For those who have seen the movie Tenet, it’s often described as an overwhelming timeline of events without much clarity. The same can be said for navigating the confusing world of cybersecurity. With so many solutions on the market, picking the right tools can feel daunting.

Fortunately, Red Sift is here to help cut through the noise and provide clarity in a landscape full of moving parts, dependencies, and geographic nuances. This includes addressing major challenges like DNS misconfigurations, email and web service vulnerabilities, incorrect DMARC and SPF setups, and domains lacking proper protection or expired certificates still in use.

Mismanagement of these issues can lead to increased cyber threats and reputational damage. As Billy noted, “three major types of attacks include business email compromise (BEC), malware distribution via the takeover of trusted domain names, and registered domain name takeovers through nameserver attacks.” Identifying these security gaps is critical, and teams need to find swift resolutions.

Navigating AI challenges toward a solution

Security teams, though well-intentioned, often struggle to “move the needle” with the complexity of services, policies, and priorities. As Billy mentioned, “identifying, triaging, and remediating a misconfiguration fast can only be done with the right resources.”

While new technologies like generative AI can assist, tools like ChatGPT and Gemini are not built to handle the intricacies of web and email security. As pointed out during the session, “you can’t rely on them to do the job correctly—asking the same question multiple times may give you inconsistent answers.” Resolving complex security issues requires an integrated AI tool that learns and understands the customer’s issue, no matter how difficult. Relying on open source GenAI alone is both unreliable and can lead to further problems.

This is where Red Sift Radar steps in. The skilled-up large language model (LLM) is designed to save security teams time by embedding deep, domain-specific intelligence into their workflows. Through an intuitive chat interface and in-app interactions across the Red Sift portfolio, Radar identifies and resolves security issues across email, domains, and internet-facing assets 10x faster.

Red Sift Radar—A new LLM that’s safe and simple

“There’s a clear gap between standalone GenAI and AI integrated into existing tools, which makes it difficult to find the right questions and answers to quickly solve security challenges,” Billy noted. Red Sift Radar solves this by embedding contextual, data-driven prompts directly into the tools teams use every day, eliminating the need to switch to a separate chat interface.

What about incomplete data? During a live demo, Billy showcased how Red Sift Radar fully integrates standard and proprietary tools, allowing real-time monitoring of internet-connected resources from a single interface. This “single pane of glass” approach enhances consistency and keeps everything in one place. When needed, external data is incorporated to extract additional insights, ensuring organizations stay secure.

Finally, Billy highlighted how “Red Sift Radar overcomes the inconsistencies typical of open-source AI by using orchestration mechanisms called playbooks.” These ensure that queries are processed using the same tools and in the same order, enhancing consistency and reducing errors, making Radar an effective and trustworthy tool for security teams.

PUBLISHED BY

Jack Lilley

18 Oct. 2024

SHARE ARTICLE:

Categories

AI

Recent Posts

VIEW ALL
BEC

What is email spoofing and how can you prevent it?

Faisal Misle

Executive summary: Email spoofing is a growing cyber threat where attackers forge the sender’s address to impersonate trusted sources, enabling phishing, business email compromise, and financial fraud. Because legacy email protocols like SMTP lack strong authentication, spoofing can bypass traditional filters. Organizations can mitigate this risk by implementing robust email authentication measures, especially DMARC.…

Read more
Email

What is social engineering and how can you prevent it?

Jack Lilley

Executive summary: Email phishing has evolved and criminals now use social engineering to impersonate executives, suppliers, and even government agencies, persuading recipients to approve payments or disclose credentials. Because human judgment sits at the heart of these attacks, technical controls that eliminate spoofed messages before they reach the inbox are essential. DMARC provides that…

Read more
Cybersecurity

Attackers are abusing Microsoft 365: Here’s how to stay protected

Jack Lilley

Executive summary: Varonis has surfaced an active phishing campaign that spoofs internal users by abusing Microsoft 365’s Direct Send feature. Because Direct Send doesn’t require authentication and is treated as “internal,” these messages often bypass the checks you rely on for outside mail. Microsoft now offers an opt-in switch, RejectDirectSend, to block the pathway,…

Read more
BEC

SVGs with JavaScript are bypassing traditional email security: Learn how to stay…

Jack Lilley

Executive summary: Hackers are hiding JavaScript inside SVG attachments that pass as harmless images, and slipping past Secure Email Gateways (SEGs). To stay secure, organizations need to enforce a DMARC policy of p=reject, easily implemented with Red Sift OnDMARC, to stop compromised SVGs before they reach the end user. Key takeaways: Scalable Vector Graphics…

Read more