5 Ways AI Cyberattacks Target Your Organization and What to Do Now

Summary

AI cyberattacks are changing the shape of cybersecurity risk, not by replacing human attackers, but by making them faster, more convincing, and harder to catch. In this article John Otte breaks down five specific ways attackers are using AI today, from phishing that no longer looks like phishing to deepfake-enabled fraud, and outlines the concrete controls that reduce risk for each one.

[Estimated read time: 10 minutes]

AI didn’t create new attacks. It made the old ones better and faster.

Artificial intelligence is changing cybersecurity, but not in the way many people think. We tend to imagine an AI cyberthreat as the Terminator: an autonomous machine that identifies a target, plans the attack, and carries it out on its own.

In reality, AI acts more like a highly capable power tool wielded by a human adversary. Attackers are using AI to make the same attacks as before, but faster, cheaper, more convincing, and harder to detect:

• Phishing is written better
• Impersonation is more believable
• Reconnaissance is faster
• Fraud attempts are more targeted
• Malware development is easier to scale

Additionally, attacks don’t solely come via email attachments anymore. They can come through daily use platforms and apps that weren’t previously considered threat surfaces. AI gives average attackers the ability to operate with more speed, volume, entry points, and credibility than even just last year. It’s raised the baseline.

Here’s what that shift looks like from where I sit. Fifteen years ago, the attacks I investigated were obvious: clumsy grammar, a sketchy link, a story that fell apart when you read it twice. Today I spend far more time helping organizations respond to attacks that did everything right: the email sounded like their CFO, the invoice matched a real vendor, the timing lined up with a current project. The tools got better, but the bigger change is that mediocre attackers can now operate like good ones.

If your organization’s security program can only spot bad grammar, obvious scams, and amateur tactics, you’re already behind. A strong cybersecurity program adjusts its controls, training, and response processes to match the new reality.

Here are five ways attackers are using AI against organizations today and what you can do about it.

1. AI-written phishing that no longer looks like phishing

For years, users were trained to spot phishing by its flaws: misspellings, awkward grammar, strange formatting, and implausible stories about Nigerian princes or stranded friends.

AI has erased many of those tells, allowing attackers to produce messages that are clean, urgent, and contextually believable. These messages may be written in the tone of a vendor, executive, coworker, or customer. They can reference current events, business terminology, job roles, industry language, or publicly available company information. They can also be generated at scale, allowing attackers to test different messages quickly and refine what works, resulting in an increased likelihood of employees clicking a link, opening an attachment, approving a request, or entering credentials into a fake login page.

I keep a folder of phishing emails clients have forwarded me, and the ones from the last year barely resemble the ones from five years ago. One that stuck with me was addressed to a controller, referenced a real acquisition the company had announced that same week, mirrored the CFO’s actual writing style, and asked her to expedite a wire to “close things out before quarter-end.” There was nothing to catch by eye. What saved that company was a standing rule that no wire moved without a callback on a known number, and she made the call.

What to do about it

Organizations need updated security awareness programs that train users to recognize suspicious behavior, unusual requests, Multi-factor Authentication (MFA) codes they didn’t originate, unexpected urgency, and changes in normal business process as indications of cyberthreats. Security awareness should also include training users how to verify or discredit these instances through a trusted channel.

Technical controls still matter. Email filtering, attachment scanning, domain protection, MFA, conditional access, and phishing-resistant authentication all help reduce risk. But the human process must mature, as users are an organization’s first line of defense.

2. Deepfake voice and video impersonation

Attackers can use voice cloning or deepfake technology to impersonate executives, employees, vendors, or business partners:

• A phone call that sounds like the CEO’s voice
• A video message that seems to come from a senior leader
• A voicemail from a vendor asking for an urgent payment change

These attacks are especially dangerous because they exploit trust, authority, and urgency. The most likely targets are finance, HR, procurement, executive assistants, IT help desk teams, and anyone with the ability to approve payments, reset credentials, change vendor information, or grant access.

