Mic Up Perspective - AI and Cybersecurity: Pioneering the Workforce of Tomorrow

Terry Leach is the Solution Architect and Founder of Astrolytes, an early-stage cybersecurity startup. His focus is developing workforce solutions for bridging the gaps in cyber skills and processes using AI.

In this era of transformative technology, we stand on the cusp of a significant shift. Artificial intelligence (AI) presents immense opportunities and notable risks, similar to past technological revolutions such as electricity or the printing press. Recent media discussions following the President's Executive Order on AI have focused on AI's potential security threats, but a narrow view overlooks AI's potential to revolutionize the workforce, particularly cybersecurity.

As a startup founder, veteran, African-American, and technology history enthusiast, I bring a multi-faceted perspective. My unique standpoint allows me to see beyond the typical narratives explaining how job displacement will happen and highlight how AI can be a powerful tool for expanding the cybersecurity workforce. AI as a general productivity technology will be essential for national defense and commercial sectors because there are over half a million unfilled positions as of January 1, 2024.

Retaining and Upskilling the Workforce

With the rapid adoption of ChatGPT over the last year, I’ve noted several trends that will impact the cybersecurity workforce. The first use case is using AI to resolve customer service support tickets. AI has helped resolve 30-50% of tickets through automated chat, dramatically reducing the need for IT and security employee intervention. This AI use case can be extended to many project management tasks in cybersecurity, 80% of which Gartner estimates will be eliminated by AI by 2030. For knowledge workers like cybersecurity practitioners, these project management tasks include data collection, tracking, and reporting, which are the bulk of cybersecurity work.

Secondly, the potential for AI's impact on the workforce is the ability to lower the cost of personalized education and training. As Sal Kahn, founder of Khan Academy, said in his TED Talk, we are on the cusp of using AI for the most significant transformation education has ever seen by giving learners an AI tutor and teachers an AI teaching assistant, scaling learners' performance at a much lower cost. Off-the-shelf AI coding assistants like GitHub Copilot, which assist software engineers, have increased entry and mid-tier career engineers’ efficiency by 2.5 times, accelerating timelines with a relatively small investment in training. For example, a cybersecurity AI co-pilot could create a personalized interactive game to increase the knowledge and skills related to a potential industrial control system incident response. Entry-level cybersecurity practitioners could be upskilled faster and cheaper than is currently possible.

Finally, AI can play a role in reducing cognitive load and preventing burnout among practitioners and ultimately make our cyber workforce more resilient. Burnout due to cognitive load in these cybersecurity roles is a real problem with the continued growth of information and threat surfaces from devices and connected systems. But AI can play a role in addressing this, especially in a threat and information environment that continues to expand with more devices and related systems. Cybersecurity defenders need training, but the expense and time away to attend training may be a challenge. One of the significant advantages of AI in this realm is its potential for knowledge transfer and upskilling the workforce with hard or soft skills.

AI Shifts What Skills are Needed in Cybersecurity

Using AI in cybersecurity opens up the possibility of upskilling talent across various levels, from entry-level programmers to more advanced roles. A shift in cybersecurity tasks means the workforce can focus more on critical thinking, creativity, and developing soft skills essential for human interaction, something I have learned in my years in the field. I have spent years reading and learning about cybersecurity without a cybersecurity job, but have exercised my curiosity and problem-solving skills to succeed in the sector. In my nearly 20 years as a Solutions Architect, interacting with cybersecurity teams and reading and learning about cybersecurity, I realized cybersecurity has more people and process problems than a shortage of technical solutions. My work required me to listen to and speak the language of both management and software engineers to deliver products that have an impact.

The cybersecurity jobs of the future will also require technical knowledge and skills different from most technology-focused cybersecurity positions of today because of AI. Many cybersecurity job postings currently list experience with a specific vendor product instead of the candidate's knowledge of a task that can be performed across all vendor products in the category. AI has the potential to reduce silos of cybersecurity software tools. This is an added benefit because cybersecurity is not an industry-specific function of a business. It is a horizontal technology that permeates every part of our increasingly digital economy, so our standards, like the Workforce Framework for Cybersecurity (NICE Framework), should be adopted to enable an expanded range of candidates and lower barriers to entry-level cybersecurity jobs. While there are concerns about AI replacing jobs, AI also opens doors to upskilling across various sectors of work roles. Preparing for tomorrow’s cybersecurity workforce has already started; the NIST Modernizing Talent Management, supporting the NICE Strategic Plan, has produced an Employer’s Guide to Writing Effect Cybersecurity Job Descriptions, a tool for hiring managers and human resources professionals.

In conclusion, the technological shift towards affordability and accessibility signals an urgent need for a varied and skilled cybersecurity workforce adept at preemptive resilience against cyber threats. This evolution is not merely about risk mitigation but about leveraging AI to cultivate a workforce that is as diverse and dynamic as the technology it protects. For cyber leaders and CISOs, dedicating significant time to talent development is not just a strategy. We must actively fuel this transformation and ensure that our cybersecurity teams are as advanced and adaptable as the AI systems they defend. We can not secure our digital future without using AI.

Mic Up features perspective pieces from diverse cybersecurity professionals across the #ShareTheMicInCyber network. If you are interested in contributing, please email sharethemic@newamerica.org with the subject line "Mic Up Perspective".