The most natural place where artificial networks can be used in information security is in attack detection.
The security team leaders of more than one web hosting company told me the same story. Their teams' daily challenges are to defend against the attacks mounted continuously by several overseas teams against the IT security of their hosting infrastructure. Attack teams specialize in one target hosting company, and there are often many attack teams on one defensive security team.
The hosting company security teams try to preemptively defend the assets of their companies from attacks. These teams also have to restore their hosting system with minimal impact on hosted sites whenever an attack achieves its goal, which may be data corruption, data theft, the insertion of malware, or some other manipulation.
The primary mechanism for preemptive defense is detection of an attacker and an ascertaining the attack's intended target within the hosting infrastructure's defenses, after which known blocks to these attacks are employed, such as IP or MAC filters, modification of access rights, upgrades that plug known security holes, or other measures.
The progress of attacks occur across some set of changing fronts, as in a war or a game of chess. Information security may soon become largely a game between two sets of computer systems. One trying attacks, and the other trying to detect and block them.
For the defending team, high speed, real time detection of the attack is key. A properly designed deep learning solution, configured and integrated into a defensive system, is more likely to block an attack than a person watching a dashboard of log file stats and system metrics. A deep network could also be trained to discover the subsystem or specific defense against which the attack is intended.
Once detection occurs, the application of patches, exclusion filters, and denial criteria may best be accomplished through a rules based system.