Deepfake attacks don’t need to be perfect to succeed. They only need to be convincing enough in the moment, especially when combined with urgency and pressure.

The first time I saw a cloned voice used in a live attack, it wasn’t perfect. A finance employee got a call that sounded like a senior leader, slightly rushed, asking to push a payment change through. The “bad connection” actually helped the attacker; it covered the imperfections in the audio. She nearly did it. What stopped her was a single trained instinct: we verify payment changes out-of-band, every time, no exceptions. That habit, not any piece of technology, was the control that worked.

What to do about it

It’s unreasonable to expect every employee to become a deepfake expert. Organizations must strengthen verification procedures.

Require out-of-band verification for any request that arrives by voice or video: confirm it through a known, different channel rather than the one the request came in on, and never use a callback number the message itself provided.

Document the verification. Train employees that slowing down isn’t insubordination; it’s part of the control environment. Point 5 below covers the fuller set of business processes this protects, from payment changes to credential resets.

3. Automated reconnaissance and targeting

Attackers do their homework. AI helps them do it faster.

Attackers review websites, LinkedIn profiles, job postings, press releases, vendor pages, exposed systems, employee roles, technology stacks, and past breaches. AI accelerates this process by summarizing large amounts of public information and identifying useful attack paths:

• Who to impersonate
• What language to use
• Which systems to target
• Which employees may have useful access

This is where cybersecurity and business exposure overlap. I’ve run these open-source reviews for clients, and it’s sobering how much you can assemble in an afternoon without ever touching their network. From public sources alone I’ve been able to name who runs payroll, identify the exact remote-access product in use from a job posting, map the executive team, and find a forgotten login portal still answering on an old subdomain.

Your public information may be useful for marketing, recruiting, and sales, but it also helps attackers build more credible attacks.

What to do about it

Organizations should manage their external attack surface and public information with more discipline.

Understand what information is publicly available and how it could be abused. Review websites, employee directories, job postings, vendor references, exposed login portals, cloud assets, and internet-facing systems.

Security teams should regularly ask:

• What can an attacker learn about us without logging in?
• Can they identify our key employees, vendors, tools, and business processes?
• Are we exposing unnecessary technical details?
• Are old systems, forgotten domains, or unused portals still online?
• Do our executives and high-risk employees have enhanced protections?

Attack surface management, vulnerability management, domain monitoring, external scanning, and executive protection all become more important in this environment. Reducing unnecessary exposure makes it harder for attackers to turn that information into a successful attack.

4. Faster malware, scripting, and attack development

AI can help attackers write scripts, modify code, create phishing kits, generate fake documents, and solve technical problems. It lowers the barrier to entry for less-skilled attackers while helping experienced attackers work faster.

Most breaches don’t rely on sophisticated techniques. After 15 years and a lot of incident response, I can tell you the breaches I get called into are rarely exotic. They’re an unpatched system someone meant to get to, an exposed remote-access port, a shared admin password, a backup nobody had tested.

AI helps attackers exploit gaps faster, making speed of detection and response even more critical. The organizations that weather this well aren’t the ones with the most tools; they’re the ones that do the boring things consistently.

What to do about it

Execute the fundamentals consistently. They’re not glamorous, but neither are security breaches.

• Patch critical vulnerabilities quickly
• Remove unnecessary remote access
• Enforce MFA. Limit administrative privileges
• Monitor endpoints
• Centralize logs
• Protect backups
• Segment critical systems
• Review identity and access permissions
• Test incident response procedures

Organizations should also strengthen detection and response. If attackers can move faster with AI, your organization can’t rely on slow manual processes, unclear ownership, or delayed escalation. Define alert triage procedures, establish clear incident response roles, ensure logs are centralized and available, and test backups before they’re needed.

Operational maturity is the best defense against these faster attacks.

