AI red-teaming tools helped X-Force break into a major tech manufacturer 'in 8 hours'

An unnamed tech business hired IBM's X-Force penetration-testing team to break into its network to test its security. With the help of AI automation, Big Blue said it was able to do so within hours. While he can't name names, Chris Thompson, global head of X-Force Red, said this particular customer is "the largest manufacturer …

[Blazde]

'the largest manufacturer of a key computer component'

They got the blueprints to Energizer's CR2032 coin batteries?

[Anonymous Coward]

Now have them do it again...

Now have them do it again, this time without powdered recreational pharmaceuticals.

[HuBo]

Work for 8-hours, get paid for 3-weeks!

Ah-ha! So they used automated pen-testing to scan for vulns, resulting in "really big data[sets]" and a commensurate "offensive data analysis problem" (aka "crazy data analysis" for a "fire hose of information"), which is where AI came in to sift through all that and "connect the dots" or "put the dots closer together" to ease the delineation of intrusion strategies of highest potential into the target system. Here, a flaw in the poorly secured "HR portal" came out as the winning entry point. Good stuff to know (esp. the current role of AI in this).

Great article!

[xanadu42]

" ... a flaw in the manufacturer's HR portal..."

It would be the HR portal...

Isn't the flaw the whole HR Department?

[Mike 137]

Re: " ... a flaw in the manufacturer's HR portal..."

"Isn't the flaw the whole HR Department?"

More probably it was an error by the devs who created the portal. The HR team was just the customer.

[TheBruce]

Re: " ... a flaw in the manufacturer's HR portal..."

The problem I ran into is HR chose a system, pay for it and then run by security.

[wsm]

AI tools can "never replace dedicated hackers, truly the most skilled people out there"

Coming from IBM, I believe the context is all important.

Other organizations might have the more skilled people on the inside.