4th IEEE International Conference on AI in Cybersecurity (ICAIC), 5-7 February 2025, University of Houston, Texas, USA

Generative AI for Automated Security Operations in

Cloud Computing
Author 1: Advait Patel Email: [email protected]
Affiliation: Broadcom Author 3: Hariharan Ragothaman
2025 IEEE 4th International Conference on AI in Cybersecurity (ICAIC) | 979-8-3315-1888-2/25/$31.00 ©2025 IEEE | DOI: 10.1109/ICAIC63015.2025.10849302

Email: [email protected] Affiliation: Athenahealth Author 5:Diwakar Reddy Peddinti

Email:[email protected] Affiliation: Independent Researcher
Author 2: Pravin Pandey Email:[email protected]
Affiliation: Tiffany & Co Author 4:Ramasankar Molleti
Email: [email protected] Affiliation:Options Clearing Corporation

Abstract—New opportunities in cloud computing have brought automating demanding routine tasks, such as log analysis,
many new risks that require effective protection of dynamic threat hunting, and vulnerability scanning, thereby lightening
distributed environments. Introducing a new formative the workload by many folds; 2) increasing the throughput and
technology, generative AI, to cloud security has far-reaching accuracy of threat prediction and response. More specifically,
benefits for automating threat detection, real-time incident
this study concerns the implementation of generative AI in
addressing, and vulnerability management. This paper focuses on
extending generative AI with cloud security tools like AWS automated security management on virtualized computing
GuardDuty and Google Cloud Security Command Center; the platforms. Namely, it enhances understanding of how
contemplation of accuracy enhancement and response efficiency generative AI can improve threat intelligence, incident
highlights its aim. Concerning actual applications such as SOAR handling, and vulnerability management. The various anti-
systems, the study demonstrates how media industry giants, such cloud-native security tools, such as AWS GuardDuty and
as Netflix and JPMorgan Chase, have used AI to minimize risk Google Cloud Security Command Center, as well as real-
factors while increasing operational efficiency. The paper also world systems, such as Security Orchestration, Automation,
discusses the significant increase in response time, enhanced and Response (SOAR), are also discussed in the study. The
detection accuracy, and the shift to proactive security strategies
aim is to examine how generative AI could evolve cloud
brought by generative AI. Drawing attention to AI systems'
opportunities, the study examines the subsequent issues connected security operations, what problems it can solve, and the
with AI applications, including over-dependence on AI tools, potential directions for further improvement of the cloud
adversarial risk to models, and the complex nature of decision- cybersecurity environment. Hence, this research seeks to fill
making in the context of AI systems. The present study also existing gaps in the existing literature by providing much-
highlights the importance of generative AI in strengthening the needed insight into the growth of AI-based cloud security.
defense of the cloud environment, but, at the same time, it II. LITERATURE REVIEW
recognizes the significance of preventive efforts and planned A. Current Advancement in AI for Cybesecurity
action plans to manage these technologies efficiently. AI has greatly influenced cybersecurity since it has offered more
Keywords—cloud security, generative AI, incident response, soar tactical approaches to early identification of threats and response
systems
to them. Structured security measures are rules where most
I. INTRODUCTION security policies are predefined, with little flexibility to address
Cloud computing has done much for organizations by emerging threats in cyberspace. On the other hand, AI systems
providing a scalable and cheap way of storing and processing employ machine learning (ML) techniques that can parse
data. But this has opened a new front of security problems. significant volumes of big data and continually learn about new
Threats inherent in cloud environments include unauthorized threats [3]. Approaches like supervised, unsupervised, and
access, data compromise, and very complex attacks aimed at reinforcement learning techniques have boosted the ability to
specific settings [1]. Because cloud systems are distributed detect threats. AI uses in cybersecurity are intrusion detection
and can process staggering amounts of data, monitoring and systems (IDS), user behavior analytics (UBA), and endpoint
securing such environments is becoming more and more protection. For instance, sophisticated statistical models can
challenging. Conventional security methods fail to detect assess the variability of traffic that shows the signs of attack [4].
threats and provide responses as fast as threats appear and Natural language processing has been applied for security log
evolve, which means threats can go unnoticed in the analysis, and thanks to it, the speed of vulnerability detection has
organization. The challenges have become more manageable increased.
with the help of a new development called generative AI. In B. Integration of AI with Cloud Security Tools
particular, generative AI deploys machine learning algorithms Security risks in cloud computing solutions differ from those
to look for patterns, outliers, and new types of threats within of more traditional solutions because of their distributed
the mountains of incoming data. Because of its capacity to architecture, multi-tenant/multi-dimensional framework, and
build sample situations and produce authentic data, the ability to scale resources. AI has been found very useful,
security team can work ahead of time or anticipate a threat and especially when interfaced with cloud-native security tools to
swiftly respond to it [2]. Specifically, generative AI generates mitigate the challenges. AWS GuardDuty, Microsoft Defender
the following benefits for security professionals: 1) for Cloud, and Google Cloud Security Command Center use

979-8-3315-1888-2/25/$31.00 ©2025 IEEE

Authorized licensed use limited to: Center for Science Technology and Information (CESTI). Downloaded on March 30,2025 at 04:13:36 UTC from IEEE Xplore. Restrictions apply.
 artificial intelligence in real-time threat detection to protect
organizations.
AWS GuardDuty: This service employs ML to identify
network traffic, access logs, and feeds from other sources for
the AWS environment. That is how it defines various
unwanted actions, including attempts to gain unauthorized
access or to transfer data outside the protected network or the
presence of viruses and other malware [5].

Figure 2: Google Cloud Security Command Center Features

Google Cloud SCC uses modern threat identification
mechanisms using machine learning techniques and best-in-
class security intelligence. It automates detecting risks,
including malware, forbidden access tries, and many
suspicious things, before they become a big problem. The
timely detection of threats on the platform is instrumental in
conceiving and developing new strategies to combat emergent
threats, improving the robustness of the whole protective
Figure 1. Amazon GuardDuty Architecture [5] structure [6].
Figure 1 above describes how Amazon GuardDuty operates. It
integrates Amazon GuardDuty, CloudWatch Events, Kinesis
Firehose, and SNS. This solution helps observe and neutralize
security threats much faster. GuardDuty processes CloudTrail
records, VPC flow logs, and DNS queries and shares the
results with CloudWatch Events. Results are computed within
5 minutes and sent further by implementing custom event
patterns [5]. Two CloudWatch Event Rule targets are defined:
Kinesis Firehose and SNS. It provides the result directly to
two locations: an Elasticsearch domain for dashboarding using
Kibana and an S3 bucket for historical storage. S3 data can
also extend a data lake and permit analysis using Amazon
Athena. SNS sends the alert immediately with an email or
SMS to the operations teams. With Kibana, one can
Figure 3: Google Cloud Security Command Center [7]
investigate, and published results are viewable using the
Elasticsearch query language. IP whitelisting is replaced with The figure above presents the structure of Google Security
a more convenient method—Amazon Cognito User Pools—to Command Center SCC Enterprise, a flexible multi-cloud risk
secure overall authentication. Such a setup allows for real- management solution. It combines advanced SecOps that
time oversight, access to the findings, and efficient utilization applies artificial intelligence with cloud protection and then
of the GuardDuty results. offers preventive and responsive security for clouds situated in
Google Cloud Security Command Center: This platform uses AWS, Google, and Microsoft Azure [7]. To achieve the best
AI to manage and provide a unified view of the security security in the cloud, SCC concentrates on five areas: posture,
environment in Google Cloud projects [6]. Using predictive code, identity, data, and threat.
analysis, it categorizes threats by severity and provides an At its core, SCC leverages the Google Security Fabric, which
action plan for addressing them (refer to Figures 2 and 3 combines three critical elements:
below). • Mandiant Threat Intelligence is a service that permits
clients to stay informed on current threats and their
adversaries.
• The Continuous Risk Engine identifies risks,
configuration mistakes, and threats in continuous operation.
• Implementing an intelligent product, Google Gemini
AI, to handle top-tier features, including threat detection, risk
scoring, and response optimization.
This architecture employs a planet-scale data lake to analyze
and integrate security operations for multi-cloud
environments. By design, SCC has inherent remediation; thus,

