As cybercrime grows, the cybersecurity industry has had to adopt the latest technology to keep up.
Artificial intelligence (AI) has quickly become one of the most helpful tools in stopping cyberattacks, but attackers can use it too. Recent phishing trends are a perfect example of both sides of the issue.
Phishing is by far the most common type of cybercrime today . As more companies become aware of this growing threat, they have implemented AI tools to stop it.
However, cybercriminals are also increasing their use of artificial intelligence in phishing.
Here’s a closer look at how both parties are using this technology and who benefits more from it.
How Does AI Help Fight Phishing?
Phishing attacks take advantage of people’s natural tendencies for curiosity and fear.
Because this social engineering is so effective, one of the best ways to guard against it is to make sure you don’t see it. This is where artificial intelligence comes into play.
Anti-phishing AI tools often come in the form of advanced email filters. These programs scan your incoming messages for phishing attempts and automatically send suspicious emails to your junk folder.
Some new solutions can: Detect phishing emails with 99.9% accuracy by creating different versions of scam messages based on real examples to train themselves to detect variations.
As security researchers detect more phishing emails, they can feed more data into these models, making them even more accurate.
AI’s continuous learning capabilities also help improve models to reduce false positives.
AI can also help you stop phishing attacks when you click on a malicious link. Automated monitoring software can create a baseline for normal behavior and detect anomalies that are likely to occur when someone else uses your account.
They can then lock the profile and alert security teams before the intruder does too much damage.
How Do Attackers Use Artificial Intelligence in Phishing?
AI’s potential to stop phishing attacks is impressive, but it is also a powerful tool for creating phishing emails.
As generative AI like ChatGPT becomes more accessible, it makes phishing attacks more effective.
Spear phishing, which uses personal details to create user-specific messages, is one of the most effective types of phishing.
An email that gets all your personal information correctly will naturally be much more convincing.
However, creating these messages has traditionally been difficult and time-consuming, especially on a large scale. With generative AI, this is no longer the case.
Artificial intelligence can generate massive amounts of tailored phishing messages in a fraction of the time a human can.
He’s also better than humans at writing convincing fakes. In a 2021 study, AI-generated phishing emails saw significantly higher click-through rates than human-written ones — and this was before the release of ChatGPT.
Just as marketers use AI to customize customer outreach campaigns, cybercriminals can use it to create effective, user-specific phishing messages.
As generative AI improves, these hoaxes will only become more convincing.
Attackers Stay Ahead Thanks to Human Weaknesses
As attackers and defenders benefit from AI, which side has seen the most significant benefits? If you look at recent cybercrime trends, you will see that cybercriminals are evolving despite more advanced protections.
Business email compromise attacks rose 81% in the second half of 2022, and employees opened 28% of those messages.
This is part of a longer-term increase of 175% over the past two years, which shows phishing is growing faster than ever.
These attacks are also effective. Stealing $17,700 per minute , which is probably why they’re behind 91% of cyberattacks.
Why has phishing increased so much despite artificial intelligence improving anti-phishing protections? It probably comes down to the human element. Employees must actually use these tools to be effective.
Beyond that, employees may engage in other unsafe activities that make them susceptible to phishing attempts, such as logging into work accounts from unauthorized, unprotected personal devices.
The aforementioned survey also found that employees reported only 2.1% of attacks. This lack of communication can make it difficult to see where and how security measures need to be improved.
How to Protect Against Increasing Phishing Attacks?
Given this alarming trend, businesses and individual users must take steps to stay safe.
Implementing AI anti-phishing tools is a good start, but it can’t be your only measure. Not only are 7% of Security teams not using or planning to use AI, but phishing continues to dominate, so companies need to address the human element as well.
Since humans are the most vulnerable link to phishing attacks, they should be the focus of mitigation steps. Organizations should make security best practices a more prominent part of employee onboarding and ongoing training.
These programs should include how to detect phishing attacks, why this is a problem, and simulations to test the retention of information after training.
It’s also important to use stronger identity and access management tools, as they help stop successful breaches once you get into an account.
Even experienced employees can make mistakes, so you must be able to detect and stop breached accounts before they cause major damage.
AI is a Powerful Tool for Both Good and Bad
AI is one of the most disruptive technologies in recent history. Whether this is good or bad depends on its use.
It is crucial to recognize that AI can help cybercriminals as much as – or even more than – cybersecurity experts.
When organizations acknowledge these risks, they can take more effective steps to address increasing phishing attacks.
