Security in the age of AI: new attack vectors and practical defences

Artificial intelligence is changing economics, medicine and cybersecurity. It can strengthen defence and lower the cost of attack. Language models, deepfake systems and automated tooling make familiar fraud more personalised, scalable and convincing.

Forrester analyst Kyle Wilbur compared AI with nuclear technology: powerful enough to create enormous benefit and capable of serious harm when misused. The comparison should not turn an algorithm into a mind. AI does not understand consequences as a responsible person does, but in skilled or careless hands it becomes a powerful instrument.

AI-enabled threats require a system response: technology, process, training and realistic simulation. Defence must evolve without falling into either panic or the illusion that an existing antivirus product makes the organisation invisible.

1. New attack vectors: AI as an attacker’s force multiplier

Most “new” vectors are older techniques amplified by AI. They become more precise, faster, easier to personalise and cheaper to scale.

1.1. LLM-assisted phishing

Phishing has long been effective because it attacks human judgement. Large language models now help an attacker create:

• false messages that resemble normal corporate correspondence;
• personalised approaches based on open-source intelligence and real colleagues;
• thousands of variants adapted to particular people, languages and roles.

The article cites SlashNext, BlackBerry, Positive Technologies, Group-IB and Kaspersky reports for rapid growth and percentages of LLM-assisted phishing. Those figures should be checked in the original report definitions; different vendors measure messages, incidents and campaigns differently. The operational conclusion does not depend on one percentage: grammar, tone and a familiar name are no longer reliable signs of authenticity.

Examples

• False Sberbank or Gosuslugi alerts: a message reports suspicious login activity and asks the victim to call a supplied number; the fraudster then impersonates security support.
• Malicious job applications: HR employees receive plausible CVs or test files containing malware. The article reports a 2024 rise in attacks on HR departments.
• Deepfake calls from executives: a messenger account uses public photos, voice material and company context to request money or confidential information.

The increasing volume creates an “information fog.” Defenders cannot rely on users spotting awkward language; they need verification rules that still work when the message is polished.

1.2. Deepfakes and forged documents

A deepfake is synthetic or altered image, video or audio. It exploits visual and auditory trust. The article attributes rapid growth in business deepfake attacks and a high share of voice cloning to a 2023 Group-IB report. Whatever the exact rate, synthetic media has already made a familiar voice or face insufficient proof of identity.

Examples described in the article include a cloned CEO voice associated with a ₽35 million transfer, false banking calls, an attempted Zoom impersonation of a VTB executive and cloned voices aimed at Alfa-Bank customers. It also cites Kaspersky material on attackers using public social-media data to make the forgery more convincing.

Payment instructions and powers of attorney

Generative tools can create realistic scans, transfer instructions and PDF invoices, and can replace payment details while preserving a familiar visual design. One 2024 logistics case in the article combines a synthetic CFO voice with a false ₽12 million invoice that was detected only during audit.

Deepfake plus document forgery turns social engineering into a multi-channel story: the voice, message and attachment all appear to confirm one another. Independent verification must therefore use a trusted channel and known account data rather than another element supplied in the suspicious message.

1.3. Automation of the attack lifecycle

AI can assist several stages:

• Reconnaissance: summarising public sites, social networks, forums, leaks and stolen datasets.
• Exploit development: drafting Python, Bash or PowerShell code and adapting known techniques.
• Phishing operations: personalising messages, calls and chatbots.
• Post-exploitation: helping control data theft, ransomware workflows and attempts to evade detection.

The article attributes Russian adoption figures and cases to Positive Technologies and InfoWatch, including automated “verification” chats designed to steal CRM credentials. Generated code does not make every attacker an expert, but it reduces effort and increases the number of plausible experiments defenders must absorb.

2. Why do these attacks succeed?

• Plausibility: the voice sounds like the director and the language resembles company style.
• Emotional pressure: “transfer the money immediately” narrows attention and discourages checking.
• Fatigue: overloaded employees miss weak signals.
• False confidence: “we have antivirus” is confused with protection from identity fraud.

The article cites SANS and Proofpoint percentages for human involvement and clicks on authoritative-looking messages. “Human factor” should not become blame. If a process lets one tired employee approve a high-impact request from an unverified channel, the process is the security defect.

3. Defence against AI-enabled threats

3.1. Technology

• UEBA and NDR: User and Entity Behaviour Analytics and Network Detection and Response identify unusual user, device and network patterns that may reveal account misuse or lateral movement.
• Fraud controls and traffic analytics: transaction rules and behavioural models can stop anomalous transfers or sessions for review.
• Deepfake detection: systems analyse audio and video artefacts. The article cites MITRE-era results and a broad 2024 accuracy range, as well as VisionLabs work on face swap, reenactment, lip sync and generated faces.

