Introduction
Social engineering is entering, or in fact has already entered, a new era. Artificial intelligence enables increasingly convincing scams, as attackers can quickly build false identities and execute, adapt, and further develop the same fraudulent narrative across several communication channels at the same time.
This article brings together the key points from the previously published blogs from the modern cyber threats blog series and summarizes the actions organizations can take to protect themselves against these threats. The earlier articles provide a deeper dive into the topic:
What is hyper‑personalised, AI‑driven phishing and how to prevent it?
Multichannel Social Engineering: The Next Evolution of Cyber Threats
Traditionally, cyber threats have been examined mainly from a technology perspective. Organizations have sought to block malicious emails, identify suspicious logins, and protect systems against misuse through various solutions and hardening measures.
These remain necessary actions, but they are no longer sufficient on their own in a situation where the primary target of an attack is a person, and the method is social engineering in a way that changes with the target, the situation, and time.
The effectiveness of social engineering is based on the attacker’s ability to exploit people’s normal daily routines and psychological vulnerabilities. Blind trust, a willingness to help, feelings of loneliness or urgency, openness as a personality trait, and work routines are characteristics and mechanisms that give criminals an opportunity to influence people and their decision-making processes.
From Individual Responsibility to Organizational Responsibility
This is why companies should move away from the idea that identifying attempted fraud is the responsibility of an individual employee. Instead, they should investigate how well the entire organization is able to detect and prevent fraud attempts based on social engineering.
In practice, this means three things.
The first is security culture. Employees must be able to report suspicious situations without fear of blame. The earlier an observation is brought to the organization’s attention, the smaller the potential damage will be. Reporting requires a clear and fast reporting channel, not different channels for different types of incidents — one easily remembered channel is enough. It is important to recognize that an information security incident must be managed as a process, not as a message thread.
The second is operating models. Critical payment requests, changes to access rights, disclosure of sensitive information, and other significant decisions should be confirmed through predefined procedures. Preventing social engineering is not about distrust, but about controlled verification. Verification channels and models must be planned in advance, and all obstacles and thresholds to using them must be removed.
The third is cybersecurity operating capability. In many organizations, security monitoring is still based on following the management views of numerous separate systems. However, this approach is increasingly difficult to align with the current threat environment. Attacks cross the boundaries of systems, applications, and communication channels. For this reason, the defense must also be able to form an overall picture based on information from different sources.
Modern security monitoring is based on centralized cybersecurity operations, where events are examined as part of broader attack chains rather than as individual alerts or messages. An organization’s ability to detect anomalous patterns of behaviour, combine information from multiple sources, and respond quickly is becoming an increasingly important competitive factor from a security perspective, especially in supply chains — are you a trusted operator or not?
At the same time, it is important to understand that defending against evolving social engineering threats is not merely a technical question. Effective protection requires the strategic, administrative, and operational levels of information security to support one another and maintain continuous dialogue.
At the strategic level, risk appetite, objectives, and investments are defined. At the administrative level, operating and governance models, responsibilities, risks, and risk reduction measures are built. At the operational level, threats are detected, investigated, and countered in practice.
If these levels operate separately from one another, a situation can easily arise in which technical solutions, business needs, and security measures do not support one another. Only continuous collaboration makes it possible to build a whole that meets both business objectives and the requirements of a changing threat environment.
Building Organizational Resilience Against Cyber Threats
The future of social engineering will probably not look like a single fraudulent message. It will look like a normal working day. That is precisely why organizations must build their defences on the assumption that some scams will inevitably get through the first layers of protection. Organizations must continue to build their defences on the assumption that an attacker has already succeeded in compromising some part of the environment.
The best organizations do not succeed because they identify every attack in advance. They succeed because their people, processes, technology, and the strategic, administrative, and operational leadership of information security form a unified whole that prevents individual mistakes from turning into serious information security incidents.
The next stage in the development of social engineering is already here. That is why defense must also evolve. In fact, the question is not only how we recognize scams, but how we build organizations that can withstand them.
Achieving this requires a strong security culture, functioning processes, effective operating capability, and seamless cooperation between different levels of leadership. Only in this way can an organization respond to an environment where attacks are increasingly personal, convincing, and difficult to detect.
At Context&, we specialise in applying Microsoft technologies in customer environments, and we also support a human-centred approach through training and the development of operating models. Contact us to find new tactics to protect your organisation.
This blog is the last part of a 4-piece blog series on AI assisted frauds and how organizations can protect themselves.
You can read the first part here: Social Engineering Fraud - Not only a private matter
the second part here: What is hyper‑personalised, AI‑driven phishing and how to prevent it?
and the third part here: Multichannel Social Engineering: The Next Evolution of Cyber Threats
