Topic starter
15/12/2025 4:02 pm
TL;DR: AI-generated email, voice, video, document, and chatbot impersonation now make social engineering harder to spot and easier to scale, with Delinea outlining how attackers can pressure employees into privileged actions, credential sharing, and unsafe approvals. Identity-based controls, PAM, vaulting, and stronger verification are now necessary because human trust cues no longer reliably separate legitimate requests from deception.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “How to mitigate AI-powered social engineering attacks”.
Key questions
Q: How should security teams stop employees approving fake requests that sound legitimate?
A: Use contextual approval controls, dual authorization, and identity verification outside the channel where the request arrived.
Q: Why do AI phishing attacks create more risk than traditional phishing?
A: AI lowers the cost, time, and skill needed to produce personalised lures, so attackers can run more campaigns and iterate faster.
Q: What breaks when privileged access depends on a manager's apparent authority?
A: The control fails when the request is persuasive enough to override verification, especially under urgency.
Practitioner guidance
- Enforce contextual privilege elevation Require time, location, request path, and role context before approving sensitive elevation, especially when the request arrives through email, chat, or voice.
- Add dual approval for sensitive actions Use a second approver for privileged requests that would otherwise be accepted on the apparent authority of a manager, executive, or support contact.
- Treat support chatbots as governed identities Inventory internal chatbots and AI support interfaces, assign ownership, and ensure they cannot collect secrets or direct privileged actions without identity checks.
Bottom line: AI-powered social engineering is eroding the reliability of human trust cues across email, voice, video, documents, and chat interfaces.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by NHI Mgmt Group
This topic was modified 10 months ago 2 times by Abdelrahman
This topic was modified 2 days ago by NHI Mgmt Group
11/10/2026 4:14 am
Human trust is no longer a reliable security control: AI has reduced the cost of producing convincing authority cues across every major communication channel. That breaks the assumption that employees can reliably separate authentic requests from fabricated ones by inspection alone. The practical conclusion is that trust must be verified by policy and workflow, not by judgement at the point of persuasion.
A question worth separating out:
Q: How should organisations govern employee use of consumer AI chatbots?
A: Organisations should treat consumer AI chatbots as external data processors and define exactly what employees may submit. The policy should classify sensitive prompts, require approved accounts or private modes for restricted data, and state whether tools that train on chat content are prohibited for company use. Enforcement matters more than awareness alone.
👉 Read our full editorial: AI-powered social engineering is breaking human trust controls