Check your exposure
Check where AI-assisted social engineering could work on you
Every organisation that acts on messages, calls or AI tool output is exposed. What matters is how many independent checks sit between a persuasive request and the action it asks for.
Last reviewed against NCSC (UK), UK Government (DSIT and Home Office) and Anthropic. Sources
Requests
Where one message can trigger action
List the actions that someone can set off with a message or call: a payment, a new payee, a password reset, a payroll change, a file share, a request for data. For each one, ask whether a second person or a second channel is needed. Any action that one well-worded email or call can complete is a weak point.
Also look at:
- Whether the confirmation goes back through the same channel the request arrived on
- Whether out-of-hours or "urgent" requests skip the normal steps
- Whether staff know which requests they are never expected to receive by email or phone
- Whether suppliers' bank detail changes are confirmed using details you already hold
People
Who is most likely to be targeted
Staff in finance, HR, the service desk and executive support are asked to act on requests as part of the job. The NCSC advises explaining the threat to staff in higher-risk roles instead of relying on general training alone [3]. Public information about your organisation also helps attackers: the NCSC suggests limiting what is public that could support spear phishing and watching what partners and suppliers reveal about you [3].
Hiring
Who you take on remotely
Anthropic described North Korean operatives using AI to create false identities, complete technical assessments and keep remote jobs at US technology companies [5]. Any organisation that recruits remotely for technical roles should ask what extra identity checks it uses. The page on fake job applicants covers this.
Tools
Which AI systems you run
Make a list of every AI chatbot, assistant or agent in use, including those staff adopted themselves. For each, record the data it can see, the actions it can take and the people who can use it. The NCSC's guidance says organisations should understand the data, model and software supply chains behind AI and ask suppliers about their security [9].
A quick test
Ask one finance colleague and one service desk colleague what they would do if a senior person emailed, then rang within minutes, asking for something urgent and unusual. If either would simply comply, you have found a weakness to fix first.
Evidence
What the UK data shows
The 2025/2026 government survey found 43% of businesses suffered a breach or attack over the preceding year, and 38% met phishing [4]. Of those hit, 69% said phishing was the most disruptive type [4]. Among the 31% of businesses that use or are weighing up AI, 24% had practices in place for its risks [4].
Next: the defence plan turns each gap into an action.
Am I affected?
Answer a few questions
Check if you are affected
Answer three questions about how requests reach your staff and how you use AI tools. Nothing you answer leaves this page.
Could a payment, a password reset or a change of bank or payroll details go ahead because a message or call looked and sounded right?
What is affected
The software and products in scope
Staff who act on email, messages or calls[4]
Phishing was by far the most common attack type in the 2025/2026 government survey, reaching 38% of businesses.
Finance, HR and service desk teams[8]
Vodafone's research found 40% of respondents could recognise voice-based scams, against 63% for text phishing.
Organisations that hire remote technical staff[5]
Anthropic described North Korean operatives using AI to get and keep remote technical jobs under false identities.
Organisations that deploy chatbots and AI assistants[9]
The NCSC calls prompt injection one of the most widely reported weaknesses in large language models.
Organisations with unpatched or unsupported systems[1]
The NCSC expects AI to increase the volume of attacks against systems that lack security fixes.
Keep reading
Read next
How to defend
An ordered plan for UK organisations: layered phishing defences, second-channel checks, blame-free reporting and limits on your own AI tools.
Read the guide
AI phishing
Why phishing polished by AI is harder to spot by its wording, what UK data shows about phishing and the layered defences the NCSC recommends.
Read the guide
Voice scams
What UK research says about staff recognising voice-based scams, how fake audio is reported by security leaders and how to confirm a caller safely.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Defending against AI-assisted social engineering is a matter of decisions: who may approve what, how requests are confirmed and what AI tools may do. A virtual CISO helps leaders set those rules and have them tested.