Notifications
Clear all
Topic starter
18/08/2026 2:54 pm
TL;DR: AI is lowering the barrier to industrialized social engineering and faster vulnerability discovery, according to Expel’s Q1 2026 threat report, with HexagonalRodent and Anthropic Mythos showing how attackers can scale fake personas, malware work, and exploit research. The real shift is not magical new capability, but cheaper, faster operations that stress identity controls, patching, and detection.
NHIMG editorial — based on content published by Expel: the Q1 2026 AI threat landscape roundup
Questions worth separating out
Q: How should security teams detect AI-generated social engineering that looks legitimate?
A: Security teams should combine behavioural analysis, workflow verification, and channel-based risk scoring.
Q: Why does AI make identity and access controls easier to bypass?
A: AI lowers the cost of creating believable pretexts, fake personas, and polished communications, which lets attackers reach trust decisions more often.
Q: What do security teams get wrong about AI exploit discovery?
A: Teams often assume exploit discovery remains a scarce human activity, but the article shows machine-speed discovery and chaining across real software surfaces.
Practitioner guidance
- Harden identity verification for high-risk onboarding Require out-of-band validation for recruiters, contractors, and developers when offers, assessments, or vendor relationships create access pathways.
- Review PAM assumptions around human trust Treat phishing-resistant authentication, step-up verification, and least privilege as controls against industrialized deception, not just stolen passwords.
- Add AI-era abuse cases to detection engineering Build detections for generated personas, duplicate hiring patterns, repeated assessment reuse, and rapid changes in social graph behaviour.
What's in the full report
Expel's full Q1 Quarterly Threat Report covers the operational detail this post intentionally leaves for the source:
- The full HexagonalRodent investigation showing how AI-generated front companies and personas were operationalised across the campaign.
- The supporting threat-trend data from Expel Workbench™ that underpins the quarterly analysis.
- The Mythos discussion on how AI-assisted vulnerability discovery changes defender prioritisation and review timing.
- The two-part series context linking AI-as-bait with AI-as-infrastructure across Q1 2026.
👉 Read Expel's Q1 2026 threat report on AI-driven social engineering and vulnerability discovery →
AI as attack infrastructure: what security teams need to prepare for?
Explore further
18/08/2026 3:37 pm
AI has become attack infrastructure, not attack magic. The most important change in this report is economic, not technical. AI is making it cheaper to manufacture trust signals, produce convincing lures, and accelerate exploit research, which helps less skilled actors do more and skilled actors do it faster. For identity programmes, that means verification and access decisions now face industrialised deception rather than isolated fraud. The practitioner conclusion is that trust controls must assume scale.
A question worth separating out:
Q: How should organisations respond when attackers can industrialize trust-building?
A: They should assume trust can be fabricated at scale and design verification accordingly. That means stronger onboarding controls, least-privilege defaults, tighter review of externally sourced identities, and faster internal discovery of software weaknesses. The goal is to make deception expensive again by forcing attackers to clear multiple independent checks.
👉 Read our full editorial: AI is industrializing social engineering and vulnerability discovery
