In Part 2 of our Social Engineering series, we explored four practical ways organizations can reduce social engineering risk: cybersecurity awareness training, password management, email authenticity, and phone verification.
Those fundamentals still apply, but as social engineering attacks increase in scale and sophistication, organizations must strengthen how they identify, verify, and respond to AI-enabled threats.
The New Reality of Social Engineering
In the age of LLMs, attackers aren’t limited to poorly written emails, suspicious links, or obvious spoofed domains. Today's threat actors leverage generative AI to create messages that sound natural, clone voices, fake video calls, automate phishing campaigns, and use publicly available information to make outreach feel highly personal. Business Email Compromise remains a serious risk because attackers only need the right message, sent to the right person at the right time.
The old advice to "look for spelling mistakes" is no longer enough. The better question is: how does your organization verify trust when the message, voice, or video looks real?
AI Didn't Replace Social Engineering. It Scaled It.
Social engineering still relies on urgency, authority, curiosity, fear, and trust. What AI changes is the speed and scale. Attackers automate reconnaissance, collect public information, identify targets, and generate personalized phishing campaigns in minutes.
Research found that AI-generated phishing emails can be created nearly nine times faster than human-written campaigns while achieving 2.4x higher click-through rates.
The New Red Flags Are Behavioral, Not Visual
Organizations can reduce their exposure by limiting the amount of personal information shared publicly. At the same time, they must move beyond awareness-only training toward verification-driven operations, where the focus shifts from spotting fake messages to verifying requests that appear legitimate.
Today's strongest indicators are behavioral:
-
Someone asks you to bypass an established process.
-
A request creates unnecessary urgency.
-
Someone requests credentials, payment information, or sensitive data through an unexpected channel.
-
An executive or vendor suddenly changes normal procedures.
Even a perfectly written email should be verified if the request itself is unusual. Security awareness training remains essential, but modern training should discuss AI-generated phishing, QR code scams, executive impersonation, and deepfake voice calls. Employees should also have clear processes for reporting suspicious activity to the security team immediately.
Trust Needs Continuous Verification
Addressing these evolving threats requires organizations to move beyond employee awareness and build verification directly into their security practices. Strong passwords and Multi-Factor Authentication (MFA) remain essential, but they are no longer sufficient on their own. As AI-enabled attacks become more convincing and identities become easier to impersonate, organizations must continuously verify trust rather than assume a person's identity after a successful login.
This principle is at the core of the Zero Trust Network model. Rather than granting ongoing access after a single authentication event, Zero Trust evaluates identity, permissions, location, and behavior throughout a session. Effective defense requires verification procedures and security operations that connect across these signals.
If a trusted employee's device begins accessing systems outside its normal role or exhibits unusual behavior, automated controls can require additional authentication, restrict access, and isolate the activity before an attacker can move deeper into the environment. But these controls are only effective when they are supported by clear processes for how people respond when risk is detected.
Social Engineering is Now an Operational Problem
Technology alone cannot verify trust. Organizations need clear operational procedures that define who is responsible for validating high-risk requests, approving exceptions, investigating suspicious activity, and responding to potential incidents. Continuous verification succeeds when technology is supported by well-defined roles, repeatable processes, and cross-functional accountability.
Layered security controls can limit an attacker's ability to move through the environment after compromising an account or device. This is where a mature Security Operations Center (SOC) becomes essential. Rather than monitoring isolated alerts, a SOC correlates activity across identities, endpoints, email, networks, and cloud environments to investigate suspicious behavior, determine business impact, and coordinate an effective response.
The question is no longer whether employees can recognize something suspicious. It’s whether your organization has repeatable processes, clear accountability, and the ability to verify requests that appear legitimate and respond when something slips through.
In the age of AI, organizations that combine employee awareness, continuous verification, and coordinated operational response will be better equipped to defend against what comes next.
Sources Cited
- VectorUSA: Cybersecurity Solutions for Social Engineering (Part 2)
- FBI: IC3 Public Service Announcement on Criminals using Generative AI for Social Engineering
- NIST: SP 800-63-4 Digital Identity Guidelines
- CISA: Require Multifactor Authentication
- CISA: Four Cybersecurity Essentials for Businesses
- Czybik, L., et al.: A Large-Scale Study of Personalized Phishing Using Large Language Models, USENIX Security ’26, 2026.
Explore the Social Engineering Series
Share this article
Ready to unlock the power of your technology?