Authorized licensed use limited to: Center for Science Technology and Information (CESTI). Downloaded on March 30,2025 at 04:13:36 UTC from IEEE Xplore. Restrictions apply.
 the auto-response capability addresses vulnerabilities and technologies, enhancing threat management's accuracy and
threats. Further, the company runs Mandiant Hunt with SCC, response time, and analyzing practical applications such as
which is expert-led and always-on threat identification and AI-enabled Security Orchestration, Automation, and Response
analysis [7]. The proactive measures include main issues like (SOAR) systems.
misconfiguration and compliance violations, while the A. Integration with Cloud-Native Security Tools
reactive capabilities recognize and coordinate with active Cloud-native security tools are required to target cloud
dangers. Thus, CCT’s data-driven approach to automation environments’ flexible and dispersed structures. Incorporating
increases cloud security and overall performance by generative AI in these tools adds value to its advanced features
integrating threat intelligence. of discovering outliers, real-time data analysis, and distinctive
Microsoft Defender for Cloud: This tool uses AI and analytics patterns.
targeting workload visibility across multi-cloud and hybrid a. Use Cases of Generative AI in Tools like AWS
infrastructures. These integrations demonstrate how useful AI GuardDuty
is for handling the massive amount of security data produced AWS GuardDuty is an ML-powered security offering for
by cloud platforms. By lowering false positives, AI-powered AWS purposes that works with a continuous flow of logs to
solutions free up security personnel to concentrate on real identify security events, including unauthorized attempts to
threats. Additionally, AI's predictive powers improve the access an AWS resource or indications of malware activity.
proactive detection of vulnerabilities, strengthening the The generative AI can also help GuardDuty by generating
security posture of the cloud as a whole. fake data that may mimic an upcoming actual attack so that
However, there are gaps in the use of AI, incredibly generative the system can be trained to detect such attacks or more
AI, for challenging security tasks in cloud computing. complex or new types of attacks [9]. For instance, a generative
Currently, generative AI, which comprises models that can adversarial network (GAN) can generate attack traffic that
create prosaic and creative solutions, is applied in cloud emulates the true nature of the threat. Training GuardDuty on
security operations less frequently than other AI methods. this enriched dataset makes it more capable of detecting these
1. Limited Exploration of Generative AI for Security anomalies, which conventional models might oversee (refer to
Automation Figure 1). Similarly, information derived from context-heavy
Other generative AI models, such as GANs and transformer sources such as the users’ activity log or similarity in patterns
models, have had some success in different domains, but their of API calls can be fed to transformer-based models to detect
applicability in automating security duties has been abnormal behaviors that point towards insider threat or
understudied. For example, generative AI could fake frequent privilege misuse.
assault patterns or produce fake data to ground other security b. Real-Time Data Processing and Pattern Recognition
algorithms. Such applications can significantly enhance the One of the most significant advantages of generative AI is its
stability of cybersecurity systems, although research in this ability to process and analyze large volumes of real-time data
field is scarce. provided by cloud computing systems. That is why all these
2. Optimizing SOAR Workflows tools, including Google Cloud Security Command Center, can
First, Cyber Security Orchestration, Automation, and have use cases for AI models to identify intricate patterns in
Response (SOAR) platforms are crucial tools in modern streaming data (refer to Figures 2 and 3). For example, a
security operations, but the saturation of generative AI across variational autoencoder (VAE) could take the input of live
these platforms is limited. SOAR workflows connect multiple network traffic and then highlight behavior that deviated from
tools and various data sources to automate threat-related norms for immediate action to be taken [10].
activities. Whereas AI improves some features, generative AI The analogy is invaluable in identifying multi-vector attacks
can further develop other features, like providing response where the strange signs may seem unrelated. Analytically
pattern generation based on specific threat types [8]. However, generative AI models can associate these irregularities and
limited resources about the technologies that underpin these expose the ongoing attack plan. This capability enhances
creative and adaptable generative AI workflows are available detection accuracy and enables one to distinguish actual
compared to the more common predictive or prescriptive threats from less important ones, thus easing the job of the
analytics-type approaches. security teams.
3. Scalability and Real-Time Processing a. Techniques to Optimize AI-Driven Threat Hunting
Cloud domains produce big data, which demands elastic and and Incident Response
near-real-time processing techniques. Recent literature on Generative AI can apply enhanced threat modeling to
generative AI in security is primarily premised on conceptual automate threat hunters' tasks of creating adaptive threat
models rather than design and implementation solutions that models to use during the hunt. For instance, finding past attack
are scalable to cloud services. information and generating other possible current or future
III. METHODOLOGY attacks is possible. These scenarios assist security teams in
The potential of generative AI to improve automated security preempting and uncovering some vulnerability situations.
operations in cloud computing systems is being studied using Another technique is the application of transformer models,
a variety of methodologies and frameworks. Three main areas which will be used for contextual threats. Transformer models
are examined: incorporating cloud-native security like BERT or GPT can decipher raw and unstructured data

