What is the best defense against AI-powered Phishing and Deepfake audio scams?

All answers to this question.

You need to update your Security Awareness Training. Employees need to see actual examples of deepfakes so they know just how realistic these threats have become.

   Answered 2024-08-11 by Susan Martinez

• Totally agree, Susan. Seeing is believing. When people realize that audio can be cloned in seconds, they become much more cautious with "emergency" requests.

     Commented 2024-08-12 by Michael Chen

These "generative" threats are indeed the new frontier. Since AI can now bypass grammar-based filters, you need to shift your focus to out-of-band verification. For any financial transaction, implement a "Double-Check" policy where a phone call to a known number or a face-to-face confirmation is mandatory, regardless of who the email claims to be from. Additionally, use AI-powered security tools that analyze the "intent" and "metadata" of an email rather than just keywords. Training your staff to be skeptical of "urgent" or "confidential" requests is still your best human firewall.

   Answered 2024-08-13 by Barbara Wilson

Have you considered implementing a "code word" system for internal high-stakes requests to verify identity during voice calls or internal chats?

   Answered 2024-08-16 by James Roberts

• James, a code word is a great low-tech solution! However, for larger enterprises, it’s hard to scale. A better approach is moving toward FIDO2-compliant hardware keys. These are virtually unphishable because the "handshake" happens between the hardware and the actual legitimate site. Even if an employee is tricked by a perfect AI email into visiting a fake site, the hardware key won't provide the credentials, effectively killing the attack at the final step.

     Commented 2024-08-19 by Robert Taylor