AI Phishing Threat Training for Employees - Free Micro Training Session 1 — Transcript

Full transcript

1. 0:02[music]
2. 0:09In 2026, employees need to be fully
3. 0:11aware of how AI has made fishing much
4. 0:14more of a threat to individuals and
5. 0:16organizations. There are several reasons
6. 0:18for this which are important to
7. 0:19understand in order to protect your data
8. 0:21this year. Firstly, AI tools like
9. 0:23ChatGBT have been used by hackers to
10. 0:25create emails which are very convincing
11. 0:28and much more targeted than ever before.
12. 0:30It's now common that employees are
13. 0:32getting emails which are far more
14. 0:33personalized and without any telltale
15. 0:35spelling and grammatical errors that
16. 0:37used to alert readers to a scam. Perhaps
17. 0:39the most alarming thing is that the some
18. 0:41of these fishing emails are copycats of
19. 0:44genuine ones that have been sent out in
20. 0:45the past from trusted internal sources
21. 0:48like HR, payroll, IT help desk, and
22. 0:51company executives, making them
23. 0:52particularly difficult to detect. Some
24. 0:54examples of these might be emails with
25. 0:56the subject career advancement
26. 0:58opportunities, employee satisfaction
27. 1:00survey, or donation to a charity or a
28. 1:02company announcement from the CEO. All
29. 1:04of these contain some kind of clickable
30. 1:07link which looks legitimate. Next,
31. 1:09hackers and voice cloning programs are
32. 1:11powering a new wave of attacks which are
33. 1:13more realistic, more targeted, and
34. 1:15faster to create in more ways than ever
35. 1:17before. It basically means that
36. 1:19employees can no longer completely trust
37. 1:21emails or voice messages even if they
38. 1:24look to be from trustworthy sources like
39. 1:26HR, company management, or major vendors
40. 1:29like Microsoft. It also means that some
41. 1:31of the old ways of detecting fake emails
42. 1:33by catching spelling mistakes, bad
43. 1:35grammar, odd tones are no longer
44. 1:38reliable as AI is used to create
45. 1:40error-free fishing emails in seconds. So
46. 1:42the second reason AI is a major threat
47. 1:44in 2026 is that its ability to clone
48. 1:47voices and create deep fake images and
49. 1:50video. Hackers have used tools like
50. 1:52these to impersonate company executives
51. 1:54and managers which are used in various
52. 1:56scams like creating voice fake
53. 1:58voicemails and even joining and hosting
54. 2:00conference calls and issuing fake
55. 2:02instructions to other employees for the
56. 2:04purposes of transferring funds
57. 2:06fraudulently or donating to charities
58. 2:08through fishing websites. These same
59. 2:10type of tactics are used by AI generated
60. 2:12voices for fake help desk and fake
61. 2:14banking personnel looking to get you to
62. 2:16reveal passwords, pins or personal
63. 2:19information. These can be particularly
64. 2:21convincing as voices are highly
65. 2:22interactive and deep fake video quality
66. 2:24has almost become imperceptibly
67. 2:26different from the real thing. This is a
68. 2:28change from the old methods of fake call
69. 2:30centers where live human scammers were
70. 2:33trying to perform this type of scam and
71. 2:34you could detect maybe the foreign
72. 2:36accents and the suspicious level of
73. 2:38pressure tactics which often give things
74. 2:40away quickly. So some deep fake cases uh
75. 2:43that have been reported in the last few
76. 2:45years have involved theft of hundreds of
77. 2:47thousands of dollars which have never
78. 2:48been recovered as those responsible are
79. 2:50difficult to trace particularly the fact
80. 2:52that they may be based in company in
81. 2:54countries rather that are known to be
82. 2:55sympathetic to cyber criminals. The
83. 2:57third reason AI has become a major
84. 2:59threat is its fast evolving ability to
85. 3:02crack passwords even strong ones in
86. 3:04minutes using so-called quantum AI
87. 3:07technology. This means that second
88. 3:09factor authentication, password
89. 3:11managers, and good password hygiene have
90. 3:14become critical in 2026 so that you can
91. 3:16protect all your work and personal
92. 3:18online credentials. Security
93. 3:20organizations are now recommending
94. 3:21password lengths of at least 16
95. 3:23characters with complex characters as a
96. 3:26minimum standard. These organizations
97. 3:27are also recommending moving away from
98. 3:30SMS notification or text message
99. 3:32notifications as a method for account
100. 3:34verification and more towards using
101. 3:36things like hardware keys, facial
102. 3:38recognition that you might see on Apple
103. 3:39iPhones and setting up passwordless
104. 3:41login authentication as more and more
105. 3:44online providers are offering such as
106. 3:45Google and Microsoft. So the final
107. 3:47reason why AI is causing problems for
108. 3:49organizations is that it's using more
109. 3:52avenues of attack at a faster rate of
110. 3:54attack than ever in the history of
111. 3:55hacking. Employees need to be vigilant
112. 3:57for malicious QR codes, malicious links
113. 3:59in work collaboration tools like team
114. 4:01and teams and slack as AI can rapidly
115. 4:04create and alter attack methods at great
116. 4:06scale in a short amount of time. AI can
117. 4:09be used to easily mutate and analyze
118. 4:11which attack methods are most effective
119. 4:14leading to fishing optimization which
120. 4:16again is a very worrying trend. So what
121. 4:18to do as an employee? What steps can I
122. 4:20take to combat AI powered fishing in
123. 4:232026? While the first and most important
124. 4:25message is to make it a habit of
125. 4:27stopping and thinking about the
126. 4:28communication you just received, even if
127. 4:30it looks to be from an internal source,
128. 4:32experts re recommend taking a 9-second
129. 4:34pause or take nine pause as it's called
130. 4:37to think more logically about your next
131. 4:39action. In those seconds, look for any
132. 4:42red flags such as unnatural movement or
133. 4:44speech in videos, urgency or incentive
134. 4:47to act now in voice messages or in email
135. 4:49format. This is particularly true when
136. 4:51it comes to requesting requests rather
137. 4:53involving credentials, submission of
138. 4:55person details or payment requests.
139. 4:57These may all be indicators of a fishing
140. 4:59attack. If you're not sure, you should
141. 5:02verify the request independently via a
142. 5:04separate channel. So, if if an urgent
143. 5:06request comes in to pay a supplier or to
144. 5:08rectify an account problem, even it's
145. 5:10from your if it's from your own HR or IT
146. 5:12department, then you should use an
147. 5:14official method to verify them where
148. 5:16appropriate. This may mean calling the
149. 5:18person back, checking with your manager,
150. 5:19or visiting an official website, but
151. 5:21never through clicking on the link in an
152. 5:23email or over the phone to the
153. 5:24requester. Apply the same principle for
154. 5:27verifying requests on other platforms
155. 5:28such as social media and messaging apps
156. 5:31for work and for personal accounts. You
157. 5:33may have encountered security type
158. 5:34alerts from email platforms, retail,
159. 5:36banking, and home entertainment
160. 5:38websites, which are often suspicious.
161. 5:40Use this separate channel method if
162. 5:42you're not sure to verify that the
163. 5:44requests are indeed real. So, what about
164. 5:45reporting an incident? Well, you should
165. 5:47always feel safe in reporting potential
166. 5:49incidents quickly and not be deterred
167. 5:52even if it turns out to be a false
168. 5:54positive. If you have clicked on a link
169. 5:55or have taken an action which you have
170. 5:57any doubt about, then report it. Malware
171. 6:00may not show any sign of activity when
172. 6:02you click on it, but that doesn't mean
173. 6:04nothing has happened. It's critical to
174. 6:05let response teams know there could be a
175. 6:08problem, even if you may feel
176. 6:09embarrassed or reluctant to disclose
177. 6:10your mistake. Time is of the essence in
178. 6:12damage control. So, in conclusion, as an
179. 6:15employee this year, remember that
180. 6:17fishing has become a lot more deceptive
181. 6:19and a lot more of a threat to passwords
182. 6:21through the use of AI tools and
183. 6:23so-called quantum AI technology. So,
184. 6:25remember to take the time to analyze all
185. 6:27emails, text messages, voice and video
186. 6:29communications a little bit closer in
187. 6:312026. And be sure to verify and report
188. 6:33anything you have a data about to your
189. 6:35response teams. So, thanks for watching
190. 6:37and be sure to like and subscribe to our
191. 6:39channel so that you receive all the
192. 6:40information on the latest security
193. 6:42threats in 2026 and beyond. Remember to
194. 6:44be safe online out there. So, until the
195. 6:46next video, all the best from your cyber
196. 6:48trainer, Paul Rogers.
197. 6:50[music]