Authorized licensed use limited to: Center for Science Technology and Information (CESTI). Downloaded on March 30,2025 at 04:13:36 UTC from IEEE Xplore. Restrictions apply.
 from logs, alerts, and user reports when solving an incident. Robust performance measures are necessary to assess
By putting this information into context, they can provide the generative AI's efficacy in security operations. Important
best remediation actions [11, 12]. metrics consist of (the metrics are summarized in Figure 4):
TABLE I. DIFFERENCES AND SIMILARITIES BETWEEN BERT Detection Accuracy: Based on the rate of the number of
(BIDIRECTIONAL ENCODER REPRESENTATIONS FROM TRANSFORMERS) AND
GPT (GENERATIVE PRE-TRAINED TRANSFORMER) threats identified by the AI system out of all the actual threats
[13].
Aspect BERT GPT Similarities False Positive Rate: To solve the problem of producing too
Primary Encoder-only Decoder-only Both are based many unnecessary alerts, generative AI could limit this
Architecture transformer. transformer. on the
transformer problem by ensuring security is not disrupted through
architecture. excessive notifications.
Training Masked Causal Both use
Objective language language unsupervised Response Time: Time needed to identify, assess, and address a
modeling modeling pre-training on threat. By automating crucial procedures, generative AI seeks
(MLM) and (predicting the large text
next sentence next word corpora.
to dramatically lower this statistic.
prediction sequentially). Resource Utilization: Savings when using AI to analyze CPU
(NSP). time, memory utilization, and bandwidth.
Directionality Bidirectional: Unidirectional: Both analyze
learns context learns context and model User Feedback: Weekly reports from security teams on the
from both left sequentially contextual usefulness and applicability of content identified by AI
and right of a from left to information
word right. from raw text algorithms after events.
data.
Application Focused on Focused on Both can be
Focus understanding generative tasks fine-tuned for
and (e.g., text specialized
classification completion, tasks.
tasks (e.g., summarization).
sentiment
analysis,
Q&A).
Output Outputs Outputs Both generate
contextual coherent embeddings for
embeddings sentences or input text,
for tokens, paragraphs. useful for NLP
not full tasks.
sentences.
Pre-training Typically Typically Both require
Dataset trained on trained on extensive
Wikipedia diverse, large- datasets to
and scale datasets capture diverse
BooksCorpus. (e.g., web text). language
representations.
Figure 4: Evaluating Generative AI in Security
Computational Lower due to Higher due to Both are
Cost its focus on its resource- B. Real-World Implementations
token autoregressive intensive but SOAR technologies aggregate many security solutions and
embeddings decoding for scalable with
and generation. distributed process the tasks of identification and response to threats.
bidirectional systems. Generative AI advances these systems through the additional
context.
Remediation Excels at Excels at Both can
feature of adaptive and intelligent orchestration.
Context analyzing generating process For instance, Splunk Phantom and Palo Alto Networks’
logs, alerts, human-like incident data Cortex XSOAR are SOAR platforms that involve machine
and structured remediation and
problem- instructions. recommend learning for flow automation. Generative AI needs to be
solving. remediation improved: build a live playbook based on the mentioned threat
strategies based
on their
types. In a Distributed Denial of Service (DDoS) attack,
contextual generative AI could respond by assigning more resources to
understanding. handle the handle while simultaneously banning the IPs
involved [13]. Another implementation deals with the
For incident response, generative AI helps automate the application of generative AI in layers of Security Information
creation of a playbook. In the SOAR environment, AI means and Event Management (SIEM) systems that feed into SOAR
that further response workflows can be created based on the systems. These AI models provide sound recommendations
identified threat type. For instance, an attack such as since they parse the log data, map events, and diagnose the
ransomware may initiate the following process: they might causes of a mishap. This integration guarantees faster and
initiate a flowchart that disconnects the compromised devices, more accurate rectification than rectifications in isolation.
perform a backup data recovery, and send an alert based on Validating generative AI in security work calls for various
the attack. rich data sources for training and demonstration. Common
b. Metrics for Measuring Performance Improvements sources include:
• Cloud Activity Logs: Logs from Google Cloud
Logging, Azure Monitor, or AWS CloudTrail include

