The recently passed U.S. national defense spending bill recommends boosting the Defense Department's spending on AI for cybersecurity, which policy experts and analysts say is critical as increasingly sophisticated threats proliferate.

While it was unclear as of press time exactly how much of the $857.9 billion in funding authorized by the 2023 U.S. National Defense Authorization Act, or NDAA, was specifically earmarked for AI research and development, the bill highlights several planned funding increases for AI research programs, application development and workforce training. It also includes a directive to create a five-year road map for AI adoption in DOD cyber missions.

DOD has to adopt AI technologies "because that's where things are going in the future," Sen. Gary Peters, D-Mich., told S&P Global Market Intelligence.

Peters, who chairs the Senate Homeland Security and Governmental Affairs Committee and has led Congress on several cybersecurity initiatives, said lawmakers in the next Congress will be exploring further matters regarding AI and cybersecurity intersecting.

DOD did not respond to a request for comment asking about its AI and cybersecurity initiatives. While the NDAA highlights Defense Department's spending priorities, Congress still must pass a defense budget as part of the larger government appropriations bill that will provide funding for all federal agencies in fiscal year 2023.

AI and cyber concerns

Over the past decade, cyberthreats have become more automated and are occurring more frequently, noted Paige Bartley, a senior research analyst focusing on data, AI and analytics at 451 Research.

"These are sophisticated attacks, often stemming from nation-states," Bartley said. "They have access to more sophisticated technology than someone just writing code manually."

Human teams can never scale to the efficiency of automated systems that are deployable via AI, Bartley said. They require the adoption of automated-detection technologies to help defend against such attacks.

Tejas Dessai, a disruptive-technology analyst for Global X ETFs, said AI investments in the NDAA are a response to heightened concerns about potential threats following Russia's invasion of Ukraine and other geopolitical matters, but these investments will better position the DOD and its partners on cyber operations in the future.

"I think we're super early in the cycle, but the long-term dividends [that AI] will deliver once the infrastructure is in place are really bright," Dessai said.

Infrastructure questions

Dropped from the final text of the NDAA was an initiative aimed at protecting critical infrastructure. The directive would have asked sector risk management authorities to designate systemically important critical infrastructure entities and to establish a common minimum level of protection needed for important infrastructure such as financial institutions, power grids and hospitals.

Its removal from the final bill will slow efforts to craft a comprehensive approach to fixing infrastructure exposures, said Lauren Zabierek, executive director of the Cyber Project at Harvard University's Belfer Center for Science and International Affairs.

Despite any perceived shortcomings, the defense bill was hailed by the cybersecurity industry as a step forward.

"After several years of rapid developments in the cyber program and cyber policy arenas, this year's NDAA marks a sustained investment in ongoing initiatives," said Robert Sheldon, director of public policy and strategy at endpoint threat detection company CrowdStrike Holdings Inc.

Workforce education

As AI adoption in the DOD ramps up, U.S. armed forces and defense agencies are expected to focus on further educating their workforce on AI technologies and tools.

Bartley and Dessai pointed to a skill shortage in the space, something the NDAA is addressing through a provision that would consider the creation of a pilot program for an AI and cybersecurity curriculum offered through the National Security Agency.

Both analysts agreed the momentum on adopting AI will forever change the way cyber warfare is conducted in the future.

"We are moving from bullets to data and ... cyber," Dessai said. "It only makes sense for us to increase investments."

451 Research is part of S&P Global Market Intelligence