Your Attackers Hired AI. Have You?

The attacker doesn't have to think anymore. The platform does it for them.

• Scale went up and the cost went down. Running a high-quality, personalized phishing campaign used to require skilled operators, time, and research. Now it requires a credit card and a Telegram account.
  
  
• Remember training employees to look for spelling errors and awkward phrasing? That worked because the people writing phishing emails often weren't fluent English speakers. AI-generated content is grammatically correct, tonally appropriate, and increasingly personalized.
  
  
• Deepfake audio and video technology has matured to the point where synthetic voices are convincing enough to fool humans in real-time calls. The CEO fraud attack vector no longer requires a human actor on the phone, an AI model trained on a few minutes of publicly available audio can do it.
  
  
• AI is being used to generate malware that rewrites portions of its own code at runtime, producing unique signatures every time it executes. A piece of malware that looks different on every execution is significantly harder to detect with tools designed to recognize known patterns.
  
  
• AI-assisted reconnaissance means adversaries can process breach databases, public records, LinkedIn profiles, and credentials dumps to identify high-value targets and tailor attacks to them.

A threat actor can provision a fully equipped, AI-augmented attack platform for a few hundred dollars a month. It comes with automated reconnaissance, AI-generated lures, MFA bypass, and post-compromise automation that executes in minutes. Meanwhile, a typical organization’s security operations run on human analysts reviewing alerts, making triage decisions manually, and working through an investigation process designed for a slower threat environment of the past. Offense is operating at machine speed. Defense, in many organizations, is still operating at human speed.

The Answer

The answer isn't to panic or to replace every human analyst with a bot. It's to recognize that AI-augmented threats require AI-assisted defense and to make targeted investments that close the specific gaps these tools exploit.

• Authentication anomalies such as logins from new devices, new geographies, single-factor authentications that bypass MFA and impossible travel are some of the earliest indicators of a PhaaS-driven compromise. Detection rules for these behaviors need to run in minutes, not hours.
  
  
• Modern PhaaS kits bypass traditional MFA by stealing session tokens in real time so phishing-resistant authentication methods such as hardware keys or passkeys are the controls that hold up best against these techniques. Prioritize your highest-risk users and applications first.
  
  
• Executive voice calls authorizing urgent financial transactions should have out-of-band verification steps that don't rely on the authenticity of the call itself. The $243,000 deepfake CEO attack worked because the receiving organization had no such process. That was 2019 and the technology is significantly better now.
  
  
• User behavior analytics, anomaly detection, and automated correlation of weak signals across large alert volumes are areas where AI-assisted tooling genuinely improves detection outcomes. If attackers are using AI to find and exploit gaps faster than humans can close them, defenders need AI to close that response gap.

AI hasn't fundamentally changed what attackers want. They still want access, credentials, money, and data. What AI has changed is how fast they can get it, how convincingly they can deceive your employees, and how low the barrier is to running a sophisticated operation.

The organizations that will navigate this era successfully aren't necessarily the ones with the biggest security budgets. They're the ones that have assessed the gap between how fast attacks happen and how fast they detect and respond, and begin making the changes to close it. The threat actors already made the transition to AI-augmented operations, the question is whether your defenses have.