Cybersecurity vendors have to do better in figuring out what organisations actually need to solve their business challenges.
For one, they should review the need to tag artificial intelligence (AI) in all their products just because the technology is today’s leading buzzword.
“Not everything can be solved with AI, but so many of them literally [are putting] AI in all their products,” said Marnie Wilking, chief information security officer (CISO) for online travel platform, Booking.com.
“Vendors need to not assume they know what problems we’re facing,” Wilking said in an interview with FutureCISO, during her recent visit to Singapore.
“[Instead,] they need to ask us what we need and what issues we’re seeing, and actually listen and build [solutions] into their products,” she said, when asked how market players should improve their products.
This is crucial since risk tolerance can differ among enterprises and across verticals, said Wilking, whose career in cybersecurity spans almost three decades, including 16 years in an FSI (financial services institution) as well as time in a healthcare startup.
Moving to healthcare, where the latter is not regulated in the same way as FSI, taught Wilking the value of being able to explain risks not just technically, but also in terms of their relevance to the organisation.
For instance, instead of SQL injections, conversations about cyber risks in healthcare should revolve around a customer’s healthcare data and the impact of identity theft on insurance fraud, she explained.
“Really understanding the business is the most important thing you can do as a CISO,” she said. “Know how your business makes money, that’s key.”
At Booking.com, it means safeguarding the travel booking platform against scams, which have been on the uptick alongside the increase in post-Covid travel and emergence of more sophisticated phishing email.
Where AI can make a difference
Here, AI actually can be leveraged to enhance fraud detection and response.
To boost its cyberdefence amidst the rise in cyber attacks, Booking.com added more detection mechanisms and monitoring of actions on its platform. It uses AI to detect and block suspicious messages, including blocking links that look suspicious, said Wilking, who was appointed the company’s CISO in 2023.
AI-powered fraud detection controls also monitor payments and bookings, blocking transactions that appear dubious and identifying potential fraudulent bookings and fake property listings, she said.
Booking.com partners also have the ability block certain senders as well as configure access to enable only certain employees to send messages to guests, she added.
Since 2010, Booking.com has facilitated more than 6.8 billion guest arrivals across properties listed on its platform and more than 1.8 billion guest arrivals in its alternative accommodations category, such as homes. The online booking site boasts more than 31 million reported listings in 175,000 destinations, including 8.4 million reported listings in homes, apartments, and other "other unique places to stay", according to the company's website.
With the high volumes of transactions it processes, Booking.com is able to use its database to build its own large language models (LLMs) for fraud detection, said Wilking.
Doing so ensures data integrity, which is a common challenge with building robust LLMs, she noted, adding that the company spent significant time making sure it used accurate data.
It also continuously reviews and refreshes the data, including feeding human-based reviews of AI-generated results back into the LLM to further train and finetune the AI model, she said.
AI is further used to build more secured products and security features, and reduce resources to perform certain tasks, she said. For instance, the technology is used to weed through potential vulnerabilities and identify those that need to be prioritised, she added.
In addition, more traditional tactics, such as two-factor authentication (2FA) and one-time password (OTP), are used as part of a layered defence approach. Booking.com partners are required to apply 2FA as a “step up authentication” when abnormal behavioural patterns are detected -- for instance, when users log in with a new device or from a location different from where they usually would.
According to Wilking, AI has blocked about 99% of fake property listings.
She believes the technology can be further leveraged to improve cybersecurity measures and bolster defence against cybercriminals.
There also is potential, particularly with the emergence of AI agents, to tap AI to prevent or detect human errors as quickly as possible, she said.
In addition, AI can be used to run automated checks on AI-generated results for potential bias and ensure these adhere to a company’s AI policies.
Wilking also urged the cybersecurity community to collaborate and share information on cybercriminal activities and cyberattacks.
“AI comes with [existing] risks and new risks, and we need to be sharing information on what we’re seeing,” she said.
“I’m confident that in the next two years, we can leverage AI to get better at cybersecurity and at defending against criminals, and using it to improve customer trust,” she added.
Consumers use AI, but can’t fully trust it
Establishing trust will be key as consumers appear unwilling to fully rely on AI-generated responses, even as more turn to AI to assist in their decision making.
In Asia-Pacific, 98% of travellers already are using AI-powered search engines, but just 38% say they fully or mostly trust AI generated information, according to Booking.com’s inaugural Global AI Sentiment Report.
Just 8% of Asia-Pacific consumers fully trust AI, even though 93% want to use the technology in future travel planning, the study found.
The report polled 37,325 respondents across 33 markets globally, including more than 1,000 each in Singapore, Thailand, Hong Kong, and South Korea.
Some 16% in Asia-Pacific are comfortable with AI making decisions independently, the study revealed.
Another 77% believe AI travel agents will be mainstream within the next three years, though 25% have questions about the technology’s development, reliability, and use cases.
The industry will need to figure out what it has to do to address such sentiments, said Laura Houldsworth, Booking.com’s Asia-Pacific managing director.
“Generative AI represents one of the most significant technological shifts of our era, opening up new possibilities across industries, including travel,” said Houldsworth.
She noted that the travel platform has been using machine learning and AI to improve customer journey and “unlock more intuitive” travel experiences.
“But as we enter this next phase, our responsibility goes beyond technology,” she said. “Building trust, ensuring transparency, and prioritising safety are critical as we guide travellers, and our industry, into the future.”
Adopting AI in a meaningful way
It also can take years for new technology to become mainstream, even if it is cutting-edge.
The key is figuring out what needs to be done to push the technology, such as AI, to broad-based adoption, said Lawrence Wong, Singapore’s Prime Minister and Minister for Finance, at last week's IPS-SBF Conference
Unlike previous technologies, though, AI already is relatively accessible, with most able to use GenAI apps such as ChatGPT on their phone, Wong noted. He added that AI already is embedded in various products, such as messaging app WhatsApp and search platform Google.
“[However,] that is not exactly the best way to use AI or to harness the potential of AI,” he said. “There is still so much potential to be unlocked and unleashed…we will have to think harder about how we can help every company, big and small, especially our smaller enterprises, make full use of AI.”
This should encompass integrating AI into their processes, transforming their industry and business, and elevating productivity in a more significant way, Wong said.
“Even as we think about broad-based adoption of AI, which we have to do because we have no choice -- we have to harness technology -- we also have to think equally hard about applying technologies like AI, in a meaningful and deliberate manner that creates jobs for Singaporeans," he said.
