Turning Chaos into Privileges: Processing Attacker Data with AI

When conducting adversarial emulation engagements, making sense of all the data available to the attacker is THE biggest challenge. As a defender, if you don’t know the needle in the haystack the threat actor will find even exists, how can you protect against it? How can you make sense of the vast amounts of structured and unstructured data to give yourself the advantage? Data permeates the modern organization; structured data such as computer-readable output from tools and unstructured data; such as data from clients which is created by and for other employees. This data can be challenging to parse, process and understand from a security implication perspective but artificial Intelligence (AI) might just change all that. Our presentation will focus on a number of case studies where we obtained unstructured data during our complex adversarial emulation engagements with global clients and how we processed this into structured data that could be used to better defend organizations using AI. We will showcase the lessons learned and key take-aways for other organizations and highlight other problems that can be solved with this approach both for red and blue teams.