As fraud becomes more sophisticated, so must our defence strategy

A new type of fraud is repeatedly making the headlines in the Belgian media. Classic phishing e-mails with spelling errors or poor grammar are a thing of the past; modern fraud is almost indistinguishable from reality.

Earlier this year, for example, the federal authorities warned of scammers who used AI to mimic King Philippe’s voice and even his image in order to persuade victims, in a very subtle way, to transfer money. Other cases involved Flemish celebrities and news anchors being used in authentic-looking videos to make fake investment platforms appear credible. Further examples include WhatsApp investment tips that exploit social proof (such as peer pressure and Fear Of Missing Out) to persuade victims to deposit large sums of money. Public institutions and banks are also increasingly used as bait in these scams. For example, you may receive a phone call, allegedly from your bank, asking you to block a suspicious transaction (ed. always use the ‘Check who’s there’ button in KBC Mobile if this happens), or fake e-mails from mypension.be following a notification saying that official information regarding your pension will be temporarily removed from the site. Cybercriminals eagerly exploit current events to lure you into their trap.

Even companies are targeted: employees receive urgent calls from someone posing as the CEO or CFO, whose voice sounds exactly like them but later turns out to have been generated by AI. A hospital was forced to shut down its servers following a cyberattack. Surgeries were cancelled and services scaled back. This incident illustrates how weaknesses in the supply chain (external software) can act as a gateway.

To make matters worse, cybercrime is becoming more professional. Data theft and social engineering (such as phishing, vishing, and deepfake audio/video) are evolving into a marketplace with data and access brokers and crime-as-a-service. AI is taking the persuasiveness of scams to a whole new level. 

Scammers no longer exploit people’s ignorance, but their trust: recognisable voices, familiar faces, trusted authority. That is exactly what makes these attacks so dangerous. Because the incidents are much more convincing, they cause greater damage. 

There is an important counterbalance to this reality: while AI can be misused, it can also be leveraged for protection. 

A Security Operations Centre (SOC) is an organisation’s (physical or virtual) cybersecurity command centre. This is where cyber threats are monitored, analysed and managed 24/7.

SOCs are responsible for:

• Monitoring: continuous monitoring of IT systems, networks, cloud environments and endpoints  
• Detection: identifying suspicious activities and cyberattacks
• Analysis: assessing an incident’s severity
• Response: taking swift action to limit damage (isolating, blocking, recovering)
• Reporting and improvement: learning from incidents and enhancing security measures

SOCs are evolving from human incident response teams to AI-driven, partly autonomous, defence platforms.

The advantages are clear:

• Speed and scale: AI can analyse millions of signals at once (something that is impossible for humans), allowing suspicious patterns to be identified more quickly, often before any actual damage occurs.
• Behavioural recognition: instead of following fixed rules, AI learns what is considered ‘normal’ behaviour within an organisation or for a user. Any deviations, however subtle, are detected more quickly.
• Less human error: AI filters out noise and helps you focus on what really matters, reducing the risk of crucial signals being lost in the abundance of information.
• AI can act independently: in modern SOCs AI is permitted, albeit under strict conditions, to carry out actions itself, such as isolating a device from the network, temporarily blocking an account or terminating a malicious connection. These are crucial actions in cases involving ransomware or data theft, where every minute counts.
• Continuous improvement: after every incident, AI learns what was correct. It adapts its models, thereby reducing future false positives, transforming cybersecurity into an adaptive, self-learning system, with the SOC becoming smarter after every attack.

In other words: AI makes cybersecurity more proactive and consistent, and less dependent on scarce human expertise. And that is exactly what is needed right now, with attacks escalating in terms of both speed and sophistication. 

It is notable that cyber risks increasingly intersect with other major themes such as geopolitics, energy supply, supply chains and even democratic processes, with digital sabotage being used to create social unrest and influence decision-making.

The European NIS2 Directive (Network and Information Security Directive 2) aims to enhance Europe’s digital resilience against cyberattacks, IT failures and digital disruption.  Consequently, cybersecurity has become a continuous and structural responsibility at management and board level.

For most companies, this means:

• Permanent monitoring of digital risks
• Mandatory incident reporting
• Demonstrable preventive measures
• Attention to the entire digital chain, including suppliers