December 10, 2023 • 

The answer for calendar year 2023 is not even close. Throughout the year, one topic has ruled all technology and cybersecurity discussions worldwide, and it continues to “suck the oxygen out of the room” at conferences in December 2023.

From ChatGPT grabbing top attention early in the year; to GenAI taking the cyber industry by storm at the RSA Conference in San Francisco in April; to tech leaders meeting with Congress on AI; to federal, state and local governments scurrying to issue new policies and governance over AI (and some states issuing AI “pauses“); to global tech leaders calling for global “guardrails and more” on AI research; to the just announced Google Gemini release, we are in the midst of an AI revolution.

As I traveled all across North America and the world, unrelenting questions surrounding AI and GenAI came up at security and technology conferences, no matter what the initial topic was. For example, I was just speaking at the Indiana Public Sector Cybersecurity Summit this past week, and every session I attended had an AI angle — even when the cyber topic was change management, malware, talent or anything else.

WHY UNPRECEDENTED?

Readers are probably not surprised by this headline about GenAI stealing the 2023 cyber show, but some may be wondering how the tech is unprecedented in “disrupting plans and ushering in unparalleled change.”

Put simply, I have never seen a new topic come out of nowhere to dominate the industry. Some are comparing these changes to the beginning of the Internet.

To grasp just how unexpected this headline would have been in December 2022, take a look at the top 2023 security industry predictions, which are summarized in the list below from across hundreds of sources and global experts. GenAI doesn’t show up anywhere on the list, and besides machine learning for cyber tool sets, AI received very little attention with the exception of targeted deepfakes growing in use and sophistication.

2023 SECURITY PREDICTION TOP THEMES (from December 2022)

• More cyber insurance issues and assorted (big) changes coming. Many won’t qualify.
• More nation-state cyber attacks based on lessons learned from the Ukraine war.
• Growing trouble with multifactor authentication (MFA) attacks.
• New attacks against space vehicles and drones.
• Social media attacks surge, including the use of targeted deepfakes.
• Use of public cloud computing and digital transformations grows, along with cyber threats.
• More critical infrastructure attacks that impact society.
• Hacktivism grows into new areas and becomes a bigger problem.
• Enterprises veering away from endpoint solutions and moving toward platforms to reduce complexity.
• Ransomware will be back in new, more dangerous, blended forms.
• More attacks against nontraditional technology, from cars to toys to smart cities.

Back in November, we covered some staggering numbers regarding how popular GenAI apps have become. You can see the full list at the link, but here are the top give:

1. ChatGPT: Launched in November 2022, it quickly dominated with 14.6 billion visits over 10 months, averaging 1.5 billion monthly.

2. Character.AI: Introduced in September 2022, it captivated users, accumulating 3.8 billion visits and surging by 463.4 million within a year.

3. Google Bard: Google’s March 2023 entry saw a remarkable 241.6 million visits in just six months.

4. Janitor AI: A unique chatbot from May 2023, it experienced a quick rise with 192.4 million visits in four months.

5. Perplexity AI: Established by ex-Google staff in August 2022, it progressed rapidly, drawing 134.3 million users in nine months.

Beyond the popularity of GenAI, the fact the bad actors are using it against us and even the number of new cybersecurity tools using AI, there are many shadow IT challenges with free GenAI apps that are dominating conversations around the world as we head into 2024. Here’s an excerpt from an article I wrote for CSO Magazine on this topic:

“Purchased applications are not what I am talking about. The free version of Google Bard or OpenAI ChatGPT or other generative AI apps have their own terms and conditions that likely do not match the language preferred by your organizational lawyers. Also, how is data that is input into the system protected? Finally, it’s unclear who can copyright or claim ownership of AI-generated works. Therefore, how are the results used in business processes?

“I am limiting this discussion to free generative AI apps available to end users on the Internet. You may be thinking, ‘Just buy the enterprise version license if you like a product.’ (For example, use Google Vertex AI rather than Google Bard.) On this point, we may agree. But many people (and companies) won’t do that, at least not initially.

