By Richard Ford, CTO, Integrity360

For years, the standard cyber security advice has been to look for warning signs: poor spelling, odd grammar, an unfamiliar email address, a message that does not sound like the person supposedly sending it. Artificial intelligence (AI) is making those warning signs much harder to find.

Cybercriminals can now use AI to write convincing emails in seconds, replicate voices and hold conversations that feel authentic. A badly written phishing email sent to thousands of people can become a personalised message that names the recipient’s job, employer and colleagues.

Personalised attacks don’t need weeks of research

Phishing, impersonation and social engineering are not new phenomena in any way. AI changes the quality and speed of these attacks. A highly targeted attack once demanded research: the attacker had to study an organisation, pick the right employee and learn enough about them to make a believable approach. AI shortens that process.

People leave a great deal of information about themselves online, including job titles, employers, colleagues, conferences, suppliers and professional interests. Combined with conversational AI, that gives criminals what they need to personalise approaches at a scale that was previously impractical.

The most dangerous message may be an ordinary one. A supplier asks to change the banking details on an invoice, or someone claiming to be a senior executive makes an urgent payment request, and each arrives with enough accurate context to be believed. As credibility rises, the old advice to “spot the phishing email” becomes less useful.

A familiar voice proves little

Email is only part of the problem. AI-generated voices and increasingly sophisticated synthetic content undermine the cues people use to decide whom to trust. An employee who gets an unusual email might phone the sender to check. What happens when the voice on the line can be convincingly cloned as well?

Organisations should not assume every communication is fraudulent, but identity verification has to carry far more weight. Organisations need processes that let employees verify sensitive requests independently, especially those involving payments, confidential information or system access. Trust cannot rest on how genuine an email looks or how familiar a voice sounds.

Fake candidates are a new way in

Recruitment deserves more attention. Organisations are used to thinking about criminals breaking into networks, and are less ready for someone entering through the hiring process. AI can produce convincing CVs, manipulate interviews and support synthetic candidates, which lets a threat actor get further into hiring than traditional checks anticipated.

A successful candidate receives legitimate credentials and sight of sensitive information, so an attacker no longer needs a technical vulnerability. Recruitment teams, HR departments and business leaders share responsibility for verifying identity alongside IT.

Employees should not carry this alone

Security awareness still matters, but its limits are clear. When fraudulent messages are hard to tell from genuine ones, telling employees to “be more careful” is not enough. The response needs awareness plus stronger processes.

Multi-factor authentication makes stolen credentials harder to use, and least-privilege access limits the damage if an identity is compromised. Continuous monitoring then helps spot suspicious behaviour after an attacker gets in. Employees also need a simple way to verify sensitive requests, so they know exactly what to do when something feels wrong and do not have to make difficult security judgements alone.

AI erodes the cues people have long used to judge whether somebody is who they claim to be. Organisations should respond by building ways to verify identities, access and sensitive requests, even when everything looks and sounds genuine.