<p id="isPasted">The glut of data from new sources, combined with new ways of working with data, is making cybersecurity more complicated. But artificial intelligence (AI) delivers smarter strategies by considering context at scale.</p><p>It’s not news that enterprises are processing large amounts of data. However, the number of data sources and their associated attack surfaces are increasing. The growth of agentic AI and autonomous bots, the Industrial Internet of Things (IIoT), generative AI, and associated large language models (LLMs) is creating more opportunities for threat actors to sneak in and more complex network architectures that organizations must monitor.</p><p>While threat actors might use AI to launch cyberattacks, enterprises can, in turn, rely on the same technology to enhance their cyber hygiene. The cybersecurity field itself is evolving, harnessing the potential of AI at scale.</p><p>In this blog, we discuss five strategies AI can use to boost cybersecurity. These strategies include:</p><ul><li>executing strategies across distributed environments</li><li>overcoming the limitations of static signatures</li><li>automating gatekeeping actions in context</li><li>ranking and prioritizing exposure and vulnerability management</li><li>understanding threat actor psychology</li></ul><h2>Executing Strategies Across Distributed Environments</h2><p>Cybersecurity must account for how and where data move, both on premises and in the cloud. And those data need protection, whether static or in transit. A Zero Trust framework, which ensures that every access request is verified, helps. In addition, role-based access control (RBAC) ensures intelligent access to sensitive data.</p><p>AI carries out these tactics at scale. The technology is also adept in IIoT environments, where attacks can take the form of unauthorized command execution instead of more familiar methods like malware infections. AI helps execute cybersecurity in today’s highly distributed data environments. Whether data management involves an understanding of telemetry, network traffic, and machine states, AI can be trained on what “normal” looks like and catch deviations from the norm, and in the right context.</p><p>For example, AI agents can be trained to guard specific categories of attack surfaces, while proprietary machine learning (ML) models can be trained to recognize threats that are unique to the enterprise workflow.</p><p>As part of AI defenses, teams can automate early actions, such as isolating breach environments or restricting network access, to limit the damage from a cyberbreach.</p><h2>Overcoming the Limitations of Static Signatures</h2><p>A battle-tested cybersecurity strategy is to maintain a catalog of past threat actors and match new attacks against established “signatures,” such as their IP address. Such signature-based detection should comprise one aspect of security, but not the sole one. Threat actors can change signatures very quickly, and the method doesn’t factor in zero-day exploits from entirely new sources.</p><p>Drift-aware AI models can track changes to the network environment, including cloud autoscaling and remote work, to continuously update internal records of potential new attack surfaces that need monitoring. ML models group events based on behavioral similarity rather than static, unchanging signatures, which can quickly become outdated. Equally important, these mechanisms can withstand the onslaught of data from hundreds of thousands, if not millions, of distributed nodes.</p><h2>Automating Gatekeeping Actions in Context</h2><p>Because some of the most complex infrastructures integrate information technology (IT) and operational technology (OT), AI models analyze how devices communicate and respond to commands. If command sequences deviate from normal established patterns, AI flags the activity as suspicious. These actions and the continuous flow of threat updates from security information and event management (SIEM), endpoint detection and response (EDR), network detection and response (NDR), and software-as-a-service (SaaS) logs might give us the picture; but acting on every alert is probably not warranted, and is the reason why cybersecurity teams need information about threat context.</p><p>Contextual enrichment models enhance data with additional relevant information that could improve understanding of the event. In this context, AI models can assign probabilistic risk scores rather than simpler binary yes-or-no models for threats. Additionally, a cybersecurity strategy should acknowledge that assigned risks can increase over time.</p><h2>Ranking and Prioritizing Exposure and Vulnerability Management</h2><p>Enterprises have hundreds of thousands of common vulnerabilities and exposures (CVEs), and with constantly changing inventories, they have limited capacity to keep up with all evolving threats.</p><p>AI-driven predictive analytics help cybersecurity teams understand which vulnerabilities are more likely to be exploited. In addition, the technology identifies the most likely attack paths and identities. All of these attack surfaces have to be taken together in context. For example, a CVE in an isolated system out in the field might have an overall lower vulnerability profile than a user with high privilege-identity access using a commercial browser for routine work.</p><h2>Understanding Threat Actor Psychology</h2><p>Cybersecurity teams can also employ psychological operations (psyops), which involve understanding and influencing an “enemy’s” mind. AI can boost cyberpsychology-informed security by exploiting an attacker’s cognitive weaknesses. For example, the attacker might have seeded innate biases that can help guide the next step in a cyber-defense system.</p><p>While such a system might not keep threat actors away forever, it can thwart or delay an attack long enough for more severe defense measures to take effect. For now, this advanced method works primarily for human-driven cyberattacks—not AI bots—but it’s a fast-evolving field of study to accommodate the next generation of AI threat actors.</p><h2>Conclusion</h2><p>While cyber attackers are deploying increasingly sophisticated AI bots, AI itself is a potent tool for keeping up with cybersecurity defenses at scale and in the right context. Equally important, AI adapts to how and where data move, so it can keep pace with how enterprise workflows operate today and into the future.</p>

