Cloud Concepts, Architecture and Design · Topic 5 of 5
AI, ML and Emerging Technologies in the Cloud
CCSP AI and ML for cloud threat detection, data validation, SOAR, ethics and regulation, plus blockchain, IoT, edge, quantum and confidential computing.
- 5 min
- ML detection depends on validated, complete, untampered data.
- SOAR automates response through playbooks; keep humans on high impact steps.
- Ethics covers bias, transparency, privacy, accountability and human oversight.
What it is
Many technologies are built on, or delivered through, the cloud: artificial intelligence and machine learning, data science, blockchain, the Internet of Things, containers, edge, quantum and confidential computing. Each changes the risk picture.
AI and ML get their own outline section because they cut both ways. They help defenders detect and respond to threats, and they bring new duties around data quality, ethics and regulation.
How it works
Impact of related technologies
| Technology | What it is | Main security concern |
|---|---|---|
| Data science and ML | Analysing large data sets, training models | Data aggregation, privacy, model integrity |
| AI | Systems that generate content or make decisions | Misuse, data leakage, prompt injection |
| Blockchain | Distributed, append only ledger | Key loss is permanent; immutability conflicts with erasure rights |
| IoT | Large numbers of connected devices sending data to the cloud | Weak device security, patching, scale of identities |
| Containers | Packaged applications sharing a host kernel | Image integrity, isolation, orchestration security |
| Quantum computing | Computing that could break today's public key algorithms | Harvest now, decrypt later; migrate to post-quantum cryptography |
| Edge computing | Processing close to where data is produced | Physically exposed nodes, distributed management |
| Confidential computing | Protecting data in use inside hardware trusted execution environments | Trust in the hardware vendor, attestation |
NIST published its first post-quantum standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). Crypto agility, the ability to swap algorithms without redesign, is the key design goal.
AI and ML for cloud threat detection and analysis
Cloud environments produce huge volumes of logs. ML helps by:
- Anomaly detection: learning normal behaviour for users, workloads and API calls, then flagging deviations such as a key used from a new country.
- Classification: sorting alerts into likely benign and likely malicious to reduce noise.
- Correlation: linking events across services into one incident.
- Assistance: generative AI that summarises an incident or drafts a query for an analyst.
Models produce false positives and false negatives. They need tuning, monitoring for drift as the environment changes, and human review of important decisions.
Data source validation and verification
A detection model is only as good as its inputs. Before data is used for training or detection, verify that it is:
| Check | Example |
|---|---|
| Authentic | Logs come from the expected source, ideally signed or sent over authenticated channels |
| Complete | No gaps in time or missing sources |
| Accurate and consistent | Clocks synchronized, fields parsed correctly |
| Untampered | Integrity protected so an attacker cannot hide activity or poison training data |
| Representative | Training data reflects the real environment, including recent changes |
Poisoned or incomplete data teaches the model that attacks are normal. Protection of the AI data itself is covered in Domain 2.
SOAR
Security orchestration, automation and response platforms connect security tools and run playbooks: predefined workflows that enrich an alert, contain a threat and open a ticket. AI can recommend or trigger playbooks.
High impact actions, such as shutting down production, should keep a human approval step. Playbooks are code and need change control.
Ethical concerns
- Bias and fairness: models can treat groups unfairly, for example by flagging some users more often.
- Transparency and explainability: people affected by a decision should be able to understand it.
- Privacy: monitoring and training on user behaviour must be lawful and proportionate.
- Accountability: a named person or function owns each AI system and its outcomes.
- Human oversight: humans can review, override and stop the system.
Regulatory requirements
| Instrument | Key point |
|---|---|
| EU AI Act | In force 1 August 2024; prohibited practices apply from 2 February 2025 and general purpose AI obligations from 2 August 2025. The Digital Omnibus moved high-risk obligations to 2 December 2027 (Annex III uses) and 2 August 2028 (regulated products). |
| GDPR | Applies when AI processes personal data, including rules on solely automated decisions with significant effects |
| NIST AI RMF 1.0 | Voluntary framework with four functions: Govern, Map, Measure, Manage |
| ISO/IEC 42001 | Certifiable AI management system standard |
The EU AI Act is risk based: unacceptable risk practices are banned, high-risk systems carry strict duties, and other systems carry lighter transparency duties.
A worked example
A company deploys an ML service that flags unusual cloud API activity. After a month the model stops flagging logins from a new region. Investigation shows the region's logs were never sent to the training pipeline, so all activity there looked normal.
The fix is data source validation: an inventory of expected sources, completeness checks that alert on missing feeds, and retraining after the gap is fixed. A SOAR playbook that disables keys automatically is kept, but a human must approve disabling any production service account.
How the exam asks about this
- "What should be verified BEFORE log data is used to train a threat detection model?" Its source, integrity and completeness.
- "Which tool runs predefined response workflows across security products?" SOAR.
- "Which emerging technology protects data while it is being processed?" Confidential computing.
What to remember for the exam
- ML detection depends on validated, complete, untampered data.
- SOAR automates response through playbooks; keep humans on high impact steps.
- Ethics covers bias, transparency, privacy, accountability and human oversight.
- NIST AI RMF functions are Govern, Map, Measure, Manage; ISO/IEC 42001 is certifiable.
- Quantum computing threatens current public key cryptography; plan for crypto agility.
Automated AI decisions do not move accountability. The organization remains responsible for what its AI tools decide and do.
Common mistakes
Trusting model output without validating input. Missing or poisoned data produces confident but wrong results.
Fully automating destructive responses. An automated playbook that deletes resources on a false positive becomes a self-inflicted outage.
Treating blockchain as private by default. Data written to a public ledger is visible and hard to remove.
Check yourself
Why is data source validation important for AI threat detection?
Because missing, inaccurate or tampered data teaches the model wrong patterns, so real attacks may look normal.
What does a SOAR playbook do?
It runs a predefined workflow that enriches, contains and records an alert across connected security tools.
What are the four functions of the NIST AI RMF?
Govern, Map, Measure and Manage.
Topic 5 of 5 in Cloud Concepts, Architecture and Design
Test yourself on Cloud Concepts, Architecture and Design
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.