Artificial intelligence is changing the economics of cybercrime by making some attacks faster to prepare, easier to personalise and cheaper to repeat. Tasks such as analysing software, drafting convincing fraudulent messages and examining publicly available information can increasingly be assisted by automated tools. The result is a security environment in which individuals and businesses may face more convincing threats without necessarily encountering entirely new forms of criminal activity.

The principal danger is not that every hacker has suddenly acquired advanced technical capabilities. It is that automation can help criminals scale familiar methods, reduce the time required to prepare attacks and direct their efforts towards more potential victims. Effective protection consequently depends on strengthening established security practices while recognising that traditional warning signs may become less reliable.

Why artificial intelligence changes the threat

Phishing has long relied on persuading people to reveal passwords, transfer money or open malicious files. Historically, poorly written messages, obvious spelling mistakes and generic greetings sometimes helped recipients identify fraudulent communications. Artificial intelligence can reduce these weaknesses by generating polished language, adapting messages to particular individuals and reproducing the tone of legitimate organisations.

Criminals may also use publicly available information to make their approaches more credible. A message referring to a real business relationship, a recent transaction or an employee’s responsibilities can appear more convincing than an unsolicited request. Automated systems can help prepare variations of such messages at scale, increasing the number of attempts that a criminal group can make.

Voice and video impersonation create additional risks. Artificial intelligence can assist in producing convincing imitations of a person’s voice or appearance, potentially making fraudulent instructions seem authentic. Such tools do not guarantee a successful impersonation, and the quality of generated material varies. Nevertheless, the possibility is serious enough that organisations should not rely on recognising a familiar voice as proof of identity.

The underlying lesson is that trust must increasingly depend on independent verification rather than presentation alone.

Strong authentication limits the damage of stolen passwords

A strong, unique password remains an important defence, but passwords can be compromised through phishing, data breaches, reused credentials and malicious software. If the same password protects several accounts, a breach at one service may expose others. Password managers can help users generate and maintain different credentials without relying on memory or insecure written records.

Multifactor authentication provides another layer of protection by requiring an additional form of verification. However, not all methods offer the same resistance to attack. Criminals may exploit fraudulent login pages, manipulate users into approving authentication requests or steal session tokens that allow access after a successful login.

Passkeys and other phishing-resistant authentication methods can reduce some of these risks because they are designed to bind authentication to the legitimate service. Where supported, they can offer stronger protection than passwords combined with easily intercepted codes. Organisations should prioritise these methods for sensitive accounts, particularly those with administrative privileges or access to financial information.

Users should also review account recovery settings and remove authentication methods they no longer control. A secure password is less effective if an attacker can bypass it through an inadequately protected recovery process.

Software updates close known security gaps

Cybercriminals frequently exploit vulnerabilities in operating systems, browsers, applications and internet-facing services. When developers release a security update, it may address a weakness that attackers have already identified or are actively attempting to exploit. Delaying installation can leave devices exposed even when a remedy is available.

Enabling automatic updates is one of the simplest ways for individuals to reduce this risk. Operating systems, browsers, mobile applications and router software should be maintained, while obsolete applications that no longer receive security support should be removed or replaced. Updates should be obtained through official channels rather than unfamiliar links in emails or messages.

Businesses face a more complicated task because updates can affect compatibility and essential operations. They need to identify exposed systems, prioritise critical vulnerabilities and test patches without allowing administrative procedures to create unnecessary delays. If a vulnerable system cannot be updated immediately, temporary restrictions and additional monitoring may reduce exposure.

Artificial intelligence makes this discipline more important because attackers may be able to identify and exploit known weaknesses faster. A vulnerability does not become dangerous only when a criminal discovers it; the risk also depends on whether the organisation has left the affected system accessible and unprotected.

Verify unusual requests through a separate channel

Social engineering attacks succeed by exploiting urgency, authority and familiarity. A fraudulent message may claim that an executive needs an immediate payment, a bank requires account verification or a delivery company needs additional personal information. AI-generated content can make these requests appear more professional, increasing the likelihood that recipients will act without checking their authenticity.

The safest response to an unexpected request involving money, credentials or sensitive information is to verify it independently. If a senior colleague requests a payment through an unfamiliar channel, contact that person using a previously established telephone number or internal communication system. Do not rely on contact details supplied in the suspicious message itself.

Businesses should introduce verification procedures for changes to supplier bank accounts, unusual payment instructions and requests to disclose confidential information. These procedures must apply even when the request appears to come from a senior executive. A culture in which employees can question urgent instructions without fear of criticism is an important security control.

Individuals should similarly be cautious about unsolicited links, attachments and requests to install software. A familiar logo or convincing website is not sufficient evidence that a communication is legitimate.

Backups and monitoring limit the consequences

Preventing every intrusion is unrealistic, so organisations must also prepare for incidents that succeed. Reliable backups can help recover information following ransomware attacks, accidental deletion or system damage. Backups should be protected from unauthorised modification, stored separately from production systems where appropriate and tested regularly to establish that restoration actually works.

Monitoring can help identify suspicious behaviour, including unusual login attempts, unexpected changes to account permissions and connections from unfamiliar devices. Alerts are useful only when someone is responsible for reviewing them and taking appropriate action. Organisations need clear procedures for isolating affected systems, preserving evidence and notifying the relevant people.

Individuals can reduce their exposure by enabling device security features, using screen locks, securing home wireless networks and reviewing the applications that have access to personal information. Sensitive files should not be uploaded to unfamiliar artificial intelligence services without understanding how the information may be handled.

These measures may appear routine, but they address the weaknesses that many attackers continue to exploit.

Artificial intelligence does not make every online interaction dangerous, nor does it render existing security measures ineffective. It changes the speed and scale at which familiar threats can operate, increasing the importance of reliable identity checks, software maintenance and sensible access controls.

For individuals, the most effective approach combines unique passwords, stronger authentication, timely updates and independent verification of unusual requests. For businesses, the same principles must be supported by staff training, controlled access, tested backups and a documented incident-response plan.

Security products can provide valuable assistance, but they cannot compensate fully for poor processes or excessive trust in unverified communications. The strongest defence is a system in which suspicious activity can be detected, credentials are difficult to misuse and mistakes can be contained before they become serious incidents.

As AI-assisted attacks become more accessible, cybersecurity is less about recognising every possible scam than establishing routines that remain effective when a scam looks convincing. Those routines provide a practical defence against both traditional cybercrime and the growing automation of malicious activity.

(Adapted from Fortune.com)