asane

Phishing your own people in cyber security training? How to protect the brands you use as bait

Online Niel November 8, 2024

With the widespread use of generative AI, phishing has become an even more formidable threat to organizations. Super realistic emails, texts and deepfake voice notes can be built using AI toolsand with better grammar and spelling making threats appear more authentic, AI-based phishing is a major concern.

This year we’ve seen an escalation in the complexity and variety of phishing methods, with people being targeted on new platforms they trust, beyond the standard email, phone call or SMS. Concerns have reached the top of business. Accenture’s Pulse of Change research found that nearly half (47%) of C-suite executives are concerned about the increased risks of cyber-attacks and data breaches. cyber security threats posed by deceptive content such as realistic phishing emails/messages were identified as the greatest risk.

The attacks may not be simple, but the motivations often are: financial gain. Attackers use messages requesting personal information from fraudulent websites to trick their victims into sending money or gaining access to their networks. They also know that by impersonating senior leaders, they can influence people to share data, money or credentials.

Unfortunately, as phishing attempts become more realistic, employees are more likely to fall victim, which can create serious disruption, financial loss, and potential long-term reputational damage to their organization.

Mark Raeburn

Accenture UK Cyber Resilience Lead.

Education is the key

Therefore, it is critical that employers provide the necessary education – including training and simulations – to prevent attacks from tricking employees into clicking something they shouldn’t.

Simulating a genuine phishing attack is not a simple question. In fact, firms have tried to educate their employee by replicating public brands with typical consumer and employee communications – such as impersonating delivery companies – to create content for educational purposes. This is because these companies tend to have many characteristics that make them ideal targets for social engineering due to brand familiarity, regular requests for personal information and routine tracking link sharing. Delivery companies regularly distribute emails and SMS updates, which means that the cadence of communication – and the features that come with it – often go unnoticed and individuals are easily misled.

However, when organizations copy brands in simulations, it can pose legal issues of IP theft if they haven’t asked for permission to use their branding and company information. It can also cause the brands themselves reputational damage due to association with cyber attacks (even fake ones).

If a company decides to replicate such an exercise but wants to avoid using a third party as part of the simulation, it could instead deploy internal emails from trusted departments such as finance, legal or HR. This means they still appear believable to employees because they will look alike emails normally issued directly by internal teams, but not at risk of getting into legal hot water from external companies.

How you can protect your company

In addition to training employees, companies can also take preventative measures to stay protected – and turn the tables on attackers using the AI genre itself.

Given that AI increases the risk of being defrauded by realistic content, it is also a vital part of an organization’s technological armoury. For example, many platform companies and hyperscalers are rolling out AI security features in their own environments. In addition, AI-powered “red teaming” — a cybersecurity technique — mimics an attack to see how individuals would respond. Other examples, incl penetration testingit will become mandatory for organizations as regulations evolve. The key to gaining the upper hand in the age of AI will be to incorporate security by design throughout the journey.

The personal touch

While security tools are essential, people are ultimately a key line of defense. Training programs play a central role in helping employees recognize and report suspicious communications, but they should also be encouraged to rely on their instincts. Employees should always ask themselves, “Is this behavior typical of the sender? Is this a platform they would normally contact me on? Would I normally check my details this way?”

There are also cultural factors that underpin an organization’s defense – and that starts with making sure companies prioritize the way they work and the well-being of their people. Always-on and tired employees may be more likely to click on suspicious links in a hurry, so reducing alert fatigue and burnout among people also has cybersecurity benefits.

Just as there is a human behind the initial creation of a phishing attack, there is always a human on the receiving end of a scam. The best defense is always based on the knowledge of an empowered employee who understands the risks and acts carefully. A healthy dose of human suspicion combined with a strong technology-based line of defense will put organizations on the right track to defend against phishing attackers without inadvertently damaging the reputation of other brands.

We have presented the best cloud antivirus.

This article was produced as part of TechRadarPro’s Expert Insights channel, where we showcase the best and brightest minds in the tech industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you’re interested in contributing, learn more here: