Cybersecurity fatigue: A growing risk with AI-driven social engineering attacks

August 2024 Information Security, Training & Education


Adam Whittington.

Although the tactics and technologies cybercriminals use have evolved over the past 20 years, phishing and other social engineering attacks are nothing new. Despite the significant amounts of time and money invested in cybersecurity training and awareness, employee carelessness and ignorance remain the most vulnerable parts of the average enterprise’s security posture.

A recent study from security vendor SlashNext found that there has been a 341% increase in phishing attacks in the first half of 2024. If that is not disturbing enough, an alarming proportion of users still fall for phishing attacks — in our experience with phishing simulations, as many as 10% of users among our client companies will still fall victim. Statistics from Verizon show that the median time for users to fall for phishing emails is less than 60 seconds.

Phishing gets more sophisticated

So, what is going on here? There is little doubt that phishing attacks have grown in sophistication over the past few years. Criminals have added smarter techniques to their arsenal, such as ‘spear phishing’ — which targets people with highly convincing and personalised messages — and QR code phishing (quishing), which deceives a recipient into scanning a QR code that redirects them to a bogus website.

Furthermore, while many phishing messages still give themselves away through poor grammar or unnatural-sounding language, criminals have lifted their game. Generative artificial intelligence (AI) tools such as ChatGPT have been a godsend for cybercriminals, enabling them to generate more phishing emails than ever before, while improving the sophistication of their work.

They can, for example, use public data about executives and companies harvested with AI to launch precision attacks on company employees. In addition, Gen AI can help cybercriminals eliminate misspellings and grammar mistakes so that their emails seem like credible copies of communications from a bank or tax authority. Cybercriminals can also use Gen AI to rapidly build convincing landing pages to harvest logins and passwords from people they duped.

With this backdrop and companies taking end user education seriously, one would imagine that employees would be more alert, but the reality is that cybersecurity has become a topic that bores many end users. Not only have they tuned out from the warnings they get from their IT department on an almost daily basis, but they have also started to become tired of the friction that cybersecurity causes in their working lives.

Employees who experience cybersecurity training fatigue become less attentive and vigilant when it comes to identifying potential phishing threats. They are more likely to overlook suspicious indicators or engage with malicious content without critically assessing its legitimacy. As such, cybersecurity training fatigue can weaken an organisation's defences against phishing attacks.

More than a third of users cut security corners

One international study found that 54% of office workers are ignoring important cybersecurity alerts and warnings due to digital communication information overload. Nearly 47% agreed that information overload is inhibiting their ability to identify threats such as phishing emails, while 36% admitted to cutting corners on cybersecurity practices. Shockingly, less than a quarter report being engaged in their cybersecurity training.

Unless every end user is hyper-vigilant, it is only a matter of time before an attacker gets their hands on credentials or tricks someone into downloading a ransomware file. As such, it is essential to combat cybersecurity fatigue and keep users deeply engaged in the importance of security. It is helpful to understand why cybersecurity fatigue sets in, in order to rectify or prevent it.

As the research implies, one of the major issues lies in the sheer amount of information employees need to deal with. In addition to constant cyber threat warnings and frequent cybersecurity training, they may also receive a range of other compliance-related information in their inboxes. As a result, they may feel overwhelmed and start to tune out, or their ability to retain information might be compromised.

For employees who are under pressure to perform every day, cybersecurity training sessions might become an unwelcome chore. That is especially the case when they start to feel that the training is repetitive or that they already know the material. Then there is the effort involved in complying with security procedures, such as remembering long passwords or using multifactor authentication (MFA) every time they sign on.

Part of the answer lies in implementing information best practices such as policies dictating multifactor authentication (MFA) and strong passwords. These first lines of defence will foil most attempted breaches via phishing attacks. Zero-trust architectures, where no device, user or traffic is implicitly trusted, can also help stop attacks in their tracks. Passwordless authentication can reduce friction for end users.

Strengthening the weakest link

Ultimately, humans remain the weakest link. To mitigate this risk, organisations should deliver engaging, targeted training initiatives that address employees' specific needs and foster a culture of continuous learning and improvement. Microsoft's phishing simulation tools can be a helpful way to keep people on their toes, correct behaviour, and understand end user behaviour. Strategies such as gamification, role-based training, micro-learning, and reward programmes are also effective.

We also find that it helps to take a positive slant, focusing on what employees should do rather than what they must not do. This means offering ways for employees to do their jobs and remain productive — clear guidance around the right cybersecurity behaviours and principles. Positive reinforcement works better than a punitive approach, especially when the goal is to get users to report to IT when they see a suspicious message or believe they have fallen for a scam.

Ultimately, the objective is to create an environment where every employee understands the importance of addressing cyberthreats and commits to playing their part. With the right technology and an engaged, vigilant workforce, enterprises can be optimistic about their odds of success, but it requires an environment where people feel rewarded for constantly learning and adapting.

For more information, go to https://www.plusonex.com




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Phishing attacks through SVG image files
Kaspersky News & Events Information Security
Kaspersky has detected a new trend: attackers are distributing phishing emails to individual and corporate users with attachments in SVG (Scalable Vector Graphics) files, a format commonly used for storing images.

Read more...
Crypto in SA: between progress and precaution
Information Security
“As cryptocurrency gains momentum and legitimacy, it’s becoming increasingly important for people to pay attention to financial security”, says Richard Frost, head of technology and innovation at Armata Cyber Security.

Read more...
Cyber recovery requires a different approach to disaster recovery
Information Security
Disaster recovery is about getting operations back on track after unexpected disruptions; cyber recovery, however, is about calculated actions by bad actors aiming to disrupt your business, steal sensitive data, or hold your system hostage.

Read more...
MDR users claim 97,5% less
Sophos Information Security
The average cyber insurance claim following a significant cyberattack is just $75 000 for MDR users, compared with $3 million for endpoint-only users, according to a new independent study.

Read more...
The impact of GenAI on cybersecurity
Sophos News & Events Information Security
Sophos survey finds that 89% of IT leaders worry GenAI flaws could negatively impact their organisation’s cybersecurity strategies, with 87% of respondents stating they were concerned about a resulting lack of cybersecurity accountability.

Read more...
Efficient, future-proof estate security and management
Technews Publishing ElementC Solutions Duxbury Networking Fang Fences & Guards Secutel Technologies OneSpace Technologies DeepAlert SMART Security Solutions Editor's Choice Information Security Security Services & Risk Management Residential Estate (Industry) AI & Data Analytics IoT & Automation
In February this year, SMART Security Solutions travelled to Cape Town to experience the unbelievable experience of a city where potholes are fixed, and traffic lights work; and to host the Cape Town SMART Estate Security Conference 2025.

Read more...
Gallagher Security expands Digital Badge Programme
News & Events Access Control & Identity Management Training & Education
Following a successful launch and roll out across Australia and Papua New Guinea in 2023, Gallagher announced its Digital Badge programme is now available to channel partners and end users across the rest of APAC IMEA.

Read more...
Kaspersky KATA 7.0 for targeted attack protection
Information Security Products & Solutions
] Kaspersky has announced a major update to its Kaspersky Anti Targeted Attack (KATA) including enhanced network detection and response (NDR) capabilities with deeper network visibility, internal threats detection and other critical security features.

Read more...
The role of advanced technologies in ransomware recovery
Information Security
As businesses increasingly adopt cloud technologies, the complexities of maintaining resilience and ensuring rapid recovery from such incidents become even more pronounced. The integration of advanced technologies is essential to navigate these challenges effectively.

Read more...