Detection accuracy changes with compression, quality and the method used by the attacker. A detector should be one signal, not the authority that approves a payment.

3.2. Training and exercises

• run phishing simulations based on the organisation’s real communication patterns;
• use an authorised red team to test synthetic voice, video and automated scenarios;
• teach out-of-band verification for money, credentials, access and sensitive data;
• measure reporting and process improvement, not only who clicked.

The article cites KnowBe4 for a reported reduction in phishing success after regular training. Training helps, but it must be accompanied by technical and procedural controls.

4. Russian products and import substitution

The original article lists domestic technologies used where some international products are unavailable:

• SIEM and analytics: MaxPatrol SIEM from Positive Technologies for collecting, analysing and reporting security events.
• EDR/XDR: Kaspersky and STAF products using behavioural analysis and real-time monitoring.
• VPN and firewalls: products from Continent, Dallas Lock and Security Code for protected channels and connection control.
• Operating systems: Astra Linux and RED OS as domestic platforms with security capabilities.

A product name is not a completed control. The organisation still needs correct configuration, asset ownership, incident response, updates, log quality and tested recovery.

5. Emerging directions

5.1. Voice assistants and smart devices

• synthetic audio can imitate the owner and attempt to send messages, authorise actions or control IoT devices;
• recorded or generated voices may target office conference and automation systems;
• inaudible or ultrasonic commands can exploit an assistant’s microphone path.

The article refers to 2024 research by Moscow State University and Skoltech on ultrasonic control of a smart speaker. Such interfaces should require confirmation and limit high-impact actions.

5.2. IoT and industrial AI

• false telemetry may influence SCADA decisions;
• poisoned training input can make a factory model misclassify equipment state;
• generated malicious firmware or software updates can target connected devices;
• access to a digital twin may let an attacker explore subtle changes before applying them to a real process.

Predictions of a first “AI-directed accident” are scenarios, not established incidents. They are useful for threat modelling because industrial consequences can be physical.

5.3. LLM agents and autonomous scripts

An agent can plan steps and call tools. In an attack context it might search for vulnerabilities, converse with support while impersonating a customer, collect information through APIs, manage a botnet or adapt a phishing campaign. AutoGPT and AgentGPT have been used in legitimate testing and demonstrate the general pattern.

Defence requires least-privilege credentials, server-side authorisation, tool allowlists, rate limits and human approval for consequential operations. The model may propose an action; deterministic controls decide whether it is allowed.

5.4. Data poisoning

If an attacker can change training or retrieval data, the system may learn to miss malicious files, accept forged documents or bias recommendations. The article cites a Gartner forecast for the future share of poisoning attacks. The exact number is uncertain; the control is concrete:

• record data provenance and approved sources;
• validate changes and separate duties;
• test models against known clean cases;
• monitor distribution shifts and unexpected output;
• keep a recoverable version of datasets and indexes.

5.5. Synthetic identities

Generative systems can create plausible employees, customers and officials, complete with photographs, documents and a history of interactions. Such identities may build trust over time, seek service access, collect information or sign false documents. The article describes a 2024 Russian case involving a network of AI-generated LinkedIn “employees.”

Identity verification therefore needs authoritative records, liveness checks where proportionate, known-channel confirmation and monitoring for inconsistent behaviour. No single selfie or voice sample is sufficient.

Practical control set

• classify data before connecting it to an AI system;
• keep secrets and unnecessary personal data out of prompts and logs;
• treat retrieved documents and web pages as untrusted input;
• separate model instructions from evidence and validate structured output;
• apply least privilege and short-lived credentials to every tool;
• require independent approval for payments, deletion, publication and access change;
• maintain an inventory of AI use cases, owners, models, data classes and permissions;
• test voice interfaces, industrial AI, prompt injection and leakage;
• monitor data provenance and poisoning indicators;
• prepare containment, evidence preservation and a kill switch.

Conclusion

AI-enabled phishing, deepfakes and automated reconnaissance are personalised, scalable and relatively inexpensive. The next wave includes IoT, industrial models, LLM agents, poisoning and synthetic identities. Technology alone will not solve the problem.

A resilient organisation combines anomaly detection, access controls, verification rules, training and realistic exercises. It verifies digital identities, data and actions through independent evidence. AI remains a tool; protection must adapt as the tool becomes faster and more accessible.

The central requirement is readiness to change. Old controls should be retained where they still work, but not mistaken for a complete answer to a new execution layer.