AI, Emerging Cyber
Threats & Digital Hygiene

Securing data, systems, and people
in a rapidly changing threat landscape.
A 2.5-hour session for all staff.

Every employee with system access is a custodian of sensitive data

We run on cloud workflows, automated analytics, and remote access portals.

Security is now an everyday operational habit, not just an IT job.

Today: real cases, how AI changed the attacks, and the habits that stop them.

AI now sits on both sides of the table

Organizations

Automated analytics, digital workflows, data-driven decisions

Attackers

From broken-English scams to autonomous, hyper-personalized operations

Spotting spelling mistakes no longer protects us. AI writes flawless, role-specific lures and probes networks 24/7.

Part 1

What the attacks look like now

Real breaches, AI-driven intrusions, and the lures landing in our inboxes

Binance · Oct 29, 2026

One laptop opened the door to $6.3 billion

$6.3B

in digital assets taken, the largest crypto theft on record. About $2.85B frozen or intercepted; the FBI attributes it to North Korea.

  • Entry: a compromised DevOps engineer's laptop reached a service container and submitted unauthorized withdrawals. No wallet keys leaked.
  • More breach points followed: a multi-stage attack, not a single login.

The weakest link is rarely the central server. It's the endpoint on someone's desk.

Agentic AI attacks link every stage of an intrusion at machine speed

Humans still pick targets, but machines now do the work in between, leaving defenders less time to react.

Search targets

Scans many organizations at once

Test entry

Probes leaked credentials and portals

Explore

Maps the network from inside

Escalate

Climbs to higher access

The UK NCSC says hostile AI will "highly likely" scale up ransomware, social engineering, and exploitation within two years. Our main risks: leaked credentials, misconfigured portals, weak APIs.

Sources: Canadian Centre for Cyber Security; UK NCSC

Phishing lures now impersonate the people we trust most

  • Trusted identities: fake regulators, vendors, executives, and legal counsel.
  • Familiar subjects: "Compliance Notice", "Urgent Invoice", "Review Documents", laced with Remote Access Trojans.
  • Pressure points: we open outside attachments daily; quarter-end pressure is when checks get skipped.
  • One click: a .zip or macro spreadsheet can give an attacker a live view of your screen.

From the investigator's desk

Crypto investment fraud built on stolen trust

Composite case from the presenter's work as a cyber forensic investigator assisting investigating agencies. Anonymized and illustrative.

How it began

A victim was groomed on a messaging app and steered to a fake crypto trading platform showing fabricated "profits".

The lapse

Deposits went to mule accounts opened with shared or rented KYC credentials; withdrawals were blocked behind fake "tax" fees.

How it was traced

Blockchain tracing of wallet hops to an exchange, KYC records requested through the investigating agency, and device and IP logs linking mule accounts.

From the investigator's desk

An insider's shared credentials enabled financial fraud

A composite, anonymized, illustrative case.

How it began. An employee shared portal credentials and left a signature token plugged in "for convenience".

The lapse. A phishing RAT on that workstation let outsiders approve payee changes and divert vendor payments.

How it was traced. Forensic imaging, login times against attendance records, and the money trail in bank statements.

The pattern. Cyber compromise and financial fraud are one coin; attackers read our digital trails as investigators do.

Three seconds of audio is enough to clone your Director's voice

  • At Arup, a deepfake video call with a fake CFO led to 15 transfers totalling about $25M.
  • Typical script: "Process this payment before I board my flight."

Golden rule: never act on urgent payment, access, or data requests made only by phone, voice note, or chat. Verify on an independent official channel.

Sources: BleepingComputer; Financial Times

Shadow AI quietly leaks our data to outside servers

Shadow AI means using free public chatbots, PDF summarizers, or OCR converters for official work.

Pasting reports, client IDs, memos, or financial records sends them off our network.

Many tools keep inputs to train future models.

Policy: official documents go only into approved tools.

15-minute exercise

Spot the trap

The urgent .zip

An email from notices@organization-portal-support.org with an urgent .zip about your account

The MFA request

A chat from an unknown number with a senior leader's photo, asking for an MFA code

The visitor's USB

A visitor hands you a USB drive of "supporting presentation files"

For each one: what's the red flag, and what's the safe protocol?

10-minute break

Part 2: Cyber hygiene habits

Three pillars that turn awareness into daily practice

Pillar 1

Your identity and tokens are your signature

Never share SSO, portal, or system passwords, even with assistants or contractors.

Never leave hardware keys or digital signature tokens plugged in unattended.

Anything done with your credentials is your responsibility.

Treat an unexpected MFA push or OTP as an attack in progress: deny it and report it.

Pillar 2

Keep endpoints, USBs, and messaging clean

No official documents, customer lists, or internal intelligence on personal messaging apps or email.

No personal phones, unapproved drives, or third-party USB sticks in work computers.

Outside parties share files only through approved secure portals.

Lock your screen every time you step away.

Pillar 3

Pause, verify, report

Pause

Urgency and secrecy are the attacker's main tools.

Verify

Call back on a known internal number or confirm in the official workflow.

Report

Tell IT/security right away; a quick report limits the damage. Don't delete the evidence.

Security is a daily habit, and you
are the first line of defense

One verified call, one denied prompt, one report
can stop the next breach.