AI-driven cyber threats forcing rethink of enterprise security, says Elastic CISO

The rapid evolution of cyber threats is compelling businesses to fundamentally reassess their cybersecurity strategies, according to Mandy Andress, Chief Information Security Officer at Elastic. In a conversation with Business Today, Andress emphasized that the most notable change is the speed at which artificial intelligence is facilitating new attack vectors. "In the past, defenders had days or even hours to respond to newly discovered vulnerabilities; now, that window has shrunk to mere minutes. Organizations must either respond at machine speed or reconfigure their security measures to be more proactive," she explained. Elastic, headquartered in San Francisco, offers an open-source platform that specializes in search, observability, and security solutions. Andress noted that conversations with clients are shifting away from traditional cybersecurity concerns toward a focus on cyber resilience, as businesses strive to withstand the increasing scale and speed of AI-enabled attacks. Notably, this shift is being recognized beyond IT departments; senior management is now viewing cybersecurity through the lens of enterprise risk rather than just a technology issue. India has emerged as a key market for Elastic, encompassing clients from various sectors like financial services, telecommunications, and public enterprises. "There's tremendous potential here, especially with government initiatives aimed at enhancing digital infrastructure. Companies are investing in modernization and AI, creating significant market opportunities," Andress remarked. Elastic also has a global innovation center in Bengaluru that supports product development and various global functions. The company collaborates with enterprises to modernize security infrastructures, maximize existing technological investments, and tackle the talent gap in cybersecurity. Many organizations initially adopt security tools to meet regulatory mandates but often fail to leverage their full potential. Elastic's strategy involves integrating an AI layer atop existing security frameworks to bolster cyber defense capabilities, allowing organizations to sift through fragmented data sources more effectively. Their platform is designed to augment cybersecurity teams, empowering junior analysts to perform at levels comparable to seasoned professionals. "By providing AI assistance, we enable junior security analysts to operate with the proficiency of senior SOC operators," Andress noted. In India, Elastic's clientele includes both public sector organizations and digital-native firms such as Apna, along with major enterprises like Bharti Airtel. Airtel's Managed Security Services platform utilizes Elastic's AI-driven analytics to streamline real-time security operations, enabling clients to detect, investigate, and respond to threats across various infrastructures. As cyber threats continue to evolve, attackers are increasingly exploiting vulnerabilities in third-party software and open-source libraries during the development phase. This trend has heightened focus on securing the software development lifecycle (SDLC) with more robust and proactive controls. Elastic's 2025 Global Threat Research Report has pinpointed three significant emerging risks in India: the use of generative AI tools and large language models to automate malicious software creation, an alarming 64% of organizations identifying AI-enabled attacks as their primary security concern, and the rise of the "access broker" economy focused on credential theft rather than direct data breaches. Nearly 70% of organizations reported that credential theft is the most prevalent tactic in cloud attacks, with Trojans and file infectors comprising nearly 70% of detections nationwide. Another notable trend is how attackers behave after infiltrating systems. Rather than remaining undetected, they are increasingly executing harmful code swiftly, often outpacing cybersecurity defenses. According to Elastic's 2025 Mirror report, execution tactics have surpassed defense evasion, accounting for 32.5% of all observed activities on Windows systems — a significant increase from previous data. With the surge of AI-driven attacks, Andress advocates for new security models that emphasize continuous visibility, risk-based access, and intelligence-driven operations. Indian enterprises, compared to their global counterparts, are displaying a greater readiness to adopt AI-enhanced cybersecurity tools. "What stands out in India is the openness to embrace AI," she concluded.