A few years ago, a coworker forwarded me an email that looked like it came from our organization's leadership team. However, it was a phishing attempt, the textbook ones we learned about in mandatory security training. These emails were fairly easy to spot back then. Today, with generative AI, phishing emails are created and shared in seconds and at scale.
Traditional technology solutions to cybersecurity incidents include firewalls, MFA, passwords, and software updates. However, AI has added a level of complexity that has made the entire cyber community take notice. Deepfake audios can sound like anyone, including CEOs, nonprofit directors, and government entities. AI-generated emails are written in ways that fool you into thinking the person on the other side is actually in the organization. Fake invoices are able to duplicate the exact formatting of a vendor. These types of attacks target small businesses, nonprofits, and local government agencies specifically, because of their perceived low funding status and inability to defend against such threats.
Cyber professionals have known for years that technology controls are only one countermeasure, but building a security culture that can defend against AI-enabled attacks requires a workforce that's security aware and empowered to act. Your entire team, not just those with cyber in their title must understand:
• Why verification matters even for familiar senders and formats
• What kinds of requests should never be fulfilled without a second confirmation channel
• How to recognize the urgency and authority cues that AI-generated attacks are designed to exploit
• That asking 'is this legitimate?' is encouraged and part of their responsibility to the organization.
I say this as both an AI governance professional and organizational development leader: "Building A Security Culture Isn't An IT Responsibility". It requires leadership modeling, recurring learning opportunities, and a psychologically safe environment where employees can raise concerns looking paranoid. Enabling a security culture that can withstand AI-enabled security threats is not determined by an organization’s budget. It is found in organizational cultures that encourage people to trust their instincts, that ensures security awareness, and has established guardrails that allow employees to slow down, pause, and verify.
Is your organization building a security culture that address AI’s unique attacks? I help teams develop the awareness, policies, and practices to stay ahead of emerging risks. Let's connect at TawanaTownsendConsulting.com.