AI Didn’t Invent the Scam. It Made It Better.

---

For years, we’ve been teaching people how to recognize a scam. Look for the poorly written email. Watch for the strange wording. Be suspicious of the message that doesn’t quite sound like your CEO. Double-check the invoice that looks a little off.

Those were useful clues. AI is making many of them less useful.

AI-powered cyber scams are taking familiar tactics and making them faster, more convincing, and harder to recognize.

The fake invoice can look professional. The email can be grammatically perfect. The message can sound remarkably like the person it claims to be from.

And an attacker doesn’t have to spend an afternoon carefully writing one convincing message when technology can help create hundreds of variations in a fraction of the time.

That doesn’t mean AI has suddenly invented cybercrime. It means it can make the cybercrime we already know much easier to execute.

How AI-Powered Cyber Scams Exploit Trust

I think this is one of the biggest shifts organizations need to understand.

We tend to imagine a cyberattack as something technical. Malware. A suspicious attachment. A bad link. Someone hacking into a system.

But what if the attack is simply a perfectly reasonable-looking request?

• Your CFO needs a payment processed.
• Your CEO wants you to send a document.
• A vendor sends an updated invoice.
• Someone from HR asks you to review a file.

Nothing has to be obviously malicious. The attacker just has to convince the right person that the request is legitimate.

That’s not a hypothetical concern. Current incident-response data shows that attacks increasingly cross identity, endpoint, network, human, email, application, and cloud environments rather than staying in a single lane. Learn More at Palo Alto Networks.

AI adds another layer because it can help attackers create more convincing content and operate at greater speed and scale. Mandiant reported in 2026 that adversaries have moved beyond simply using large language models to draft phishing messages and are increasingly incorporating AI into broader attack operations. Learn more at Google Cloud.

Your Inbox Isn’t the Perimeter

This connects to something I’ve been talking about a lot lately.

We still tend to think of phishing as an email problem.

But work doesn’t happen exclusively in email anymore.

It happens across Microsoft 365, Teams, SharePoint, OneDrive, Google Workspace, Slack, cloud applications, browsers, mobile devices, and an ever-growing collection of third-party tools.

Every connection creates convenience. It can also create another place where identity and trust matter.

Microsoft has described the modern attack surface as extending across email, identity, endpoints, cloud environments, IoT and external infrastructure. Learn more at Microsoft.

And now we’re adding AI tools into those workflows.

So the question isn’t just: Can we stop the bad email? It’s becoming: Can we tell when someone—or something—we trust is asking us to do something we shouldn’t?

That’s a much more interesting security problem.

AI Is Also Part of the Solution

There’s another mistake I don’t want organizations to make.

We shouldn’t respond to all of this by deciding AI is simply too dangerous to use.

Your employees are going to use AI. nYour competitors are going to use AI. And your attackers are certainly going to use AI.

The goal isn’t to pretend we can put this technology back in the box.

The goal is to understand where it creates risk, put appropriate controls around it, and use it intentionally. That means:

• Knowing what AI tools are being used inside your organization.
• Knowing what information employees are putting into them.
• Understanding what those tools can access.
• Thinking carefully about identity, permissions and verification.
• And creating processes that don’t depend entirely on someone recognizing that something “looks fake.”

Because increasingly, it won’t.

Separate the AI Fact From the AI Fiction

There’s plenty of hype around AI and cybersecurity right now. Some of it is justified. Some of it isn’t.

That’s why I think we need a more practical conversation.

• What are attackers actually doing with AI?
• What should organizations genuinely be worried about?
• Where are we overreacting?
• And how can businesses take advantage of these tools without unnecessarily expanding their risk?

That’s what we’ll be talking about on October 19 during our next webinar: The Modern Attack Surface Is Bigger Than Your Inbox.
We’ll look at how AI is changing scams, impersonation and attacks; separate some of the AI fact from the fiction; and talk about practical ways organizations can embrace these tools without handing attackers a promotion.

Because AI isn’t going away.

Neither are the attackers.

The question is whether our security strategy is evolving as quickly as both of them are.

October 19

I’d love to have you join us.

---

Frequently Asked Questions