Authorized licensed use limited to: Center for Science Technology and Information (CESTI). Downloaded on March 30,2025 at 04:13:36 UTC from IEEE Xplore. Restrictions apply.
 information about resource access patterns, API calls, and user example, AI can process a considerable amount of log data in
activities [14]. real time and, for instance, define nuance discrepancies,
• Threat Intelligence Feeds: Use threat intelligence revealing a possible security threat [17]. Generative AI also
feeds such as VirusTotal, Aberdeen Research, AlienVault, or generates fake datasets to create various attack vectors; the
IBM X-Force feeds as generic training data for AI about systems develop the ability to identify and counter all types of
known attack patterns. attacks.
• Synthetic Datasets: The other advantage of This integration has several advantages for organizations and
generative AI is that it can generate artificial datasets to model companies. First, it allows for threat identification at a higher
and include the specific types of attacks that are hard to level and earlier, significantly extending protection against
emulate. breaches or reducing the impact of violations at different
• Incident Reports: AI systems can learn from real- levels—financial and others. Besides, AI automation removes
world situations using historical data from previous instances. additional burdens from security teams and makes traffic more
• Live Traffic Analysis: It is possible to validate AI efficient for strategic decisions [18]. The flexibility of
performance in real time by monitoring actual network traffic. acknowledged cloud-native tools integrated with artificial
intelligence guarantees organizations’ security, including
startups
B. Enhancing Response Time and Accuracy in Cloud Security
Operations
Security data from multiple sources can then be fed to
generative AI, which can process and analyze the data in real
time, making it easier for organizations to be alert for the most
dangerous threats. For instance, AI systems may contain and
prioritize alerts by separating the dangerous ones from the
simple noise. This saves time and effort that security teams
spend analyzing the events and guarantees that severe threats
will be identified and solved rapidly.
This also means that using generative AI increases the
Figure 6: Data-Driven AI Security Insights
effectiveness of threat identification and countering [19].
The situations expected in testing should be as varied as
Traditional systems can be problematic, with high false
possible, including specific phishing attacks, internal threats,
positive results that overwhelm security teams with alerts.
and mass campaigns. Information from such tests is employed
Using generative AI to distinguish events from noise, for
to adjust the AI models and check their efficiency in
instance, relating different incidents to determine
identifying threats and reacting.
synchronized acts of terror, lowers the rate of false positives.
IV. RESULTS AND DISCUSSION
Further, AI-integrated models can recommend appropriate
A. Integrating AI with Cloud-Native Security Tools
response actions that match the incident's properties, thereby
Software solutions such as AWS GuardDuty and Google
improving the impacts of the protective measures [20].
Cloud Security Command Center have been developed to
Individual companies using artificial intelligence report
address the security challenges of cloudy architectures.
outstanding gains in managing security and safety. For
Combined with generative AI, these tools can strengthen
example, Capital One is employing AI in banking, a financial
organizational security by providing additional layers of data
firm that uses the technology in security to lower response
analysis, quicker identification of strange behavior, and
time and increase precision. These risks have, therefore, been
predictive threat mapping ability [15].
mitigated at Capital One through the adoption of AI that can
Organizations using AWS GuardDuty include Netflix, which
monitor millions of daily instances and guarantee proximity to
shows how the firm has incorporated the feature into its
financial regulations. Similarly, global healthcare centers like
security management strategies. Netflix has adopted the
the Mayo Clinic use artificial intelligence security measures to
GuardDuty AI service to watch millions of log entries for
safeguard patients' vital information [21]. These systems
potential suspicious activities [16]. This proactive approach
immediately identify unauthorized entry attempts and legal
helps Netflix keep the environment safe for streaming services
requirements, such as HIPAA, in healthcare facilities.
while providing a smooth customer experience.
C. Security Orchestration, Automation, and Response (SOAR)
Besides, Shopify uses Google Cloud Security Command
Systems
Center to safeguard its Shopify e-commerce platform.
SOAR systems are critical in contemporary security
Shopify, which incorporates the AI models into the Command
operations because they can centrally coordinate and automate
Center, will effectively attain the capability to analyze the
security processes. When integrated with generative AI,
security telemetry data and correlate and prioritize the events.
SOAR systems work synergistically, providing the tools to
This capability quickly responds to threats to protect customer
help organizations effectively manage and defeat threats.
data and thus enhances trust. These systems increase
Generative AI improves SOAR systems by generating real-
capabilities manifold, particularly in pattern recognition,
time playbooks that allow an organization to respond to an
anomaly detection, and context-aware threat detection. For

