Artificial Intelligence: Friend or Foe

The talk opens with the state of ransomware. The speaker cites a reported 93 percent year-over-year rise in attacks in 2021, points to high-profile incidents such as the Kaseya and Colonial Pipeline attacks, and describes the spread of ransomware-as-a-service and triple extortion. He traces how ransom demands have grown over the years and links the trend partly to remote work, which widened the ways staff reach internal data.

The middle section turns to artificial intelligence, framed as a new wave of automation that replaces analytical effort in the way machines replaced physical labour. The speaker credits cheaper storage, cheap compute and recent advances in machine learning for making this practical. He walks through defensive uses: predictive campaign hunting that flags likely malicious infrastructure, sandbox-based analysis that records a file's behaviour, and context-aware detection that correlates events across endpoints, cloud and email. He presents behaviour-based anti-ransomware that keeps protected shadow copies so files can be restored, and a phishing and file-sanitization approach. He then demonstrates a code assistant that suggests encryption functions from a plain comment, raising the concern that adversaries can use the same tools.

The closing part covers an example forensics report and a set of practices: multi-factor authentication, phishing awareness and red team exercises, segmentation of operational technology from IT, manual workarounds in continuity plans, a clearly communicated incident response plan, and quarantining suspected assets.