Discover five practical ways AI strengthens cybersecurity through threat detection, risk prioritization, automation, and adaptive defense.

5 Practical Ways AI Strengthens Cybersecurity

<p id="isPasted">In the modern, everything-is-connected era, security isn’t just an issue for information technology (IT) and networking specialists but a shared concern across disciplines and job functions.</p><p>Traditionally, cybersecurity has focused on building a fortified network perimeter. Once users or devices gained access to the network, they were assumed to be trustworthy. But that model is no longer sufficient.</p><p>Consider a modern manufacturing facility. There may be hundreds of Internet of Things (IoT) sensors transmitting data to cloud analytics platforms. Engineers might remotely monitor diagnostics from home offices. Third-party vendors could access equipment for routine maintenance. Every one of these connections represents a potential vulnerability. In such an environment, there is no longer a meaningful "inside" or "outside" the network.</p><p>To draw an analogy, the traditional approach embodied a "castle-and-moat" philosophy. Anyone outside the castle — i.e., outside the security perimeter — was treated as a potential threat, while anyone inside the castle walls was deemed trustworthy.</p><p>Today’s digital landscape more closely resembles a sprawling city built around that castle. The defensive moat can no longer enclose every system, device, or user. Instead, each resource must be protected individually, such as by requiring an ID check at the entrance to every building.</p><p>This is the premise of zero trust architecture (ZTA), a cybersecurity model based on the principle of "never trust, always verify." Under ZTA, users and devices are not trusted by default, regardless of their network location. Instead, each request to access a resource is evaluated in real time.</p><p>This architectural shift extends far beyond traditional IT teams. Automotive engineers designing connected cars, industrial control specialists securing power plants, and healthcare developers building IoT medical devices all need ZTA principles to protect their systems from modern threats.</p><p>This article will explore how implementing this new approach requires both technological evolution and a fundamental reassessment of how we secure digital interactions in an increasingly connected world.</p><h2>Four Core Concepts Underpinning Zero Trust Architecture</h2><p>In traditional security models, access was typically granted based on network location —  whether a user or device was inside the corporate network. Firewalls and virtual private networks (VPNs) created barriers at the perimeter, and once users made it past those defenses, they often had broad access to internal systems.</p><p>A critical weakness in this approach is that once an attacker breaches the perimeter, they can move throughout the network. This lateral movement is particularly dangerous in operational technology (OT) environments where systems control physical processes. In a power plant, for example, an attacker who compromises one system could potentially navigate to critical control systems, threatening not just data but physical infrastructure and public safety.</p><p>ZTA flips this model by making identity, not location, the foundation of security decisions. Every access request is evaluated based on who is asking, what they are asking for, and the context surrounding the request. This architecture is built on the following four key principles.</p><h3>Identity Verification and Continuous Authentication</h3><p>Every user and device must prove their identities. This verification is not a one-time event; it continues throughout the session. Access can be revoked immediately if risk signals emerge, such as a login from an unusual location or an outdated security patch.</p><h3>Micro-Segmentation</h3><p>Networks are divided into small, secure zones. Even if attackers compromise one zone, they cannot easily move into others. In smart factories, for example, micro-segmentation can prevent a breach in a quality control system from affecting production machinery or safety-critical controls.</p><h3>Least Privilege Access</h3><p>Users and devices are granted only the minimum permissions necessary to complete their tasks. An accounting employee, for instance, does not need to access engineering servers, and vice versa. This restriction limits the damage that can result from compromised credentials or insider threats.</p><h3>Continuous Monitoring and Risk Assessment</h3><p>Access control is dynamic, guided by ongoing analysis of user behavior, device posture, and system health. Monitoring tools feed risk models that adjust permissions in real time based on shifting conditions.</p><p>To extend our city analogy, compare ZTA to the procedures researchers might follow at a high-security facility:</p><ul><li>Employees must present their IDs (<strong>Figure 1</strong>) every time they enter the building, whether at the start of the day or just returning from a coffee break (i.e., identity verification and continuous authentication).</li><li>Researchers have exclusive access to the floor where their labs are located (i.e., micro-segmentation).</li><li>Researchers can access only the specific labs needed for their work (i.e., least privilege access).</li><li>Employees’ activities are monitored, and their security clearances are reviewed regularly (i.e., continuous monitoring and risk assessment).</li></ul><p><em><span class="fr-img-caption fr-fic fr-dib"><span class="fr-img-wrap"><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1784038913791-Figure+1.jpg" style="width:100%px" class="fr-fic fr-dib" alt="Figure 1: Access starts with identity. Zero trust ensures every badge, device, and user is verified before entry. (Source: spyrakot/stock.adobe.com; generated with AI)" /><span class="fr-inner"><em><strong>Figure 1:</strong> Access starts with identity. Zero trust ensures every badge, device, and user is verified before entry. (Source: spyrakot/stock.adobe.com; generated with AI)</em></span></span></span></em></p><p>The goal of ZTA is not simply to block unauthorized access, but to enforce fine-grained, context-aware controls that adapt to changing conditions.