AI has quickly become a key tool for the modern web. Developers, web hosts, and site owners are adopting it to reduce costs, increase efficiency, and serve customers (we can debate the merits of the last one).
AI is also taking a lead role in security research, with people and organizations analyzing code for vulnerabilities. That makes sense, as an AI model can find potential issues faster than a human. It’s also a tool developers can use while building – making the web safer for everyone.
We’re already seeing the fruits of this virtual labor. Recent WordPress security releases have found and patched issues with AI’s help. The WordPress plugin directory’s “Protect the Shire” initiative looks to catch plugin security holes before they are released to the public.
That’s all impressive. However, it feels like we’re only in the beginning stages of AI-assisted security. So, what does it mean for web professionals? And will this brave new world make our jobs easier? Or could it all backfire on us?
Let’s attempt to answer these and a few other important questions.
AI Makes the Connections Humans Can’t
It stands to reason that AI can identify common patterns of vulnerable code. Training a model on PHP or JavaScript documentation should mean it “knows” which functions are potentially dangerous.
The more surprising feature is AI’s ability to make seemingly unrelated connections. By itself, a particular code snippet may not be problematic. But combine it with another (or two or three more), and you might get a different result.
Think of it as one of those futuristic scenes in your favorite crime drama. You know the drill: a character uses a computer to track down a criminal at light speed and zero obstacles. AI isn’t quite that fast, but a few hours of scanning does the job.
We’ve seen cases where such detective work found vulnerabilities that existed for years. Humans reviewing the same code the old-fashioned way didn’t see the connection. A large language model (LLM) puts the puzzle together with relatively little effort.
AI is demonstrating its value for this type of work. That’s good, because malicious actors are using the same tools to do the reverse. We’ll need tools to identify problems as soon as possible.
Battling Information Overload
Researchers are using AI to uncover a record number of security vulnerabilities. Bug bounty programs that used to receive a few dozen reports a month are now seeing hundreds or more. That’s both a good and bad sign.
On the bright side, every patched security flaw is a positive thing. No one wants their app to be less secure, after all. More security means more peace of mind. Or does it?
The side effect is a deluge of security warnings. Companies and individuals are holding up every single issue they find, as if to say, “Look at this! We’re all doomed unless you buy x, y, and z!”
The reality is that no two vulnerabilities are the same. Some will be more severe and more likely to be exploited. Indeed, the random connections AI makes can mean an attacker needs to follow a very specific (and unlikely) set of steps to do real damage.
Regardless, all bets are off when an issue becomes public. Hackers will know (or can easily find out) how to exploit the vulnerability. From there, product makers rush to develop and deploy a patch.
This leaves the rest of us to wonder what’s an emergency and what can wait. It also makes freelancers and agencies afraid to ignore their email. What if our security plugin finds a critical issue?
We Need Smarter Ways To Manage Web Security
Even the most attentive web developers will struggle to keep up with the pace of security disclosures. Rarely does a day go by without another big doomsday flaw dropping.
The traditional workflows for everyday agencies and freelancers aren’t enough. Automated updates offer speed, but don’t guarantee safety or stability. Besides, how do we protect our sites from the inevitable undiscovered AI-built threats?
Here’s hoping we find smarter ways to manage security threats. We need help to make sense of all the information out there. A mechanism to quickly apply patches and minimize exposure would also be welcome. Some of these things already exist – but they must be applied at scale.
These issues could be resolved at the hosting level. After all, hosts are the closest point of contact for a website. Content delivery networks (CDNs) like Cloudflare could also help with a seamless mitigation strategy.
The bottom line is that AI has fueled an explosion of security discoveries and potential attacks. Freelancers and agencies can’t handle them alone. Help!
Top
