Defence plan
How to defend your organisation against AI social engineering
No update fixes this. The defence is layers: make it hard for attackers to reach your people, help people report, limit the damage if one succeeds and be ready to respond.
Last reviewed against NCSC (UK), UK Government (DSIT and Home Office) and Anthropic. Sources
Approach
Four layers, not one
The NCSC's phishing guidance describes four layers: make it difficult for attackers to reach users, help users identify and report phishing, protect the organisation from the effects of a successful attack, and respond quickly to incidents [3]. AI changes the quality of the lure, not the logic of the defence, so the same layers apply.
Sequence
What to do, in order
-
1
Identify the processes where a message or call can release money, change access or expose data. -
2
Require confirmation by a second type of communication for those processes [3]. -
3
Turn on multi-factor authentication and limit administrator accounts [3]. -
4
Set up a clear, quick reporting route and say that nobody is reprimanded for reporting [3]. -
5
Review the AI tools in use and limit what each can access and do [2]. -
6
Write an incident plan that names who does what, and test it [3].
Judgement
Where leaders go wrong
Relying on staff to spot polished lures
Treating AI risk as a separate project
The NCSC's assessment points organisations to its Cyber Assessment Framework and 10 Steps to Cyber Security, and says strong basic security is key to mitigating AI-enabled threats [1]. Patching, identity and logging come first.
Expecting a product to remove prompt injection
The NCSC cautions that prompt injection may never be closed off as SQL injection can be, and urges developers to cut its likelihood and impact [2]. Be sceptical of any claim that a tool stops it completely.
First job
Pick the approval route that carries most risk, document its extra check in a short note, and invite a colleague to try to talk their way past it.
Go deeper
Pages for each part
Read how to train staff for the people layer and how to secure your AI tools for the tools layer. If something has already gone wrong, the incident layer shows how one extortion case unfolded.
What to do
Six steps, in order
-
Step 1
Confirm risky requests on a second channel[3]
Treat any request for money, access or sensitive data as unconfirmed until it is checked by a different type of communication, such as ringing a known number or logging in to the account directly.
Who: Finance, HR, service desk and all staff
-
Step 2
Make reporting simple and blame-free[3]
Give staff a clear, quick way to report suspected phishing and say plainly that nobody is reprimanded for struggling to spot it or for having clicked. Measure reports as well as clicks.
Who: Security leads and managers
-
Step 3
Protect against the effects of a successful attack[3]
Use multi-factor authentication, limit administrator accounts, keep devices and software up to date and supported, so a stolen password or a clicked link does not hand over everything.
Who: IT teams
-
Step 4
Put limits on AI tools that read untrusted content[2]
Reduce the privileges of any AI tool that processes outside content, log its inputs, outputs and tool calls, and rely on safeguards that do not depend on the model behaving.
Who: IT, development and security teams
-
Step 5
Ask suppliers how their AI is secured[6]
Understand the data, model and software supply chains behind the AI services you buy, and ask suppliers about their own security. Use the government's code of practice for securing AI as a baseline.
Who: Procurement and security leads
-
Step 6
Write and rehearse an incident plan that covers these attacks[3]
Define who does what, including forcing password resets and removing malware, and test the plan before an incident. Include how staff report an incident if their device is compromised.
Who: Incident owners and security leads
Keep reading
Read next
AI phishing
Why phishing polished by AI is harder to spot by its wording, what UK data shows about phishing and the layered defences the NCSC recommends.
Read the guide
Voice scams
What UK research says about staff recognising voice-based scams, how fake audio is reported by security leaders and how to confirm a caller safely.
Read the guide
Fake applicants
Anthropic reported North Korean operatives using AI to win remote technical jobs under false identities. What UK employers can take from the case.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Defending against AI-assisted social engineering is a matter of decisions: who may approve what, how requests are confirmed and what AI tools may do. A virtual CISO helps leaders set those rules and have them tested.