Generative AI in Cloud Security: All Buzz, No Bang

Is AI the next big thing in cloud security?

You might think so if you've followed headlines about generative AI technology over the past year or so. Cloud security is among the many domains that, according to folks who are excited about GenAI, stand to be transformed by GenAI-based tools.

I remain unconvinced. Although I can see potential for generative AI to upend other types of security workflows, such as alert management, I don't think AI in cloud security is going to be the next big game-changer for businesses that deploy and manage cloud-based workloads. Here's why.

Defining Cloud Security

To understand why generative AI probably won't revolutionize cloud security, you must first understand what cloud security entails.

Cloud security is a broad term that encompasses a variety of technologies and responsibilities. Some, like monitoring cloud workloads for anomalies, are common parts of security workflows in any kind of environment. Others, like ensuring that the complex Identity and Access Management (IAM) policies that organizations depend on to govern access rights in the cloud, are unique (or nearly unique) to cloud security.

If you were to make a list of everything you have to do to enable cloud security, it might look like this:

Related:Report Reveals False Sense of Security in Cloud Environments

The Benefits and Limitations of AI in Cloud Security

How much can generative AI do to help streamline those workflows? Not too much, I think.

The only opportunity where I see generative AI adding tangible value to cloud security is in the realm of security monitoring and response. In that context, generative AI could be helpful for summarizing and interpreting alerts, as well as helping correlate security data across different environments. This is what tools like Sysdig Sage — one of the few offerings to appear so far that leverages generative AI for cloud security — do.

But since alert summary and correlation happens as part of security workflows in any type of environment, not just the cloud, generative AI doesn't bring special value to cloud security in particular.

Related:Cloud Vendors' Security Guidelines: Worth Your Time?

Nor does AI-driven threat detection and data correlation totally change the game when it comes to cloud security. It will add some efficiency to those workflows, especially for less experienced analysts who would struggle to perform the tasks quickly using conventional tools. But even for cloud security neophytes, it's hard to imagine generative AI leading to efficiency gains of more than perhaps 10% or 20%. It's not going to quadruple the speed at which analysts can detect cloud security threats, or allow one engineer to do the work that used to require 10.

Cloud Security Policy Controls

What about the task of validating whether cloud security control policies are secure? That might seem like an area where generative AI would be useful because GenAI tools could assess IAM configurations and determine whether they are optimal for an organization's needs.

But here again, generative AI doesn't offer a lot of value. Traditional cloud security tools already excel at detecting risky IAM configurations using simpler methods of analysis. They can detect excess permissions and overprivileged users through pattern matching and rule-based analysis. They don't need fancy generative AI models.

Conclusion

In short, generative AI technology might offer some opportunity to make certain cloud security workflows more efficient. But don't expect it to revolutionize the way organizations monitor and secure cloud environments. Traditional cloud security tools are already pretty good at what they do, and generative AI-based solutions can't move the needle that much.