</p><h2>Key Architectural Components</h2><p>To achieve this goal, a ZTA environment is built around three functional pillars: establishing identity, enforcing access, and continuously monitoring for risk (<strong>Figure 2</strong>).</p><p><span class="fr-img-caption fr-fic fr-dib"><span class="fr-img-wrap"><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1784038986345-1784038986345.png" class="fr-fic fr-dib" alt="Figure 2: Zero trust is not built on a single solution; it stands on three foundational pillars that work together to secure identity, control access, and monitor continuously. (Source: Mouser Electronics/Author)" /><span class="fr-inner"><em><strong>Figure 2:</strong> Zero trust is not built on a single solution; it stands on three foundational pillars that work together to secure identity, control access, and monitor continuously. (Source: Mouser Electronics/Author)</em></span></span></span></p><h3>Establish Identity: Who or What Is Asking for Access?</h3><p>Zero trust begins with verifying both users and devices. Identity providers (IdPs) handle this process, often using familiar tools like multi-factor authentication (MFA). This role is often filled by enterprise identity and access management (IAM) platforms that manage access across an organization.</p><p>However, even a trusted user can become a risk if their device is vulnerable. To combat this, device posture checks ensure systems meet security requirements like recent operating system (OS) patches or up-to-date antivirus software. These checks may be built into IdPs or managed through endpoint security platforms.</p><h3>Enforce Access: What Can They Do, and Where Can They Go?</h3><p>Once identity is confirmed, the system must decide what level of access to allow. Policy decision points (PDPs) evaluate each request using pre-defined rules. Policy enforcement points (PEPs) act on those decisions as gates that allow or block access. Enforcement can happen within apps, network devices, or dedicated gateways.</p><p>Consider a technician trying to update a control system. They might be allowed access from a company laptop during work hours, but not from a personal device at 3 a.m.</p><p>A key enforcement tool is the software-defined perimeter (SDP). Unlike VPNs that expose entire networks, SDPs create secure, encrypted tunnels to specific resources. For example, the technician can see only the industrial control system; the rest of the factory network remains invisible and inaccessible.</p><h3>Monitor Continuously: Are Conditions Still Safe?</h3><p>ZTA does not stop at the access decision; it requires ongoing assessment. Systems like security information and event management (SIEM) platforms and user and entity behavior analytics (UEBA) continuously monitor users, devices, and activity for signs of risk.</p><p>These tools detect anomalies, trigger additional verification steps, and adapt access policies as needed. For example, a user showing unusual behavior — such as downloading large files outside business hours — might be prompted for re-authentication or temporarily restricted.</p><h2>Common Implementation Challenges</h2><p>This all sounds great in theory, but organizations adopting ZTA typically encounter several significant obstacles in practice.</p><p>First, you cannot protect what you cannot see. Many environments, like factories, hospitals, and rail systems, contain legacy equipment deployed before widespread connectivity. The existence of these systems may not be documented, and therefore, neither are their vulnerabilities.</p><p>Then, organizations must determine how to secure these systems. Many legacy systems run decades-old software or use proprietary equipment with limited security capabilities. Retrofitting them for ZTA often requires creative approaches, such as implementing security gateways that mediate access to legacy equipment without requiring modifications to the equipment itself.</p><p>Segmentation is another common pain point. While micro-segmentation is a core ZTA principle, excessive segmentation can create performance bottlenecks and administrative overhead. Security benefits must be balanced against operational impacts, particularly in time-sensitive control systems.</p><p>Perhaps the most significant challenge is cultural: ZTA requires different workflows that can disrupt established practices. Users accustomed to relatively free access may resist the new safeguards.</p><p>To promote adoption, organizations must make implementation as user-friendly as possible and clearly explain how users benefit from enhanced security. This might include demonstrating how ZTA can improve the user experience by enabling secure remote access to resources that previously required physical presence.</p><h3>Deployment Strategies</h3><p>Implementing ZTA across an entire organization is rarely feasible in a single step. Instead, a phased rollout reduces risk and allows policies to be validated in controlled environments.</p><p>For example, a power utility might start by securing remote access to its supervisory control and data acquisition (SCADA) systems with strong authentication and limited access rights. Over time, it could extend ZTA principles to internal operations, implementing micro-segmentation between control systems and establishing continuous monitoring for anomalous behavior.</p><p>This measured approach allows organizations to access security benefits while managing the practical challenges of transformation. The goal is not perfect security, but a security posture that continuously improves and adapts to evolving threats.</p><h2>Conclusion</h2><p>ZTA offers a powerful framework for securing modern systems, but effective implementation requires careful planning, collaboration across teams, and a shift in how organizations think about trust, access, and security.</p><p>For engineers and architects tasked with protecting today’s connected environments, now is the time to evaluate existing systems, identify high-risk assets, and begin laying the foundation for ZTA. All players must see security as part of their core responsibilities.</p>