Authorized licensed use limited to: Center for Science Technology and Information (CESTI). Downloaded on March 30,2025 at 04:13:36 UTC from IEEE Xplore. Restrictions apply.
 incident. The AI-created checklists are based on the details of
each scenario and describe the proper course of action for [1] M. Dawood, S. Tu, C. Xiao, H. Alasmary, M. Waqas, and S. U. Rehman,
“Cyberattacks and Security of Cloud Computing: A Complete Guideline,”
security teams. Also, AI systems can rehearse scenarios, Symmetry, vol. 15, no. 11, pp. 1–33, Nov. 2023, doi:
enabling organizations to assess the validity of the designed https://doi.org/10.3390/sym15111981.
workflows for mitigating new threats. AI is also prominent in [2] R. Kaur, D. Gabrijelčič, and T. Klobučar, “Artificial Intelligence for
SIEM tools, threat intelligence feeds, and cloud-native Cybersecurity: Literature Review and Future Research Directions,”
Information Fusion, vol. 97, no. 101804, p. 101804, 2023, doi:
security platforms, where SOAR systems can correlate https://doi.org/10.1016/j.inffus.2023.101804.
multiple sources of information. The proposed approach offers [3] N. Mohamed, “Current Trends in AI and ML for cybersecurity: a state-
security teams a unified picture of the security environment, of-the-art Survey,” Cogent Engineering, vol. 10, no. 2, Oct. 2023, doi:
which enhances the decision-making process. Banks like https://doi.org/10.1080/23311916.2023.2272358.
[4] S. Islam, M. A. Hayat, and M. F. Hossain, “ARTIFICIAL
JPMorgan Chase already use AI-boosted SOAR systems to INTELLIGENCE FOR CYBERSECURITY: IMPACT, LIMITATIONS AND
manage their security affairs. These systems automate the FUTURE RESEARCH DIRECTIONS,” Dec. 27, 2023.
investigation process of alerts, lowering the period it takes to https://www.researchgate.net/publication/377019141_ARTIFICIAL_INTELL
IGENCE_FOR_CYBERSECURITY_IMPACT_LIMITATIONS_AND_FUT
neutralize threats. JPMorgan Chase has improved operation URE_RESEARCH_DIRECTIONS
efficiency and implemented more robust security measures [5] M. Fortuna and R. Sakaria, “Visualizing Amazon GuardDuty findings,”
using generative AI [22]. The retail sector also uses AI- Amazon Web Services, Sep. 06, 2018.
supported SOAR systems. For instance, Walmart uses SOAR https://aws.amazon.com/blogs/security/visualizing-amazon-guardduty-
findings/
platforms to protect its facilities worldwide from cyber threats. [6] “Security Command Center,” Google Cloud.
The application of generative AI in Walmart’s environment https://cloud.google.com/security/products/security-command-center
improves methods of identification and response to incidents [7] S. Potti, “Introducing Security Command Center Enterprise: The first
multicloud risk management solution fusing AI-powered SecOps with cloud
and protection of supply chain and customer data [23]. security,” Google.com, 2024. https://cloud.google.com/blog/products/identity-
However, there is always the possibility of overdependence on security/introducing-security-command-center-enterprise (accessed Nov. 28,
artificial intelligence systems. Organizations can regard AI as 2024).
an infallible system that automatically addresses all security [8] S. Shea, “What is SOAR (Security Orchestration, Automation and
Response)? A definition from WhatIs.com,” SearchSecurity.
concerns, ignoring human supervision issues. Nevertheless, as https://www.techtarget.com/searchsecurity/definition/SOAR
with any system used in practice, even generative AI is never [9] R. Nowrozy, “GPTs or Grim Position Threats? The Potential Impacts of
perfect; it is outstanding at automating routine operations and Large Language Models on Non-Managerial Jobs and Certifications in
identifying outliers. False positives and false negatives are Cybersecurity,” Informatics, vol. 11, no. 3, p. 45, Jul. 2024, doi:
https://doi.org/10.3390/informatics11030045.
