A familiar voice, polished email, or convincing video call can make a request feel trustworthy. During Cybersecurity Awareness Month, businesses should recognize a growing challenge: artificial intelligence can make social-engineering messages easier to personalize and harder to judge using traditional cues such as poor grammar or an unfamiliar writing style.
The Risk is the Decision, Not Just the Technology
For most businesses, the practical concern is not whether an employee can identify how a suspicious message was created. The concern is whether a convincing message can trigger a sensitive action, such as releasing money, disclosing credentials, sharing confidential information, resetting an account, or changing payment instructions.
A Modern Impersonation Scenario
An employee receives an urgent voice message that appears to come from a senior leader asking for a confidential payment to be handled immediately. The timing and tone feel plausible. Rather than treating voice familiarity as proof of identity, the employee’s process should provide an independent way to validate the request before the transaction moves forward.
Move From “Spot the Fake” to “Verify the Request”
Awareness training remains important, but businesses can reduce dependence on an employee’s ability to visually or audibly detect a fake. Define transactions and account changes that require independent verification. Use previously established contact information, approved internal channels, or a second authorized person. Avoid completing sensitive requests solely because the message sounds urgent or appears to come from leadership.
Strengthen the Surrounding Controls
Protect business accounts with MFA and strong passwords, keep systems updated, limit excessive privileges, and establish clear reporting channels for suspicious messages. Finance, HR, IT help desk, and executive-support roles may deserve focused training because they routinely handle requests involving money, credentials, employee records, or account access.
Coverage Considerations
AI-enabled impersonation does not create a single universal insurance category. Depending on the facts, a loss could raise questions involving cyber liability, social engineering, crime, funds transfer, privacy, incident response, or business interruption. Businesses should review applicable definitions, exclusions, verification requirements, sublimits, and how multiple policies or endorsements may interact.
FAQ
Q: Can employees rely on voice or video as proof that a request is legitimate?
A: Businesses should consider independent verification for sensitive requests instead of relying solely on how a message looks or sounds.
Q: Does traditional phishing training still matter?
A: Yes, but organizations can also focus training on the business action being requested and the process for verifying it.
Q: Does cyber insurance specifically cover deepfakes?
A: Coverage should be evaluated based on the actual event and policy language rather than the technology label alone.
Cybersecurity Awareness Month is a good opportunity to update verification procedures for a world where familiar-looking and familiar-sounding messages may not be what they seem. Atlas Insurance can help businesses examine cyber and crime coverage considerations alongside these evolving social-engineering risks.
Atlas Insurance Disclaimer
This material is provided for general informational and educational purposes and is not legal, cybersecurity, or coverage advice. Insurance coverage is subject to the specific terms, conditions, exclusions, limits, endorsements, and underwriting requirements of the applicable policy and carrier. Coverage availability and terms vary by insurer and individual risk. Please review your policy and consult appropriate insurance, legal, and technology resources regarding your specific circumstances.
Source Note
Cybersecurity practices referenced in this article are informed by CISA Cybersecurity Awareness Month and phishing guidance, including phishing awareness, strong passwords, multifactor authentication, software updates, logging, backups, encryption, and incident-response planning.
