AI and Cybersecurity
Useful for alert volume. Useless if the basics are missing.
What is cybersecurity?
AI in cybersecurity means using automation to handle alert volume and to recognise increasingly convincing social engineering, applied only once the fundamental controls that prevent most incidents are actually in place.
Most breaches in businesses of this size do not involve sophisticated attacks. They involve a shared password, a former employee whose access was never removed, or somebody being convinced to make a payment.
AI does nothing about any of those. Multi factor authentication, an offboarding checklist and a payment verification step do, and they cost very little compared with any detection tooling.
Where AI does help is genuine: making sense of alert volume that exceeds human review, and recognising phishing that is now well written enough to defeat the training most staff received.
What we require before selling you tooling
Duara advises on the AI aspects of security in Kenya, and routinely tells clients to spend the money on fundamentals instead.
We will not sell detection tooling to an organisation without multi factor authentication. Buying sophisticated monitoring while leaving the front door open is a common and expensive sequence, and it is one a supplier benefits from.
Who this is for
- Alert volume exceeds your review capacity
- Phishing attempts are getting more convincing
- You want an honest view of where to spend
- Somebody has proposed AI security tooling
Industries we serve
- Financial services
- Professional services holding client data
- Healthcare providers
- Telecommunications
- Public sector
- Any business holding personal data
Problems this solves
These are the real conditions, as distinct from the threat picture security marketing describes.
- Basics not in place. Shared passwords, access never removed from leavers, and no payment verification step, which is how most incidents at this scale actually happen.
- Alerts beyond review capacity. Security tooling produces more alerts than anybody reads, so genuine ones sit unexamined among noise.
- Phishing that reads properly. Staff trained to spot bad grammar are unprepared for messages that are well written and specific to them.
- Tooling bought before fundamentals. Money spent on detection while the front door is open, which suppliers rarely discourage.
What we deliver
Fundamentals confirmed first, alert triage where volume genuinely exceeds capacity, staff prepared for convincing social engineering, and an honest view on what tooling is worth buying.
An honest assessment of fundamentals first
Alert triage where volume exceeds review capacity
Staff training against convincing phishing
Guidance on payment verification steps
A view on which tooling is worth buying
A recommendation to spend elsewhere where appropriate
Features
- Fundamentals before tooling. We will not sell detection to an organisation without multi factor authentication, because that sequence is expensive and common.
- Triage where volume is genuinely the problem. Alert overload is real and AI helps with it, provided the alerts are worth having in the first place.
- Training against realistic phishing. Attempts are now well written and specific, and staff trained on bad grammar examples are unprepared for them.
- Payment verification emphasised. A verification step for payment changes prevents the incident type that costs Kenyan businesses most, and it costs nothing.
- Honest about what AI cannot do. It does not compensate for shared passwords or unremoved access, and implying otherwise would be selling comfort.
Benefits
- Money spent where it works. Fundamentals prevent most incidents at a fraction of the cost of detection tooling.
- Genuine alerts get seen. Triage means the real ones are not sitting unexamined among noise.
- Staff prepared for what they will receive. Training on convincing examples rather than obvious ones matches what actually arrives.
- Fewer payment frauds. A verification step addresses the incident type that most commonly causes direct loss.
Technologies we use
- Fundamentals assessment. Establishing whether authentication, access removal and payment verification are actually in place.
- Alert triage. Prioritising security alerts where the volume genuinely exceeds review capacity.
- Phishing simulation and training. Preparing staff against realistic rather than obviously flawed examples.
- Access review. Identifying accounts and permissions that should have been removed.
- Tooling assessment. Judging whether proposed security products would address your actual risk.
The threat picture that security marketing describes and the incident pattern that actually affects businesses of this size are different things. Most losses here trace to access management and payment authorisation rather than to anything a detection model would catch.
How the process works, step by step
Security work usually starts with a two week fundamentals review, which frequently concludes that no AI tooling should be bought yet.
-
Step 1
Free fundamentals review
We check authentication, leaver access and payment verification before discussing anything else.
-
Step 2
The honest recommendation
Where fundamentals are missing we say spend there first, which removes the tooling conversation entirely.
-
Step 3
Alert volume assessed
Where triage would genuinely help, we establish whether the alerts themselves are worth having.
