AI social engineering awareness
Generative AI has made social engineering dramatically more convincing. The grammar is perfect, the voice on the phone sounds like your CFO, and the spear phish references a project you really are working on. The defensive instincts that used to work — spotting typos, sensing a “off” tone — no longer hold. This interactive guide walks through the main AI-enhanced attack patterns, the signals that still give them away, and the process-based defenses that work even when the content is flawless.
How it works
Pick an attack type — AI-generated phishing, voice-cloning (vishing), or deepfake impersonation — and the guide shows the way the attack typically unfolds, the detection signals that remain reliable, and the recommended response. The through line is the same across all three: because AI can fake the content, your defense has to rest on process — out-of-band verification, code words, and approval workflows the attacker cannot reach. Nothing is sent anywhere; the guide runs entirely in your browser.
Building organisational defenses
- Out-of-band verification. Confirm any money, credential, or data request through a separate known channel — never a number or link in the message.
- Approval workflows. Require two-person approval for high-value transfers so no single convincing message can move funds.
- Code words. Agree a shared word for sensitive voice/video requests; a clone will not know it.
- Assume the content is perfect. Train people that flawless grammar and a familiar voice are no longer reassurance — process is.