The best cybersecurity systems make AI central to their offering, rather than merely adding it as an extra or plug-in. AI should be a core component rather than bolted onto an existing, traditional product.
It is also crucial that the AI cybersecurity features provide clear benefits rather than merely marketing. Ensure that the AI product provides its benefits as seamlessly as possible without interfering with employee productivity. It also needs to protect all devices in the fleet, including mobile and IoT, without causing performance and resource issues.
Because AI for cybersecurity improves as it learns, the more mature provisions will be better able to detect threats than newcomers. Cylance® AI is already on its seventh generation, giving it years of training across billions of diverse threat data sets. More recently introduced cybersecurity AI will not have had so much training, making it less effective.
If your organization has implemented Zero Trust Security, you want cybersecurity AI that will fit into this framework. For example, it needs to work alongside the heuristic of Zero Trust for access and permissions adjustments.
Connected to this, consider how the AI is maintained. Does it run locally on the endpoint or exclusively in the cloud? Does it just improve signatures, or does it work in real-time to prevent threats as they occur? Does it require employee training to deploy, or is it relatively seamless? Finally, how often is the AI itself retrained?
The true test is how a solution fits with your organization in real life. You need to find out if there are the proper levels of aggressiveness for different scenarios, which users might need to adjust, and if the cybersecurity AI is as effective in offline scenarios as online. If it is offline, can it prevent zero-day malware without needing connectivity? This is the true test for cybersecurity AI: how much does it enhance your organization’s protection?
Source: https://www.blackberry.com/us/en/solutions/endpoint-security/cybersecurity-ai