Learn why zero trust architecture is the new cybersecurity standard for securing users, devices, applications, and connected systems.

Why Zero Trust Architecture Is the New Cybersecurity Standard

<p id="isPasted">The number of electronic devices that require network access is growing at a prodigious rate. Every device added to a network represents a potential security vulnerability, making it challenging to keep the cloud secure. Furthermore, emerging technological trends can also make it difficult to ensure the cloud remains secure.</p><p>As an increasing number of new devices connect at the network edge, a growing percentage of them also need to operate as close to real time as possible. The only way to accommodate this is to install new computing resources closer to the edge of the network, where those resources are potentially more vulnerable.</p><h2>The Cloud Expands to the Edge</h2><p>Historically, as the demand for computing grew, it gradually became possible for only the most well-funded organizations to maintain their own server farms. In response, data communications networks evolved into centralized architectures anchored by huge data centers.</p><p>The number of these data centers is relatively small, and they are often located at a significant distance from the majority of the customers they serve. This distance was once of little concern, but it is becoming increasingly important as more applications emerge that require near-instantaneous computing results.</p><p>The additional milliseconds necessary for a signal to travel to and from a remote data center are intolerable for vehicle-to-vehicle (V2V) communications, safety infrastructure (e.g., traffic control, disaster warning systems), and some virtual reality (VR) applications, including remote surgery or augmented manufacturing processes. Network latency can be exacerbated by bottlenecks in and around data centers that result from spikes in network traffic overwhelming available communications bandwidth and/or computing resources.</p><p>The need to avoid latency and delays is compelling further evolution in the cloud, this time toward decentralization, with more computing resources being placed closer to, or at, the network edge.</p><h2>The Advantages and Disadvantages of Computing at the Edge</h2><p>Computing at the edge reduces the latency that is inimical to applications that operate in real time, but there are other benefits. Reducing data traffic to and from distant data centers frees network bandwidth, decreases network load, and improves spectrum utilization.</p><p>It also creates the opportunity for local interests to manage local data directly. This can be important not only for operational reasons but also for conforming to data privacy regulations that dictate that individual users’ personal data remains local.</p><p>However, edge computing makes security more difficult. Not only are there more devices at the edge, but many are inexpensive devices that might not have sufficient security built in. There are also more computing nodes at and near the edge, further expanding the attack surface. And because many new edge applications have some bearing on public safety, keeping them secure is increasingly critical.</p><h2>Evolving Security</h2><p>It is challenging to maintain the level of control or vigilance in edge solutions that is possible inside a data center. There are far more server facilities, network nodes, and individual devices, while the attack surface, already enormous, continues to expand with every new connected product and application.</p><p>Edge devices can have weak, and sometimes even no, security, making every device and user potentially vulnerable. Cybercriminals can exploit these weaknesses and fool people into revealing passwords or otherwise providing digital access.