inherent in any artificial intelligence system and can cause [10] J. Liu et al., “Multi-Channel Multi-Scale Convolution Attention
missed threats or unnecessary disturbances. Variational Autoencoder (MCA-VAE): An Interpretable Anomaly Detection
V. CONCLUSION Algorithm Based on Variational Autoencoder,” Sensors, vol. 24, no. 16, pp.
5316–5316, Aug. 2024, doi: https://doi.org/10.3390/s24165316.
Generative AI has become an innovative technology in [11] V. Bertalan and D. Aloise, “Using Transformer Models and Textual
cloud security because it can power a broad range of security Analysis for Log Parsing,” 2023 IEEE 34th International Symposium on
use cases for organizations. Generative AI is connected to Software Reliability Engineering (ISSRE), pp. 367–378, Oct. 2023, doi:
cloud-native tools such as AWS GuardDuty and the Google https://doi.org/10.1109/ISSRE59848.2023.00037.
[12] I. Jahan, T. Rahman, C. Peng, and J. X. Huang, “A comprehensive
Cloud Security Command Center to enhance real-time data evaluation of large Language models on benchmark biomedical text processing
processing and increase the accuracy of threats while tasks,” Computers in Biology and Medicine, pp. 108189–108189, Feb. 2024,
decreasing the time necessary for their detection. Its additional doi: https://doi.org/10.1016/j.compbiomed.2024.108189.
[13] Z. R. Alashhab, M. Anbar, M. M. Singh, I. H. Hasbullah, P. Jain, and T.
contribution to enhancing Security Orchestration, Automation, A. Al-Amiedy, “Distributed Denial of Service Attacks against Cloud
and Response (SOAR) systems indicates its ability to solve Computing Environment: Survey, Issues, Challenges and Coherent
sophisticated security issues based on successful use cases in Taxonomy,” Applied Sciences, vol. 12, no. 23, p. 12441, Jan. 2022, doi:
Netflix, Shopify, and JPMorgan Chase’s firms. However, this https://doi.org/10.3390/app122312441.
[14] C. Hall, “Key Log Sources in the 3 Main Cloud Providers,”
generative AI has its drawbacks. Sometimes, it may bring Cadosecurity.com, Aug. 09, 2024. https://www.cadosecurity.com/blog/key-
information the user does not require or need. Overloading the log-sources-in-the-3-main-cloud-providers (accessed Nov. 28, 2024).
AI systems presents overconfidence in manual monitoring, [15] S. Sai, U. Yashvardhan, V. Chamola, and B. Sikdar, “Generative AI for
and adversarial attacks are always a potential threat to AI Cyber Security: Analyzing the Potential of ChatGPT, DALL-E and Other
Models for Enhancing the Security Space,” IEEE access, vol. 12, pp. 1–1, Jan.
models. This means that decisions made by AI are not easily 2024, doi: https://doi.org/10.1109/access.2024.3385107.
explained to others, which poses a significant challenge [16] S. M. Kerner, “How Netflix Secures AWS Cloud Credentials | eSecurity
regarding the level of trust and compliance. Planet,” eSecurityPlanet, Aug. 10, 2018.
https://www.esecurityplanet.com/cloud/how-netflix-secures-aws-cloud-
However, there is good potential for further development credentials/
of generative AI in cloud security. Progressive innovation of [17] T. Adewale, “Artificial Intelligence in Cloud Security: Use Cases and
its detection accuracy, adaptability, and multi-cloud will also Benefits,” Nov. 01, 2024.
enhance its strength in the future. Overcoming its drawbacks https://www.researchgate.net/publication/385509493_Artificial_Intelligence_i
n_Cloud_Security_Use_Cases_and_Benefits
and integrating AI with human support, generative AI can be [18] I. Jada and T. O. Mayayise, “The impact of artificial intelligence on
an essential building block in protecting ever-more intricate organisational cyber security: An outcome of a systematic literature review,”
cloud environments from today’s and upcoming cyber threats. Data and Information Management, vol. 8, no. 2, pp. 100063–100063, Dec.
2023, doi: https://doi.org/10.1016/j.dim.2023.100063.
REFERENCES

