AI Cybersecurity Threats 2026: The Human Layer Is the New Perimeter
For a decade we trained people not to click. So the attackers stopped asking them to click. They started calling instead.
A fresh TransUnion fraud analysis puts the shift bluntly: "Trust has become easier to exploit and harder to establish." Fraudsters now blend social engineering, deepfake technology, text spoofing, compromised credentials, and AI to become whoever a situation demands — a new customer, an existing account holder, or the company itself. Most fraud, the report found, no longer happens at signup. It happens after the relationship is already trusted. The same survey found 58% of organizations very or extremely worried that fraud is evolving faster than their ability to detect it. They are not wrong to worry.
The uncomfortable truth behind modern AI cybersecurity threats is that the break-in is increasingly optional. Why fight your firewall when you can phone your help desk?
Calling the Help Desk Instead of Breaking In
Dave Lewis, global advisory CISO at 1Password, frames the change with a line that should land on every security roadmap: why take the time to write an exploit script when you can just ask for a password reset? Attackers moved from deploying malware to exploiting identity, and they discovered that the softest target in any enterprise is the human who has authority to reset a credential.
This is not a new idea dressed up with buzzwords. The pattern is visible across the breaches we already study. Scattered Spider walked into MGM and disrupted casino operations by impersonating employees and talking help-desk staff into resetting credentials and bypassing MFA, then handed access to ALPHV/BlackCat ransomware. Caesars took a similar hit through a social-engineered outsourced IT vendor. Uber watched internal systems fall to MFA fatigue and IT impersonation over WhatsApp. Back in 2022 the "0ktapus" SMS-phishing wave touched 130-plus organizations. In every one of those cases the technical stack held. A person opened the gate.
What AI changes is the strength of the lock on that gate. A cloned voice makes "prove who you are" nearly meaningless to a help-desk agent judging a caller over the phone.
Deepfakes as the Force Multiplier
The cost and skill required to fake a trusted voice have collapsed. Voice-cloning tooling can produce a clone that passes as the real speaker in a live phone call from roughly one minute of clean audio. Attackers harvest that audio from places they cannot defend — corporate YouTube channels, earnings calls, webinar recordings, social media. The deepfake robocall that impersonated President Biden during the 2024 New Hampshire primary reportedly cost about a dollar in synthesis credits and took under twenty minutes to make.
Even more dangerous is real-time voice transformation. An attacker speaks naturally into a microphone and the software outputs the cloned executive's voice with sub-second latency, so they can answer questions, negotiate, and apply pressure live. A finance team taking an urgent wire request from the "CFO" has no auditory signal that the voice is synthetic.
Researchers now describe multi-channel attacks that collapse every instinct we have for verifying authenticity. An email from the CFO, then a voicemail in the CFO's cloned voice, then a Slack message, then a video call where a deepfaked CFO appears on screen — all orchestrated inside thirty to sixty minutes. Humans treat cross-channel consistency as proof, so the convergence is the attack. The stakes are measurable: a 2025 Gartner survey of 302 security leaders found 43% of organizations had hit at least one deepfake incident during an audio call and 37% during a video call.
There is also a delivery detail most teams miss. A "presentation" attack plays a fake into a camera or microphone, and liveness detection can often catch it. A "digital injection" attack feeds synthetic frames or audio straight into the software pipeline, so it carries every liveness signal a detector expects and slips past. Defending against injection requires cryptographic attestation that the stream came from trusted hardware — something most conferencing and voice platforms simply do not have today. That is why UC Berkeley's Hany Farid argues that any model resting on voice or video alone for identity is operating on broken foundations.
Impersonating the Brands We Now Trust
The deception extends past individuals to the AI brands themselves. Check Point's Q3 research on brand impersonation flagged a phishing campaign spoofing Anthropic's Claude, using a fake "payment due" notice urging a 500-euro "update payment" click to harvest credentials and financial details. KnowBe4's threat-intel lead James Dyer tracked a 228% rise in AI brand impersonation since April, noting that attackers exploit the global rush to adopt AI as cover — and that the problem spikes when they anchor scams to breaking news.
The same weaponization runs in the other direction. Defenders are also seeing attempts to exploit AI systems and poorly configured AI agents directly. "The social engineering techniques remain similar," one analyst noted, "but attackers are using AI to find weaknesses and are beginning to target AI agents directly." The agentic tools you deploy to gain speed become a new attack surface if you secure them like ordinary software and not like a trusted employee with privileged hands. Synthetic identities compound this: in June 2025 the U.S. Department of Justice announced that North Korean operatives using fabricated identities had landed jobs at more than 100 U.S. companies, including Fortune 500 firms, siphoning data along the way.
Defenses That Don't Ask People to Spot the Fake
You cannot train your way out of this. Detection by human perception fails against modern synthetic media, so the fix is protocol, not suspicion. Out-of-band, second-channel confirmation is the only reliable defense when the audio and video both lie.
For the help desk specifically, Lewis argues you fix the process, not the people. Script the identity verification for every reset. Call back to a number of record. Require manager approval for any privileged or MFA reset. And drop speed metrics like average handle time on identity-sensitive interactions — those metrics push agents to prioritize the clock over the check, which is exactly the pressure an attacker wants.
Then shrink the blast radius. Audit every door into the customer-records estate — OAuth applications, integrations, guest and portal users, API keys — and revoke anything without a named owner. Scope the rest, then repeat quarterly, because these grants grow back. Set retention limits on customer records, purge dormant accounts, and keep production customer data out of sandboxes. As Lewis puts it, data you don't hold can't be stolen. Layer that with a risk-based, holistic prioritization of where your biggest downstream losses actually are, and the surface an impersonation attack can exploit starts to shrink.
The industry's honest path forward is what some call a "no trust required" posture — a step past zero trust, where no reset, approval, or transfer succeeds on voice or video alone but needs cryptographic proof or a second verified channel. That is not a product you buy. It is a set of practices you refuse to relax under pressure. And that refusal is precisely what the fraudsters are betting you won't manage.
