Key Takeaways
- A simple gift‑card request scam highlighted how easily employees can be tricked, even before AI‑enhanced attacks existed.
- AI now lets attackers craft highly convincing phishing texts and emails, increasing the success rate of social‑engineering schemes.
- The 2026 Verizon Data Breach Investigations Report shows the human element in 62 % of breaches, with social engineering accounting for 16 % and software‑flaw exploitation rising to 31 %.
- Shadow AI—unauthorized AI tools used on corporate devices—creates blind spots that security teams cannot monitor, amplifying data‑leak risk.
- Attackers increasingly rely on speed, zero‑day exploits, and legitimate credentials rather than malware, making traditional signature‑based defenses less effective.
- Third‑party involvement in breaches has grown to nearly 50 %, underscoring the need for rigorous vendor risk management.
- Ransomware remains prevalent (48 % of breaches) and is described as the “yoga pants of cybersecurity,” while AI‑driven security can save organizations roughly $1.9 million per breach.
- Effective defense now hinges on a zero‑trust framework, continuous patching, rapid detection‑and‑response (SOAR), and planning for worst‑case scenarios.
- Leaders must ask “Who’s doing the building?” to ensure AI is developed with ethical standards and human oversight, preventing malicious misuse.
The Gift‑Card Scam That Started It All
Yvonne Pire, CEO of Trofholz Technologies, recalls an incident from nine years ago when an employee received a seemingly innocuous text from his boss requesting gift‑card purchases for an office award. After several rounds of buying and sending the codes, the employee discovered the messages were not from his boss at all; he had lost $300 to a fraudster impersonating Pire. The story illustrates how even low‑tech social engineering can succeed when trust is exploited—a precursor to today’s far more sophisticated AI‑driven attacks.
How AI Amplifies Social Engineering
Today, attackers use generative AI to produce emails and texts that mimic a boss’s tone, eliminate obvious typos, and use legitimate‑looking addresses. Pire notes that her staff now receives weekly AI‑generated requests to buy supplies, update direct‑deposit information, or pay fake invoices—all impersonating trusted colleagues. The technology removes the tell‑tale signs that once helped employees spot fakes, making social engineering far more convincing and scalable.
Verizon 2026 DBIR Insights
The 2026 Verizon Data Breach Investigations Report, which examined over 22,000 confirmed breaches across 145 countries, found that the human element was involved in 62 % of incidents, up from 60 % the prior year. Social engineering ranked as the third most common attack pattern, representing 16 % of breaches. Notably, exploitation of software flaws climbed to 31 % (from 20 %), while ransomware appeared in 48 % of breaches, up from 44 %. These trends underscore a shift toward faster, more technical intrusion methods that still rely heavily on human error.
The Rise of Shadow AI and Data Exposure
Corporate AI usage has surged: regular AI tool use on work devices tripled from 15 % to 45 % of employees in a single year. About two‑thirds of those users accessed AI through personal, non‑corporate accounts, rendering security teams blind to what data is being uploaded. This “shadow AI” creates a significant gap—sensitive information can be fed into public models without oversight, increasing the risk of inadvertent data leaks or model poisoning.
Attackers Exploit Human Weaknesses and Speed
Caleb Kwong, CEO of Savant Solutions, observes that attackers now combine volume and velocity: they flood targets with spam emails to feign an IT emergency, then pose as help‑desk staff via Microsoft Teams to gain remote desktop access. Because AI enables rapid scanning for vulnerabilities, the window to patch known flaws has shrunk dramatically—quarterly updates are no longer sufficient. Kwong stresses that even with robust tools, misconfiguration leaves exploitable holes that attackers can linger in for weeks.
Third‑Party Risks and Ransomware Trends
Third‑party software and services have become a major breach vector, with involvement rising 60 % year‑over‑year to account for nearly half of all incidents. Ransomware remains a top threat for small organizations, encrypting files and demanding payment for release. The Verizon report dubs the current era the “Ransoming Twenties,” noting that ransomware’s persistence is akin to a wardrobe staple—ubiquitous and hard to eradicate. Email continues to be the primary delivery channel for these attacks, especially as mobile device usage blurs traditional phishing cues.
Costs, Savings, and the Need for Governance
IBM and Ponemon Institute research reveals that the global average cost of a data breach fell to $4.4 million, a 9 % drop driven by faster detection and containment. Organizations that extensively used AI in security saved an average of $1.9 million compared to peers without such tools. However, 13 % of firms experienced breaches involving their AI models or applications; of those, 60 % suffered data compromise and 31 % faced operational disruption. Alarmingly, 20 % of organizations discovered “shadow AI”—unauthorized AI implementations—highlighting the urgent need for governance, approval workflows, and continuous monitoring of AI assets.
Zero Trust, SOAR, and the Swiss‑Cheese Model
Kwong advocates a zero‑trust architecture that secures identity, devices, network, and cloud layers, closing gaps that attackers might exploit. He likens defense to Swiss cheese: each layer covers a hole, but attackers will always find a way through if any slice is misaligned. To improve responsiveness, many firms adopt SOAR (Security Orchestration, Automation and Response) platforms that automatically triage alerts, enabling faster containment. Kwong’s core message is simple: assume breach will happen and focus on rapid recovery rather than hoping for perfect prevention.
Building Ethical AI From Within
Pire has instituted weekly AI training for her team, blending practical AI use with cybersecurity lessons, and her IT department sends monthly phishing alerts. She uses AI to triage her inbox but insists on keeping a human in the loop for any outgoing communications. “AI is here to stay and will become what its builders intend,” she says, posing the critical question: Who’s doing the building? Ethical standards must be baked into AI development; otherwise, malicious actors will exploit the technology without hesitation. By participating in shaping AI’s future—rather than merely complaining about its risks—organizations can help ensure that the powerful tools they adopt serve defensive, not offensive, ends.
Stay informed on business developments in the Capital Region by subscribing to the Comstock’s newsletter.