If you look at any suburb this Halloween, you’ll see countless monsters roaming the streets. Vampires, creatures and ghouls all “wreaking havoc” (going to parties and trick-or-treating).
The real monsters, though, don’t look like this. They don’t announce themselves as a threat, even jokingly. They dress themselves up in the costume of harmless, helpful allies.
While businesses just like yours are using AI tools to support security and productivity, cybercriminals can also use AI to make deceptive content and communications appear more convincing.
As night falls and the monsters come out in full force on Halloween night, remember that keeping your business safe doesn’t mean being an expert scam-spotter. It means following a few core tenets of security to help recognize and respond to potential AI-powered threats. Garlic around your neck won’t help you here; it’s all about these simple processes and safeguards.
AI shapeshifters: Sounding right isn’t enough anymore
Voice and video can appear convincing, but they shouldn’t automatically be treated as proof that someone is who they claim to be. With AI, scammers can use synthetic media to create realistic voice messages, calls or videos designed to make fraudulent requests appear legitimate.
Government cybersecurity guidance recognizes that deepfakes can be used to impersonate leaders and financial officers and potentially facilitate access to sensitive information and systems. [media.defense.gov]
Instead of relying solely on an employee’s ability to recognize manipulated media, use established verification procedures for sensitive requests such as money transfers or account changes. These shapeshifters present a challenge to what employees see and hear, which makes strong verification procedures and appropriate authentication controls even more important.
AI mummies: Wrapped in a new, more dangerous cloth
In past years, spelling and grammatical mistakes were common warning signs associated with some phishing messages. Typos, generic greetings, unusual urgency and other inconsistencies could provide clues that something wasn’t right.
Those warning signs aren’t always there. Well-written messages can still be fraudulent, making it important to consider the request itself rather than relying only on spelling and grammar.
Like an ancient mummy rising from the tomb, these scams may look different on the surface, but the underlying goal can remain the same. Look beyond the appearance of the message and pay attention to unusual or unexpected requests. Don’t become comfortable with an email just because it gets the details right and is spelled properly.
AI vampires: Never invite them in
In vampire myths, innocents are protected by not inviting vampires into their homes, as these creatures cannot enter enclosed spaces without direct permission. AI tools present a different but useful version of that lesson: employees should be careful about what business information they provide to AI services.
When employees use AI tools, especially tools that haven’t been approved by the company, sensitive business information may be handled in ways the organization hasn’t evaluated or authorized.
Before entering sensitive information into an AI tool, employees should understand whether the tool is approved for that type of business data and follow the company’s policies for handling protected information.
CISA's current AI security resources emphasize the importance of data security when organizations adopt and operate AI systems. [cisa.gov]
The best defense against AI monsters? Better rules.
Advancements in AI can make some forms of deception more convincing and create new cybersecurity considerations for businesses. Clear procedures can help employees know what to do when they encounter an unusual request, suspicious message or unfamiliar AI tool.
Need help taking a closer look at how your business is approaching AI and cybersecurity? Schedule a free 10-minute discovery call.
We’ll discuss how your employees use AI, how sensitive requests are verified and what protections you have in place already. The conversation can help identify areas that may deserve a closer look as AI-related risks continue to evolve.
Call us at 206.414.7441 or schedule a free 10-minute discovery call.