A convincing email from a trusted vendor. A voicemail that sounds exactly like a company executive. An urgent request to update payment information.
Any one of these communications could be legitimate. They could also be part of a cyberattack.
Artificial intelligence (AI) has made it easier for cybercriminals to create believable messages, imitate familiar voices, and target employees with increasingly sophisticated scams. For businesses, the concern is not simply whether an employee will recognize a suspicious email. It is whether the organization has the safeguards in place to prevent a fraudulent request from becoming a financial loss, business disruption, or data breach.
The consequences can extend well beyond immediate operational challenges. Depending on the circumstances, a cybersecurity incident may expose confidential business information, trigger contractual notification obligations, invite regulatory scrutiny, and increase litigation risk.
As Cybersecurity Awareness Month continues, businesses should take a closer look at how emerging threats are affecting both their cybersecurity practices and their overall risk management strategies.
Phishing and Social Engineering Are Becoming Harder to Detect
Phishing attacks have traditionally relied on deceptive emails designed to persuade recipients to click malicious links, disclose passwords, or share sensitive information. Social engineering takes that deception further by exploiting trust, authority, and urgency.
An employee may receive what appears to be a routine request from a vendor to update banking details. Another may receive an email supposedly from senior management requesting confidential documents. In both situations, the attacker is counting on the recipient to act before verifying the request.
AI has made these communications more difficult to distinguish from legitimate business correspondence. Messages can be personalized, grammatically polished, and written in a style that closely resembles someone the recipient knows.
As these attacks become more sophisticated, businesses should not rely solely on employees recognizing suspicious communications. Organizations should establish clear procedures for verifying unusual requests, particularly those involving payments, account credentials, financial information, or sensitive business data.
Employees should also know how to report suspicious communication promptly and without hesitation.
AI Deepfakes Create New Risks for Businesses
One of the more troubling developments in cybersecurity is the use of AI-generated audio and video to impersonate trusted individuals.
Voice-cloning technology can make a fraudulent phone call sound as though it came from a company executive, client, or business partner. Deepfake videos may similarly create the appearance of an authentic interaction.
Consider an employee who receives an urgent call from someone who sounds exactly like the company’s chief financial officer and is instructed to transfer funds to a new account. If the employee relies solely on recognizing the voice, the company could face significant financial exposure.
These risks reinforce the need for independent verification. Businesses should require employees to confirm unusual financial instructions through a previously established communication channel, regardless of how convincing the original request appears.
Companies should also consider the risks associated with their own use of AI. Entering confidential business records, client information, proprietary data, or personal information into an unapproved AI platform may create privacy, contractual, regulatory, and confidentiality concerns, even when no malicious actor is involved.
Internal AI policies should clearly address what information employees may share with AI tools, what approvals are required, and what safeguards must be in place before those tools are used.
Strong Passwords and Multifactor Authentication Still Matter
While AI-related threats are receiving considerable attention, basic security weaknesses continue to expose businesses to cyberattacks.
Compromised passwords can provide unauthorized access to email accounts, financial systems, cloud environments, and sensitive business records. Reusing passwords across multiple accounts can significantly increase the impact of a single compromised credential.
Multifactor authentication (MFA) adds an additional layer of protection, but it is not foolproof. Attackers may attempt to trick employees into approving unexpected login requests or entering authentication information into fraudulent websites designed to mimic legitimate platforms.
Businesses should require unique passwords, encourage the use of password managers, and implement phishing-resistant MFA where practical, particularly for accounts that provide access to sensitive information or critical systems.
Organizations should also regularly review employee access permissions, update software promptly, and evaluate how confidential information is stored, accessed, and shared.
These measures may seem routine, but they remain among the most effective ways to reduce cybersecurity risk.
When an Incident Occurs, Early Reporting Matters
Even well-prepared organizations can experience cybersecurity incidents. An employee may click a malicious link, mistakenly disclose credentials, approve a fraudulent authentication request, or unknowingly respond to an AI-assisted scam.
What happens next often determines whether the incident remains manageable or develops into a larger business and legal problem.
Employees should know exactly whom to contact when they suspect an incident and should be encouraged to report concerns immediately, even when they are uncertain whether information has been compromised.
Businesses should have an incident response plan that identifies who will investigate the issue, coordinate with cybersecurity professionals, preserve relevant evidence, manage communications, and assess potential legal obligations.
Depending on the circumstances, a cybersecurity incident may trigger notification requirements under state or federal law, contractual obligations, insurance considerations, or industry-specific regulatory requirements. The nature of the information involved, the extent of unauthorized access, and the jurisdictions affected can all influence the legal analysis.
Not every security incident is a reportable data breach. However, delaying an investigation can make it more difficult to determine what occurred, contain the threat, preserve evidence, and evaluate whether notification is required.
Involving legal counsel early can help businesses evaluate their obligations, coordinate the response, protect sensitive communications where appropriate, and address potential regulatory or litigation risks.
Cybersecurity Preparedness Requires More Than Technology
Cybersecurity is not solely the responsibility of an organization’s IT department. Leadership, employees, legal advisers, and outside service providers all have important roles to play in protecting business information.
As cybercriminals adopt increasingly sophisticated technologies, organizations should regularly assess whether their security measures, employee training, internal policies, and incident response procedures remain effective.
For companies reviewing their cybersecurity practices, several questions are worth considering:
Are employees trained to recognize AI-assisted phishing and social engineering attacks?
Are unusual financial requests independently verified?
Does the organization have clear policies governing the use of AI tools?
Is MFA required for critical systems and sensitive accounts?
Does the organization have a documented incident response plan?
Do employees know how and when to report suspicious activity?
The answers may reveal vulnerabilities that otherwise remain hidden until an incident occurs.
Cybersecurity Awareness Month is an opportunity to revisit these issues, but cybersecurity preparedness is a year-round responsibility. In today’s threat landscape, effective cybersecurity requires more than technology. It requires planning, policies, training, and a coordinated strategy to reduce both business and legal risk before an incident occurs.
How Mandelbaum Barrett PC Can Help
Mandelbaum Barrett PC’s Cybersecurity and Data Privacy Practice Group advises businesses on cybersecurity preparedness, AI governance, data privacy compliance, incident response, and the legal implications of evolving cyber threats.
For more information, contact the Chair of our Cybersecurity and Data Privacy Practice Group, Steven W. Teppler.
This article is for informational purposes only and does not constitute legal advice.