Riboldi said ML tools can help identify phishing attempts, and may even phishing attempts that slide through regular filters. “As time goes by, these systems get better,” he said. “This leads to less false alarms and more attention to actual threats. Since not all security weaknesses are the same, machine learning can help prioritize those vulnerabilities that pose a threat to an enterprise.”
Emphasize the “learning” part of ML
To be truly effective, new data is needed to be retrained to keep up with changing threat vectors and altering cybercrime behavior.
“Machine learning models get smarter with your help,” Riboldi said. “Make sure there is a feedback loop. Let the analyst mark events and adjust settings constantly improve its accuracy. Also, the data you give is key. It needs to be good, secure and from different sources like computers, clouds, login systems, etc.”
