AI is changing how cybercriminals work, but perhaps not in the way the headlines suggest. That was the starting point for our recent webinar with the South East Cyber Crime Unit, where Police Cyber Security Advisor Jez Rogers and ramsac’s Head of Cyber Security, Josh White, combined a law enforcement view with what we’re seeing in our customers’ environments. If you missed it, here are the main points.
The same attacks, with more speed, scale and polish
Jez’s first message was a reassuring one. Law enforcement isn’t seeing brand new categories of crime because of AI. Phishing is still phishing, credential attacks are still credential attacks and social engineering still relies on manipulating people. What AI has changed is how quickly, widely and convincingly those attacks can be carried out.
The badly written email addressed to “Dear Sir/Madam” is largely gone. AI tools can scrape LinkedIn for organisation charts, copy a chief executive’s writing style and add personal details from social media, all in flawless English.
As Jez put it, AI has accelerated the how of cybercrime but not the what. That matters, because it means the defences most organisations already know about still work.
Deepfakes and the problem of assumed authenticity
Jez pointed to the case at engineering firm Arup, where a finance employee in Hong Kong joined a video call with what appeared to be the chief financial officer and other senior colleagues. Every one of them was a deepfake built from publicly available footage, and the employee went on to transfer around US$25 million. None of Arup’s systems were breached; it was social engineering from start to finish.
In Jez’s words, the failure point was “assumed authenticity”: if it looks and sounds like your CFO, surely it is. That’s why he urged leaders to put verification processes in place that don’t depend on recognising a face or a voice.
What ramsac is seeing
Across the customers whose security we monitor, Josh said AI hasn’t caused a wave of compromised accounts or successful phishing. What has changed is speed. A year or so ago, an attacker might sit quietly in a mailbox for days or weeks; now automated tools act within minutes, scoping what the account can reach, taking data or setting up email forwarding rules. Techniques that once needed a skilled attacker are now available to anyone, at scale.
Josh shared three examples. First, when a supplier’s mailbox is hacked, a tool can quietly swap a genuine link in their emails for a malicious one, so you get an email you were expecting, from someone you know, with a dangerous link inside. Second, malware on personal devices now tries every saved work password it finds, and some users hadn’t realised an attack at home could reach their work account. Third, attackers automatically log in from the same country as their victim so they don’t trigger location alerts.
In each case, our cybersecurity monitoring and response solution spotted signs such as a sign-in from an unfamiliar device or VPN service, and locked the account down while we investigated. Attackers know which controls exist in Microsoft 365 and design around them, so someone watching for the moment of compromise is the safety net.
The basics still defeat most AI-enabled attacks
Both speakers came back to the same idea: good security is about layers. Jez compared it to protecting your home, where locks, lights, a doorbell camera, crunchy gravel and a barking dog each put off a different kind of intruder. The controls they recommended are familiar, but they matter more than ever:
🔐 Multi-factor authentication (MFA) everywhere, moving towards passwordless sign-in with passkeys or biometrics, which is far more resistant to phishing. Simple MFA still defeats most automated password attacks.
📧 Email security, including filtering and the three email authentication standards that stop criminals spoofing your domain: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance).
🌍 Conditional access policies that block sign-ins from countries or locations where your organisation doesn’t operate.
⏱️ Prompt patching, with a clear understanding of what your IT provider has agreed to patch and how quickly.
💻 Endpoint protection on every device.
👤 Separate admin accounts that are never used for everyday email or browsing,
🗝️ Least privilege access, so people only have the access their current role needs. Jez suggested HR and IT sit down regularly to check who has access to what.
Jez also made the point that your organisation owns its cyber risk. A good IT partner should welcome a conversation about what you’re paying for, what’s covered and what isn’t.
Give your people permission to question
Technology only goes so far against attacks designed to manipulate people. Jez encouraged everyone to notice how a message makes them feel: authority, urgency and fear are the classic triggers, whether a request seems to come from the boss, the bank or your IT provider.
That’s why culture matters so much. Staff need to feel confident saying “hang on, something’s not right here”, and leaders need to make clear they’ll be thanked for checking, even when it turns out to be a false alarm. Josh added that senior leaders should actively welcome being questioned when data or money is at stake.
Jez shared a story that shows why. At a company in East Sussex, a young work experience placement in the finance team spotted an email from the finance director that didn’t feel right. She’d been told it was fine to ask questions, so she rang him. He hadn’t sent it, and £150,000 stayed in the business.
Awareness training should also cover text messages, phone calls, QR codes and fake meeting invitations, as well as email. The South East Cyber Crime Unit offers fully funded training for leadership teams and staff, and the National Cyber Security Centre (NCSC) has free resources to share with your team.
Report it, and look at your supply chain
If you do fall victim, Jez asked that you report it to Report Fraud, which replaced Action Fraud in December 2025. Not every report leads to an investigation, but each one helps law enforcement act on threats nationally. He also highlighted supply chain risk: encouraging suppliers to achieve Cyber Essentials is a sensible start, as certified organisations are 92% less likely to make a cyber insurance claim, according to the NCSC. ramsac can help you achieve Cyber Essentials and Cyber Essentials Plus.
What’s next
Thank you to Jez and the South East Cyber Crime Unit for joining us, and to everyone who attended and sent in questions. Jez has two more sessions planned, on what to do when the worst happens and on what good preparation looks like, and we’ll share details when they’re confirmed.
Would you like to know how well your organisation would stand up to an AI-assisted attack? Talk to our team to find out how we can help.
Understand your cybersecurity posture
Download our cybersecurity brochure to see how ramsac supports your organisation across the six core elements of cyber resilience: Govern, Identify, Protect, Detect, Respond and Recover. Discover how our services work together to reduce risk, strengthen security and help your business stay resilient.
FAQ: AI in Cybercrime
Can biometrics on a phone be faked?
This came up in the live Q&A. Josh’s view was that every technical control will eventually be tested by attackers, so biometrics shouldn’t be treated as unbreakable. Jez added that, in line with NCSC advice, moving from passwords to multi-factor authentication and then to passkeys and biometrics is a significant step up in security, even though nothing is 100% safe. The best approach is to layer your defences.
Why would criminals set up a fake video meeting?
A meeting invitation from a senior colleague is hard to ignore, and deepfakes now make the people on screen convincing enough to remove any doubt. Once you’re in the meeting, attackers might ask you to release funds urgently or share sensitive information.
How can we protect against deepfake payment fraud?
Set clear verification rules for payments and sensitive requests, using a trusted second channel such as calling a known number, rather than relying on a voice, video or message. Make sure staff know they’re expected to check, even when a request seems to come from the top.
Where should UK organisations report cybercrime?
In England, Wales and Northern Ireland, report fraud and cybercrime to Report Fraud at reportfraud.police.uk or on 0300 123 2040. In Scotland, contact Police Scotland on 101.
Is multi-factor authentication still worth it if attackers can steal MFA codes?
Yes. MFA still stops most automated password attacks. Because criminals do try to trick people into handing over codes, it’s worth combining MFA with staff awareness and moving towards phishing-resistant passwordless sign-in.
