2024-05-06-Zscaler-2024年AI安全报告_38页_49mb

Zscaler ThreatLabz 2024 AI Security Report Summary

AI adoption in enterprises is accelerating rapidly, with a near-600% increase (3.1 billion monthly transactions) in AI/ML use from April 2023 to January 2024, despite growing security concerns. Enterprises are blocking 18.5% of transactions—a 577% increase—highlighting a reluctance toward established AI policies.

Manufacturing leads AI adoption, accounting for 20.9% of transactions, with Finance and Insurance (19.9%) and Services (16.8%) following closely. ChatGPT drives 52.23% of transactions and is the most blocked app (18.5% blocked), indicating a tension between high usage and strong control measures. India and the US are the top regions, while Education (2.98% blocked) lags in security posture compared to others.

AI-driven threats are proliferating, including phishing campaigns (e.g., using ChatGPT for fake login pages), deepfakes (used in vishing, election interference, and corporate fraud), and malware automation (polymorphic ransomware, vulnerability exploits). "Dark chatbots" on the dark web, like WormGPT and FraudGPT, facilitate malicious code generation without guardrails.

Key enterprise risks include data leakage (Shadow AI/Shadow IT), model inversion attacks, insecure AI access controls, and poor data quality leading to poisoning. Mitigation requires granular access policies, data loss prevention, DLP, and private hosting of generative AI tools.

Countries like the US and EU are leading AI regulation. The EU’s AI Act imposes strict rules by risk level, while the US mandates transparency for large AI systems and voluntary commitments to safety. These regulations aim to balance innovation with security and accountability.

For defense, enterprises should adopt AI-powered security tools (botnet detection, inline sandboxing, DLP) and enforce zero trust architecture. Best practices include blocking unauthorized AI apps, implementing granular controls, preventing sensitive data uploads to public LLMs, and establishing clear AI policies.

Finally, Zscaler secures AI adoption by integrating GenAI with Zero Trust—through advanced logging, URL filtering, DLP, Browser Isolation, and network segmentation—to ensure productivity without compromising security.