Authorized licensed use limited to: Center for Science Technology and Information (CESTI). Downloaded on March 30,2025 at 04:13:36 UTC from IEEE Xplore. Restrictions apply.
 [19] S. S. Thakur, “Generative AI Use Cases in Cloud Operations,” ai-and-healthcare-safeguarding-security-and-compliance-amidst-this-rapid-
RTInsights, Oct. 25, 2024. https://www.rtinsights.com/the-role-of-generative- transformation/
ai-in-enhancing-cloud-operations-real-use-cases/ (accessed Nov. 28, 2024). [22] J.P. Morgan, “AI Boosting Payments Efficiency & Cutting Fraud | J.P.
[20] A. Takyar, “AI in Incident Response: Exploring Use cases, Solutions and Morgan,” www.jpmorgan.com, Nov. 20, 2023.
Benefits,” LeewayHertz - AI Development Company, May 28, 2024. https://www.jpmorgan.com/insights/payments/payments-optimization/ai-
https://www.leewayhertz.com/ai-in-incident-response/ payments-efficiency-fraud-reduction
[21] “The Convergence of AI and Healthcare: Safeguarding Security and [23] J. Geisler, “How Walmart protects against cyber threats,” How Walmart
Compliance Amidst this Rapid Transformation,” www.datadynamicsinc.com, protects against cyber threats, Mar. 13, 2022.
Aug. 25, 2023. https://www.datadynamicsinc.com/blog-the-convergence-of- https://tech.walmart.com/content/walmart-global-tech/en_us/blog/post/how-
walmart-protects-against-cyber-threats.html

Authorized licensed use limited to: Center for Science Technology and Information (CESTI). Downloaded on March 30,2025 at 04:13:36 UTC from IEEE Xplore. Restrictions apply.