Artificial intelligence: beating the burnout in security incident response

The number of threats that organisations are being subjected to is increasing exponentially. As a result, security incident response (IR) teams are being faced with an unprecedented dilemma. Once acting as a reactive, first line of defence against threats flagged by operational units within the organisation, IR teams and their skillsets are evolving to become proactive and preventative, with an emphasis on threat discovery. Centralised event log collection, network traffic archiving, the creation of "data lakes," and a plethora of query and inspection tools have become the new focus for IR teams. They are embracing threat hunting methodologies and employing the latest data mining tools in an attempt to identify threats in motion and reduce threat discovery and response times.