-
Step 4
Staff prepared
Training uses realistic phishing rather than the obviously flawed examples most programmes use.
-
Step 5
Tooling reviewed
Any proposed product is assessed against your actual risk rather than the marketed threat picture.
Quality assurance and how we work
The commitments attached to advising on security spending.
- We will not sell tooling over missing fundamentals. Buying detection while the front door is open is a common and expensive sequence, and a supplier benefits from it.
- We say what AI cannot do here. It does not compensate for shared passwords or access never removed, and implying otherwise would be selling comfort rather than security.
- We describe the real incident pattern. Most losses at this scale trace to access management and payment authorisation rather than to sophisticated attacks.
- Phishing training uses convincing examples. Staff trained on bad grammar are unprepared for what actually arrives, and that training creates false confidence.
- We are not a security vendor. We advise on the AI aspects and would refer you to specialists for the rest rather than claiming coverage we do not have.
Frequently asked questions about cybersecurity
Does AI improve our security?
For alert volume and convincing phishing, genuinely. For the incidents that actually affect businesses this size, very little.
How do most breaches here happen?
A shared password, a leaver whose access was never removed, or somebody convinced to make a payment. AI addresses none of those.
So what should we spend on first?
Multi factor authentication, an offboarding checklist and a payment verification step. They cost very little and prevent most incidents.
Would you sell us detection tooling anyway?
No. Buying detection while the front door is open is a common and expensive sequence, and a supplier benefits from it.
Where does AI genuinely help?
Triaging alert volume that exceeds human review, and recognising phishing that is now well written enough to defeat older training.
Why is phishing training different now?
Because attempts read properly and are specific to the recipient. Staff trained on bad grammar examples have false confidence rather than preparation.
What is the most expensive common incident?
A payment redirected after somebody was convinced to change bank details. A verification step through a separate channel prevents it and costs nothing.
Are you a security company?
No, and we say so. We advise on the AI aspects and refer you to specialists for the rest rather than claiming coverage we do not have.
Can AI detect insider threats?
It can flag unusual patterns, with all the caution that applies to flagging people. A flag about a colleague is not a finding.
Does alert triage lose genuine alerts?
Any prioritisation risks it, which is why we ask first whether the alerts are worth generating rather than only how to sort them.
How long does the fundamentals review take?
About two weeks, and it frequently concludes that no AI tooling should be bought yet.
What about AI generated attacks?
They are real and mostly make existing attack types more convincing rather than creating new ones, which is why training matters more than tooling.
Should we worry about deepfake voice calls?
For payment authorisation specifically, yes. A verification step through a known channel addresses it better than any detection tool.
Does using AI tools create new risk?
Yes, mainly through staff pasting confidential material into consumer tools. That is a policy and sanctioned tool question rather than a detection one.
Can it monitor our staff?
We would decline building continuous staff monitoring. It creates its own risks and the incident pattern does not justify it.
Will this satisfy our auditors?
Fundamentals in place and documented usually satisfies more than tooling does, and we would suggest showing them that first.
Do we need a security operations centre?
Rarely at this scale. It is an expensive answer to a problem most Kenyan businesses of this size do not yet have.
What about ransomware?
Backups you have actually tested restoring matter more than detection. An untested backup is a plan rather than a protection.
Who sees our security assessment?
Only your own people and ours working on it. Findings about weaknesses are sensitive and stay tightly held.
What does security advice cost?
The fundamentals review is short and quoted upfront, and it frequently ends in a recommendation to spend elsewhere.
Glossary of terms
Security terms in plain language.
- Multi factor authentication
- Requiring more than a password, which prevents a large share of incidents at very low cost.
- Offboarding
- Removing access when somebody leaves, frequently incomplete and a common cause of incidents.
- Payment verification
- Confirming a payment change through a separate channel, which prevents the most costly common fraud.
- Alert fatigue
- The point at which security alerts are no longer read because there are too many.
- Social engineering
- Convincing a person to act rather than defeating a technical control.
- Phishing simulation
- Testing staff with realistic fake attempts to see who would fall for them.
Related services in AI Solutions
Talk to us about cybersecurity
Check whether every leaver from the last year still has an active account. That answer usually decides where to spend first.
Start your project