Practical guides to protect yourself, your family, and your business from AI-driven scams, deepfakes, and emerging cyber threats.
Popular articles
What is new this year
The 2026 threat landscape is defined less by new categories of attack and more by the industrialization of attacks that used to be artisanal. What took a skilled red teamer a week now runs in a script. Seven vectors deserve your attention.
1. Agentic phishing
Multi-step, conversational social engineering driven by LLM agents. The attacker sets the goal; the agent runs the conversation, adapts to replies, and pivots channels. Old phishing was a postcard. This is a salesperson.
2. Voice and video impersonation of executives
Realtime deepfakes are now reliable enough for live calls. The Arup case ($25M wire fraud in 2024) was the high-water mark; many smaller losses go unreported. Out-of-band confirmation for wires is no longer optional.
3. AI-assisted malware development
Tools like WormGPT, FraudGPT, and unaligned open-source models let attackers generate working exploits and obfuscated payloads in minutes. The skill floor for ransomware has dropped.
4. Supply chain attacks on AI components
Poisoned pre-trained models, malicious LangChain plugins, and tampered Hugging Face uploads are the new typosquatting. Treat model artifacts with the same provenance discipline as npm packages.
5. Prompt injection in production agents
If your company has deployed customer-facing AI agents, attackers will probe them for prompt injection. Output filtering and least-privilege tool access are the table stakes.
6. Synthetic identity fraud at scale
AI-generated faces, IDs, and biographies passing KYC checks. Fintechs and crypto exchanges are seeing this most acutely, but B2B SaaS account fraud is rising.
7. Information operations targeting your brand
Coordinated AI-generated content campaigns — fake reviews, manufactured customer complaints, deepfaked executive statements — are now used for competitive sabotage, not just nation-state work.
What to do this quarter
- Map your top 5 high-trust workflows (wires, credential resets, deploys, customer data exports, vendor onboarding). For each, add out-of-band verification.
- Run a deepfake-specific tabletop with your finance and exec teams.
- Inventory every AI agent or model in production. Apply input/output guardrails.
- Update your phishing simulations to use LLM-generated content.
- Subscribe to one threat intelligence feed that specifically covers AI-enabled attacks.
The honest assessment
None of these threats is hypothetical. All of them are running in the wild today. The good news: the defenses are mostly procedural and free. The teams that win this year are the ones that adapt process before they buy product.
