AI's position in the CTI program and security stack
The adoption of AI in cybersecurity is increasing at a higher pace. Therefore, you must know where to position it in the organization's security stack.
First, AI must be integrated into the SOC, whose primary objective is to protect the network, critical assets and data, endpoints, applications, and cloud services.
Second, it must also be integrated into the IR process to respond to and mitigate threats adequately, as shown in Figure 9.5:
Figure 9.5 – AI's integration into the security stack
Third, it must be integrated into the TIP and SIEM tools for objective and reliable threat intelligence analytics.
And finally, AI must be integrated into the organization's threat hunting programs, as discussed in the first section of this chapter, AI and CTI.
Analysts must protect the system and critical data (and assets) and remain compliant with regulations and standards. However...
