The attackers automate too
Apr 16th, 2025 by Jesper Kråkhede
While we discuss AI in the SOC, the attackers have been using it for a while.
Phishing mails used to be easy to spot. Bad grammar, strange formatting, generic greetings. Not anymore. Language models write perfect, personal mails in any language, adapted to the recipient´s role and recent news about the company. The old awareness training advice about spelling errors is close to useless now.
Voice is next. With a few seconds of recorded speech, a voice can be cloned well enough to fool a colleague on the phone. Deepfake video calls have already been used to trick employees into transferring large sums of money.
Reconnaissance is faster. Collecting information about an organisation, its people, its technology and its suppliers can be largely automated.
What does that mean for defence? Technical controls become even more important, because you can´t rely on people spotting the fake. Phishing resistant MFA, so stolen passwords and codes are useless. Conditional Access and device requirements, so a stolen session can´t be used from anywhere. Email protection that looks at behaviour and links, not just content.
And processes that don´t depend on recognising a voice or a face. A payment change or a password reset should be verified through a separate, known channel, no matter how convincing the request is.
When anyone can sound like your CEO, the process is your protection.