</p><p>Traditionally, security measures have been based on software. Cybercriminals have used stolen credentials and exploited security loopholes to insert their own code that subverts defenses. There are numerous ways to essentially trick software with malware and viruses. The growing problem is that software is much harder to protect outside of firewalls — and being outside of firewalls is a defining trait of edge devices. Additional security measures are necessary, meaning that more security measures are hardware-based.</p><h2>Hardware Security Benefits and Implementations</h2><p>Hardware-based security extends defense measures all the way down to the component level, embedding security features into the hardware itself. These measures have inherent advantages over software security, including greater resistance to attacks, acceleration of encryption processes, the ability to isolate critical functions, and reduced vulnerability to physical tampering.</p><p>Just as there are many different software-based security techniques, there are also a variety of hardware-based approaches. For example, hardware security modules (HSMs) and Trusted Platform Modules (TPMs) safeguard cryptographic keys and perform secure computations in cloud environments, thereby enhancing data protection and authentication.</p><h3>Hardware Security Modules</h3><p>HSMs are dedicated hardware devices that provide a secure environment for operations involving encrypted data, ensuring the integrity and confidentiality of the data. In a typical HSM, the manufacturer defines the firmware key, encrypts the firmware, and stores the key to one or more devices. The manufacturer can specify a limited number of programming operations that the HSM permits before becoming permanently deactivated.</p><h3>Trusted Platform Modules</h3><p>TPMs are embedded within connected devices of almost any size, from personal computers to sensors. TPMs harden security functions such as secure boot processes, encryption, and authentication by serving as a trusted anchor within the device, protecting against unauthorized modifications and ensuring the integrity of system components.</p><p>Secure elements and trusted execution environments (TEEs) are two techniques for providing isolated execution environments. By segregating sensitive operations within secure enclaves, both hardware-based solutions mitigate the risk of unauthorized access and manipulation.</p><h2>The Future of Edge Security</h2><p>The growth of edge computing promises tremendous benefits: safer roads, safer cities, and more intelligent services. However, this growth is also perilous, and modern society already relies heavily on data communication systems. Interconnectivity and communication serve as the backbone of nearly every facet of our lives, from essential transportation and power infrastructure to various sources of entertainment, such as streaming TV and gaming services. Unfortunately, the last decade has seen a surge in high-profile cyberattacks and faulty updates, which have had severe consequences, including incapacitating global networks and causing substantial financial losses.</p><p>Keeping the cloud and the edge — i.e., the entire network — safe requires extensive and varying levels of security. That includes both software- and hardware-based mechanisms.</p><p>Security experts have already begun bolstering security technology with artificial intelligence (AI) and machine learning (ML). As we move ahead, the application of AI/ML in security is poised to become increasingly advanced in fortifying threat detection and mitigating attacks. Nevertheless, for a reliable system, it is crucial to have sophisticated hardware security components alongside any software measures to effectively safeguard and protect our networks.</p>

Hardware Security Assurance

ORGANIZATIONS. SHAPING THE INDUSTRY.

Latest Posts

5 Practical Ways AI Strengthens Cybersecurity

Why Zero Trust Architecture Is the New Cybersecurity Standard

Protecting the Cloud Demands Security at the Edge