The human protocol
Cognitive compromise
Attackers use generative AI to write business email compromise (BEC) messages that match a CEO's tone. They target busy, high-pressure moments to force rapid, insecure decisions.
AI-POWERED SOCIAL ENGINEERING
Synthetic identity
Voice cloning lets attackers impersonate trusted colleagues. A "challenge and response" routine, such as calling back on a known number before moving money, defeats most deepfakes.
OUT-OF-BAND VERIFICATION
Phishing: silent saboteur
Most breaches start with someone opening a door for the attacker. Read this message, then decide.
● INBOX
FROM: Microsoft_Secure_Auth_v9@global-verify.net
SUBJECT: URGENT: Account suspension imminent
"Dear User, an unauthorized login attempt from St. Petersburg was detected. To prevent total data loss, click below to verify your ID within 10 minutes."
[ Verify now ]
Would you click this?
Five warning signs in this message:
- The sender's domain is wrong. "global-verify.net" is not Microsoft, whatever the display name says.
- Urgency and fear. "Imminent" and "10 minutes" exist to stop you thinking.
- A generic greeting. "Dear User" means they do not know who you are.
- A vague threat. A login from far away is a classic hook.
- A button hides the real address. Hover to check where it goes. Better, ignore it and sign in by typing the address yourself.
If in doubt: do not click, report it to your security or IT contact, and verify by another channel.
Enemy listening!
Don't be the weak link in the chain. Verify the source or sink the ship.