Traditional networking and security has evolved. More and more organizations are embracing remote-working, multi-cloud and IoT (Internet of Things) and the idea of routing traffic back to the datacenter has become somewhat unnecessary and inefficient. Not to mention, most employees are working from outside corporate premises and therefore, the traditional perimeter-based approach to security is hardly relevant. It is increasingly challenging to manage, secure and monitor such a large, disparate and distributed infrastructure. In contrast, secure access service edge (SASE) offers centralized management that is less complex, enabling control and visibility across the global infrastructure. This is why SASE has become a compelling proposition for enterprises.

One of the major challenges security teams face is understaffing. Not only is it difficult to identify and prioritize genuine security threats but also monitoring and managing the overall assets and security health of the organization is a challenge. Security analysts ideally need some kind of machine-augmented intelligence and automation that can help distill genuine alerts from noise, reduce false positives, conduct network analysis and repair, improve incident management and response and help accelerate investigation and recovery processes. Enter artificial intelligence (AI), machine learning (ML) and deep learning (DL). 

How AI supercharges SASE

For those that don’t know, AI is basically a machine or software that can perform tasks that would otherwise require human intervention. ML is a subset of AI that learns from data and makes predictions based on that data, while DL is a part of ML that mimics the human brain’s decision-making processes using the power of artificial neural networks. All together, AI has the potential to accelerate innovation, make security and infrastructure much smarter and advance SASE applications to the next level. Let’s understand how:

Reducing false positives

SASE delivers networking and security functionality via the cloud. This means that even networking data can be leveraged to eliminate false positives and enrich security analysis. For example, AI can study the logs on your network equipment and derive a risk score based on the domains and IPs the host contacted, the volume traffic it generated or the files that it downloaded. This is particularly helpful in identifying compromised assets and reducing false positives. 

Delivering real-time inference

Rapid detection and response are the primary objectives for any cybersecurity system.  Sometimes, one only has milliseconds to analyze threats and provide judgment, which is impossible if security technology is dependent on human review alone. AI and ML algorithms on the other hand can help monitor traffic in real-time, deliver near real-time inference and improve accurate threat prediction and detection at scale. 

Enhancing threat detection and prevention

AI can be used to detect and prevent threats in a number of ways. For instance, it can be used to identify previously unseen malicious traffic patterns, classify malware, block unauthorized access attempts and prevent data breaches in milliseconds. It can help block phishing attempts by analyzing and comparing text, brand and other visual content as well as email flows from websites reputed to have phishing associations. Since SASE cloud receives telemetry from across hundreds and thousands of users, AI can swiftly detect phishing messages and URLs faster than traditional security technology, protecting enterprises from fraudulent hacks and phishing scams.

Prioritizing incidents

AI can prioritize incidents, enabling security analysts to focus on high-priority risks. For instance, an AI model can be trained to aggregate data from multiple points of presence (PoPs), analyze patterns, identify Indicators of Compromise (IOCs) and provide risk scoring using metrics such as time, MITRE ATT&CK techniques, threat intelligence, server IP geolocation and other factors. By assessing these factors AI can enable security analysts to focus on high priority incidents, boosting incident response and ensuring resilience against emerging threats. 

Improving asset visibility and risk assessment

In addition to using AI for threat detection and prevention, SASE can also identify and assess the risks of assets connecting to the cloud. For example, AI can help understand the type of operating systems, devices, client applications and software and provide a deeper understanding of the asset landscape. This insight helps security teams enforce tailored security policies based on the asset’s unique characteristics and weaknesses. Using AI, SASE can also monitor device behavior and identify risks associated with outdated firmware and other risky usage. 

As the threat landscape continues to evolve and organizations become increasingly reliant on cloud services, AI will likely co-evolve and its participatory role in SASE applications will improve threat detection and prevention, prioritize incidents, and improve asset visibility and risk assessment.