Businesses Should Be Paying Attention to AI-Powered Social Engineering

Scraping tools – once limited in scope – can now act on a much broader scale, compiling detailed profiles of employees from LinkedIn posts, press releases, and even unrelated social media chatter. AI-powered chatbots can adjust tone in real time when someone hesitates, making the exchange feel like a natural conversation rather than a script.

These are just a few areas in which AI adoption is powering a new level of cybercriminal sophistication. With greater speed, scale, and precision, attacks are now outpacing many traditional safeguards.

What’s at Stake?

For Marks & Spencer, the attack caused a loss in customer trust. For Land Rover, the focus was operational continuity. In the case of the nursery school breach, it was safeguarding children’s data. Different sectors and different attack vectors – but the risks are much the same: financial loss, regulatory penalties, and reputational damage that lingers long after the headlines fade.

So, what can businesses do to protect themselves from these types of scams? The answer doesn’t lie in any one piece of technology, but rather a multi-layered defence strategy.

Building Resilience

As with many risks in business, awareness comes first. Staff need to recognise the tricks criminals use – urgency, authority, fear – and feel empowered to question them. A culture of “pause and verify” is worth more than any firewall.

Another important ethos to adopt is “Don’t just train, test”. Phishing simulations might feel uncomfortable to deploy, but they reveal how employees would react in the moment, and you can provide real, actionable feedback to specific individuals who might be acting as a “weak point”.

It’s also key to upgrade your defences, especially if it’s been a while. Intelligent email filters and anomaly detection tools can take the pressure off staff by blocking the most obvious threats before they hit inboxes. At the same time, don’t overlook the fundamentals: multi-factor authentication remains one of the simplest ways to stop compromised credentials turning into a full-scale breach.

Finally, regular, comprehensive reviews of your policies and processes are essential to keep pace with the changing realities of cyber security. Incident response plans should be living documents, actively tested and refined and not left to gather dust on a server. It is also worth reviewing how much staff and company information is publicly available online. To further increase security, it may be beneficial to limit this information to reduce the risk of social engineering.

Conclusion

In truth, cybercriminals don’t need to target your systems if they can target your people, and by adding AI to the mix, the line between genuine business communication and criminal manipulation is becoming harder to spot.

That’s why social engineering, among other forms of cybersecurity, should be high on every organisation’s priority list. True resilience doesn’t come from a single product or quick fix, but from embedding data protection awareness, robust policies and procedures, and smart technology into the DNA of the organisation. Small steps taken now can prevent far greater disruption later.