“Put simply, it’s hard to compete with free. Most organizations move slowly in acquiring new technology, and this budgeting and deployment process can take months or years. End users, who are likely already violating policies by using these free generative AI tools, are generally loath to band together and insist that the enterprise CTO (or other executives) buy new products that could end up costing millions of dollars for enterprise usage over time. That ROI may come over the next few years, but meanwhile, they experiment with free versions because everyone is doing it.”

Later in that article I cover some potential solutions to these new shadow IT challenges.

Here’s another set of perspectives on cybersecurity in 2023 from top industry leaders. (Note they also start with AI.)

OTHER TOP CYBER STORIES FROM 2023

So what else was hot in 2023 in the security industry in the U.S. and globally?

No doubt, ransomware and data breaches continued to grab headlines, as I discussed back in September in this blog.

“Here are just a few of the recent incident headlines I am talking about:

• Lansing State Journal: Michigan State University data breach linked to global ransomware attack

Two more examples:

The HIPAA Journal: IBM: Average Cost of a Healthcare Data Breach Increases to Almost $11 Million “The 2023 IBM Security Cost of a Data Breach Report shows the average data breach cost has increased to $4.45 million ($165 per record), with data breaches in the United States being the costliest at an average of $9.48 million, up 0.4 percent from last year. Data breaches are the costliest that they have ever been and have increased by 15 percent since 2020. The data for this year’s report was collected by the Ponemon Institute and included breach data from 553 organizations in 16 countries with interviews conducted with thousands of individuals. All data breaches studied for the report occurred between March 2022 and March 2023.”

Verizon.com: 2023 Data Breach Investigations Report: frequency and cost of social engineering attacks skyrocket “The median cost per ransomware more than doubled over the past two years to $26,000, with 95 percent of incidents that experienced a loss costing between $1 and $2.25 million. This rise in cost coincides with a dramatic rise in frequency over the past couple of years when the number of ransomware attacks was greater than the previous five years combined. That prevalence held steady this year: Representing almost a quarter of all breaches (24 percent), ransomware remains one of the top cyber attack methods. ‘The human element still makes up the overwhelming majority of incidents, and is a factor in 74 percent of total breaches, even as enterprises continue to safeguard critical infrastructure and increase training on cybersecurity protocols. …’”

On ransomware, here are a few of the detailed pieces from this year:

Other top stories include ongoing cyber attacks and nation-state battles over the war in Ukraine and the events flowing from the Hamas attacks against Israel.

And last, but certainly not least, we covered another under-the-radar topic last week in a blog entitled 2023’s Dark Horse Cyber Story: Critical Infrastructure Attacks.

Here’s an excerpt: “A wave of ransomware attacks targeting critical infrastructure in recent weeks is a stark reminder that the ransomware problem will continue to get worse before it slows down — despite the U.S. government’s best efforts. Why it matters: In the meantime, hackers will keep disrupting critical services at schools, hospitals, financial service institutions and more. Driving the news: Several critical infrastructure organizations are responding to ransomware this week.

• Some hospitals across the U.S. had to divert ambulances from their emergency rooms and cancel elective procedures throughout the week due to a ransomware attack.
• The North Texas Municipal Water District is investigating a suspected ransomware attack this week.
• Ransomware hit Fidelity National Financial, a real estate services company, last week — making it impossible for some customers to pay their mortgages for several days.
• The Cybersecurity and Infrastructure Security Agency warned right before Thanksgiving that ransomware hackers are still exploiting a vulnerability in a popular Citrix product — months after a patch became available.”

FINAL THOUGHTS

When I posted last week’s story critical infrastructure blog on LinkedIn, several people pointed to ongoing cyber incident situations (or unknown new situations) around the world that could still steal the 2023 “top cyber story” attention. I agree that, when you release an article in mid-December, that situation is always possible.

Nevertheless, barring a monster cyber incident with global impact that grabs global headlines in the next three weeks, 2023 will be remembered by the cyber industry as “The Year GenAI Stole the Show.”

Daniel J. Lohrmann is an internationally recognized cybersecurity leader, technologist, keynote speaker and author.