Artificial intelligence is changing how businesses work — and how criminals attack them. Leaders don't need to be AI experts, but they do need to understand the new risks and set clear rules for how their own organization uses these tools.
Deepfake fraud is real
Criminals can now clone a person's voice from a short recording and create convincing fake video. In a widely reported 2024 case, an employee at engineering firm Arup's Hong Kong office transferred about US$25 million after a video call in which the other “colleagues,” including a senior executive, were deepfakes.
The defence isn't spotting the fake. It's a process: no payment or sensitive change is approved based on a call, video or message alone, however convincing. Verify through a separate channel you already trust.
Phishing without the typos
AI writes fluent, personalized emails in any language, at scale. The old advice to look for spelling mistakes is out of date. Train staff to watch instead for unusual requests, urgency and pressure to bypass normal procedures.
Confidential data in public AI tools
Staff trying to be productive may paste contracts, customer data or source code into public AI chatbots. Depending on the tool and its settings, that information may be stored or used in ways you don't control.
AI tools with too much access
AI assistants connected to your email, files or systems can only be as safe as the permissions they're given. An assistant that can read everything can also be tricked into revealing everything. Apply the same least-access principle you'd use for any employee.
Set clear rules
- List the AI tools staff may use, and for what.
- Define what information must never be entered into public tools.
- Review the data access of any AI tool connected to company systems.
- Require out-of-band verification for payments and sensitive requests.
- Include deepfakes and AI-assisted phishing in awareness training.
Key takeaways
- Assume a voice or video can be faked; rely on verification processes.
- Give staff approved AI tools and clear data rules, rather than an outright ban they'll work around.
- Treat AI integrations like any other system with access to sensitive data.
For the technical side, see our analysis of AI-powered cyber threats.