Poland, September, 2026 - Phishing used to be easier to spot - a suspicious subject line, an obvious spelling mistake, or a logo that looked slightly off. That is changing. Companies are now facing a new generation of AI-enabled scams, including deepfake video calls, cloned executive voices, and phishing emails that can closely resemble legitimate internal correspondence. These threats cannot be addressed through technical controls alone.

AI is making familiar social-engineering techniques more convincing and easier to adapt. A message can be written to match the tone of a colleague. A voice can be used to impersonate an executive. A video call can create the impression that a familiar person is giving an urgent instruction. These scenarios make it increasingly difficult for employees to rely on appearance, tone, or familiarity when deciding whether a request is legitimate.

Cybersecurity Analytics (CA), a Gdańsk-based cyber defence and technology risk firm, says the response needs to extend beyond the IT department. Decisions such as how a company verifies a wire transfer request, whether finance has a callback procedure for urgent messages from an executive, or how a vendor's identity is confirmed are business-process decisions as much as cybersecurity decisions.

When these safeguards exist only within IT, other departments may continue operating under assumptions that no longer provide sufficient protection. A familiar voice, face, email style, or communication channel should not automatically be treated as proof of identity.

What Companies Can Do Now

Put a verification step between the request and the money.

Any wire transfer, credential reset, or urgent payment request - particularly one delivered through video, phone, or a message appearing to come from an executive - should require verification through a separate, trusted channel.

Treat AI-scam awareness as business training, not just an IT topic.

Finance, HR, procurement, and other teams involved in sensitive transactions should receive practical training based on realistic scenarios. Employees need to understand how to verify requests rather than simply learning definitions of “deepfake” and “phishing.”

Update the incident response plan for AI-enabled scenarios.

Organisations should consider how their incident response procedures would address a deepfake call, synthetic voice impersonation, fraudulent video communication, or AI-assisted phishing attempt. Clear responsibilities and escalation procedures can help employees respond consistently.

Bring risk management and IT into the same conversation.

Cybersecurity controls are more effective when business stakeholders understand the risks they are designed to address and participate in defining appropriate processes and approvals.

Do not rely on detection tools alone.

Security software can support detection, but no single technology should be treated as the only safeguard. Clear verification procedures - including who checks a request, who approves it, and who has the authority to pause a transaction - provide an additional layer of protection.

As AI-enabled scams continue to evolve, organisations may need to think about cybersecurity beyond firewalls, monitoring tools, and technical controls. The ability to verify identity, authority, and intent should become part of everyday business processes.

For Cybersecurity Analytics, the broader message is clear: cybersecurity is a company-wide responsibility, not just an IT issue. Businesses need the right people, processes, and controls in place to identify and manage cyber risks.

About CA Cybersecurity Analytics

CA Cybersecurity Analytics is a global leader in cybersecurity, data protection, and AI risk management. The company delivers continuous threat monitoring, expert guidance on AI adoption, and enterprise-level security frameworks that actually work in real-world environments.
Their team of specialists helps organisations build resilience, reduce operational risks, and navigate the increasingly complex world of digital security confidently.