5. AI-powered business fraud

Not every AI-enabled attack needs a voice, a face, or a video. Some of the most damaging ones show up as paperwork: a fake invoice, a fabricated vendor email, a synthetic document, or a convincing thread with no cloned voice involved at all. These attacks often target finance, procurement, HR, and executive workflows directly, without ever impersonating a specific person.

In my experience, this is the category that costs organizations the most, and it rarely involves anything a firewall would notice. They often have cybersecurity tools in place but weak business process controls. I’ve seen a vendor’s banking details changed on the strength of one emailed request, with the fraud only discovered weeks later when the real vendor called asking where their money is. MFA may be deployed, but the help desk may reset access based on a convincing phone call. Endpoint protection may be working, but HR may still accept sensitive changes without proper validation.

When I assess an organization now, I spend as much time on the payment change and help desk reset workflows as I do on the network because that’s where the loss happens. AI makes business fraud more believable, and that means business controls need to be treated as cybersecurity controls.

What to do about it

Organizations should identify high-risk workflows and strengthen the controls around them. Start with finance, HR, procurement, IT help desk, legal, and executive support. Review any process that involves money movement, sensitive data, access changes, vendor updates, payroll, or privileged accounts.

For each process, ask:

• What could go wrong if this request were fake?
• Who can approve the change?
• How is the request verified?
• Is approval documented?
• Can one person complete the entire transaction?
• Are exceptions tracked?
• Would we be able to prove the process was followed?

Require callback procedures using known numbers. Use dual approval for high-risk transactions, separating the person requesting from the person approving. Separate duties where possible. Document exceptions. Train employees not to bypass controls because a request appears urgent or comes from a senior person.

AI-enabled fraud succeeds when process gives way to pressure. Strong organizations make the secure path the standard path.

The bigger issue: AI raises the standard of care

AI makes traditional cybersecurity controls more important, not less so.

Organizations still need patching, MFA, endpoint protection, logging, backups, vulnerability management, incident response, access controls, and user training. But they also need to rethink how those controls operate in a world where attacks are more personalized, more polished, and more scalable.

None of the controls above eliminate risk; they reduce it. This has governance implications: how much risk is left over, and whether that’s acceptable, is a deliberate organizational decision. Reasonable cybersecurity requires understanding the risk, implementing appropriate safeguards, testing those safeguards, and documenting that decisions were thoughtful, risk-based, and defensible.

AI changes what “reasonable” may require because it changes the threat environment.

What leaders should do now

Disciplined action, not fear, is what AI-enabled attacks call for.

Executives and boards should be asking whether the organization has adapted its risk management program to account for AI-enabled threats. That doesn’t mean buying every new AI security product on the market. It means evaluating the real risk, updating controls where needed, and documenting decisions.

Start by identifying where AI makes your organization most vulnerable. For many organizations, the answer will be phishing, impersonation, payment fraud, credential theft, and exposed external systems. Then evaluate whether your current controls are sufficient.

At a minimum, leaders should ensure the organization is doing the following:

• Updating security awareness training to address realistic AI-enabled phishing and impersonation.
• Requiring verified business processes for payments, vendor changes, payroll updates, access requests, and credential resets.
• Strengthening identity controls, including MFA, conditional access, least privilege, and privileged access management.
• Reducing external exposure through vulnerability management, attack surface reviews, and public information discipline.
• Testing incident response plans against scenarios involving phishing, deepfakes, business email compromise, and credential compromise.

AI is helping attackers move faster and sound more convincing. Your organization does not need to be perfect, but it does need to be prepared.

The best defense is a security program that combines technology, process, training, governance, and evidence, not any single tool. That’s what turns cybersecurity from a collection of products into a defensible business capability.

If I could get every leader to do one thing after reading this, it would be to pick your three highest-risk workflows (the ones that move money, reset access, or change vendor details) and pressure-test them this quarter as if the request were fake. That exercise will tell you more about your real exposure than any product demo, and it’s almost always where I’d start.