For years, the standard advice was simple: look for bad grammar, odd formatting and urgent requests from strangers. That advice is now close to useless.
Generative AI lets attackers write perfect, personalized messages in any language, clone a voice from a few seconds of audio, and produce thousands of variations of the same lure so filters never see the same email twice.
The attacks we are seeing now
- Hyper-personalized spear phishing. AI tools scrape LinkedIn, press releases and company websites to write emails that reference real projects, real colleagues and real vendors.
- Voice cloning (vishing). A call that sounds exactly like your CEO or CFO asking for an urgent wire transfer or gift cards.
- Deepfake video meetings. Attackers join a Teams or Zoom call posing as an executive or vendor to approve a payment or a bank detail change.
- QR code phishing (quishing). QR codes in emails or PDFs push victims to their phones, outside the reach of desktop security tools.
- MFA fatigue and adversary-in-the-middle kits. Fake login pages relay credentials and session tokens in real time, getting around basic MFA.
- Vendor email compromise. A real supplier's mailbox gets hijacked and used to send invoices with changed payment details inside an existing email thread.
- Help desk impersonation. Attackers call your IT support pretending to be an employee locked out of their account, asking for a password or MFA reset.
Why small and mid-sized businesses are the target
AI has removed the cost of personalization. An attacker can now run a tailored campaign against a 30-person firm as easily as against a Fortune 500. Smaller companies usually have fewer controls, less staff training and more informal payment approvals, which makes them an easier payday.
What actually works
No single product stops AI-driven social engineering. The defense has to cover three layers:
- Email and collaboration security that uses AI to judge intent and context, not just known-bad links.
- People who are trained regularly with realistic simulations that reflect current attacks.
- Endpoint and identity protection that catches and contains an attacker when someone does click.
Add simple process rules too: verify any payment or bank change by calling a known number, never one in the email, and require a second approver for wires.
In our companion post, we explain how BITS combines Avanan, usecure and SentinelOne into one managed defense against these threats. Read how the layers fit together.
