We now live in a world where seeing is no longer believing, and every interaction, email, call, and text message is a potential deception. We are in a new era of social engineering, in which artificial intelligence (AI) has become the master puppeteer in a theater of digital illusions, and every organization will receive an invitation to the show.

For attackers, AI removes the limitations of human creativity and effort, making it frighteningly easy to craft hyper-realistic scams that bypass traditional security measures, including the once gold standard of MFA. The glass ceiling of what’s possible in digital deception was once visible, but now it hasn’t just been raised—it’s been shattered.

This newfound sophistication gives attackers a virtually limitless edge in the battle of attacker versus defender. While that presents a significant challenge for cybersecurity teams, they can level the playing field and even get ahead by adopting AI-powered defenses and strengthening the weakest links in the security chain.

The Breadth and Depth of Social Engineering Attacks

Social engineering has long been a favored tool in cybercriminals’ arsenal, exploiting the one vulnerability that never seems to be patched: human psychology. These attacks come in various forms, including phishing, smishing, vishing, business email compromise (BEC), pretexting, baiting, spoofing, and more, and only require a person to click accidentally.

To grasp the relentless tide of attacks that leverage human error and complacency in pre-GPT days, consider these statistics:

• 74% of breaches involve the human element, which includes social engineering attacks, and 50% of all social engineering attacks are pretexting incidents.
• Employees at SMBs experience 350% more social engineering attacks than those at enterprise-sized companies, with the average company facing 2.7 per workday.
• In Q1 2023, more than 1.6 million unique phishing sites were detected.
• In October 2022, attackers used nearly 600 brand names in spoofing attacks, the most common being Microsoft, Google, Yahoo, and PayPal.
• In 2023, the FBI received 21,489 BEC complaints, amounting to almost $3 billion in losses, or an average of $137,132 per attack.

Now that threat actors have easy access to AI tools, the steady wave of attacks will become more like a tsunami.

AI-Powered Social Engineering: Effortless Deception

By now, most people know how traditional email phishing and vishing scams work. AI adds a new dimension, empowering attackers to create highly convincing, highly personalized attacks with minimal effort. Here are three specific strategies that demonstrate how AI is altering the social engineering landscape:

Deep Fakes

Deepfakes leverage AI to generate fake video and audio content, allowing attackers to impersonate individuals convincingly. For instance, malicious actors can create deepfakes of executives to get employees to send sensitive information or authorize unusual financial transactions. Because the content looks authentic, features a trusted source, and uses personalized language, it’s nearly impossible to distinguish between genuine and fabricated content.

Voice Synthesis

Voice synthesis systems use AI to clone trusted voices, enabling attackers to craft realistic messages that are indistinguishable from legitimate sources, exploiting human cognitive biases and emotional triggers. With just 3 seconds of authentic audio, easily taken from public sources (interviews, spam phone calls, social media posts), these AI tools can generate 10 minutes of audio that perfectly mimics the source’s unique tone and intonation, again making it indistinguishable from the actual person.

Human-like Chatbot Interactions

AI-powered chatbots that impersonate customer service or sales agents can be deployed via social media platforms, messaging apps, or even embedded within fake websites. They engage in human-like interactions, building trust and answering basic questions. These chatbots are designed to lull victims into a false sense of security, with the ultimate goal of getting users to share sensitive data, enter a phishing site, or download malware.

These are just the tip of the AI iceberg. As this technology evolves, we can expect even more innovative and deceptive tactics to emerge.

Fight AI Attacks with AI Defenses

The parallels between attackers and defenders are strikingly similar. Before AI, threat actors would spend extensive time manually crafting phishing materials and designing fake websites, malware, and other cybersecurity threats. The process was labor-intensive and time-consuming, requiring a deep understanding of social engineering and technical coding skills.

On the other side, cybersecurity experts would dedicate days or weeks to manually normalizing, parsing, and analyzing data logs, identifying patterns of breaches, and sifting through false positives to detect genuine threats. They had to update security protocols and perform regular system checks constantly. All of this was labor and time-intensive and prone to human error.

Throughout time, technology and inventions have had the dual capability to be used for both good and evil, depending on how they are applied and by whom (think TNT, biotechnology, cryptocurrency, and nuclear power); AI is no different. Just as attackers leverage AI for automation, personalization, and efficiency, defenders can employ AI to automate much of the heavy lifting, including detecting and thwarting these sophisticated threats.

To fight fire with fire, CYREBRO has launch a new proprietary security data lake & precision guided detection engine that utilizes AI and machine learning (ML) raise detection and response to the most precise level. The proprietary data lake can ingest massive volumes of data from various sources, normalizing and correlating them to identify patterns and anomalies and connecting seemingly unrelated events to uncover an attack that might otherwise go unnoticed. By analyzing real-time threat intelligence and historical data, the engine prioritizes threats based on potential risks, delivering focused attack stories and recommended mitigation steps. Since the engine learns continuously, it adapts to new threats as they emerge, ensuring defenses stay ahead of the curve and keeping false positives away from raising the alarms.

The Battle Continues, Choose Your Weapons

The struggle between malicious actors and defenders is as old as the concept of security itself, akin to a game of strategy and wit. The application of AI in cybersecurity is a double-edged sword; while it has enhanced the capabilities of attackers, it has also empowered cybersecurity experts with tools to detect and respond to threats with greater accuracy and speed. Organizations that leverage AI and ML security tools are better equipped to predict, prevent, and mitigate the risks posed by social engineering or any other type of attack.

Remember, your choice of weapons will determine the battle’s outcome, so choose wisely and choose precisely.