Updated October 2026 to our current guidance. The original reporting date is unchanged.
Criminals pick up new tools quickly, and AI is one of them. It has not invented many new tricks. It has made the old ones cheaper to run and easier to believe. Here is what that looks like, and what still works against it.
Most businesses I talk to have the basics: antivirus on the computers and email that filters out the obvious junk. That setup has worked, and most of it still does its job. AI changes the parts of a scam that used to give it away.
AI can pull together what is public about your company, from the website, social media, and old data leaks, and write a message that sounds like it came from someone you know. The spelling mistakes that used to give a scam away are gone. A person writing by hand might send a few dozen targeted emails in a day. With AI, one person can send thousands, each written for its recipient.
AI can copy a voice from a short recording and put a familiar face on a video call. In February 2024, Hong Kong police reported that a finance worker at a multinational firm paid out about $25 million after a video call in which the company’s chief financial officer and several colleagues all turned out to be deepfakes. The firm was later identified as the engineering company Arup.
Sources: CNN, February 4, 2024; CNN, May 17, 2024.
AI can help with the routine parts of an attack: picking targets, writing messages, and trying a different approach when the first one fails. The result is volume. More attempts reach more people, and they read better.
For anything involving money or access, such as a wire transfer, a change to a vendor’s bank details, or a password reset, confirm it another way before acting.
The Hong Kong case is the reason for that last point. A convincing face on a call is no longer proof of anything.
Update your examples. A scam email today often has perfect grammar and your real details. Make it normal, even expected, for staff to question an odd request from the boss. In my experience, a team that is comfortable asking “did you really send this?” stops more scams than any filter.
Turn on two-step sign-in for email and anything that touches money, using an authenticator app rather than a text message where you can. A stolen password alone then gets nobody in.
Windows Update never touches third-party software.
It keeps Windows current. It does not update your PDF reader, the file compression tool, the remote-access program, or the specialty app your office runs on. Each has its own updater, or none. Nobody did anything wrong. That is where Windows Update’s job ends.
When an AI-assisted attack goes looking for a way into a computer, the easy door is usually a published flaw in a program whose fix has not been installed. So who has been checking those programs on your computers?
Before you look, guess how many programs are installed on the computer in front of you. Write it down. Then run the Reveal Scan. It counts what is installed on each Windows PC: how many programs are current and how many need updating. Most people are surprised by the first number, and the second one is usually higher than they expected. You don’t have to be able to do this. We’ll do it with you.
Count What’s on Your Computers → See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed. The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
If you run it and never speak to us again, that’s a fine outcome.
Join the owners who get Craig's Insider Notes every week.
Tagged with: