Cybersecurity fatigue: A growing risk with AI-driven social engineering attacks

August 2024 Information Security, Training & Education


Adam Whittington.

Although the tactics and technologies cybercriminals use have evolved over the past 20 years, phishing and other social engineering attacks are nothing new. Despite the significant amounts of time and money invested in cybersecurity training and awareness, employee carelessness and ignorance remain the most vulnerable parts of the average enterprise’s security posture.

A recent study from security vendor SlashNext found that there has been a 341% increase in phishing attacks in the first half of 2024. If that is not disturbing enough, an alarming proportion of users still fall for phishing attacks — in our experience with phishing simulations, as many as 10% of users among our client companies will still fall victim. Statistics from Verizon show that the median time for users to fall for phishing emails is less than 60 seconds.

Phishing gets more sophisticated

So, what is going on here? There is little doubt that phishing attacks have grown in sophistication over the past few years. Criminals have added smarter techniques to their arsenal, such as ‘spear phishing’ — which targets people with highly convincing and personalised messages — and QR code phishing (quishing), which deceives a recipient into scanning a QR code that redirects them to a bogus website.

Furthermore, while many phishing messages still give themselves away through poor grammar or unnatural-sounding language, criminals have lifted their game. Generative artificial intelligence (AI) tools such as ChatGPT have been a godsend for cybercriminals, enabling them to generate more phishing emails than ever before, while improving the sophistication of their work.

They can, for example, use public data about executives and companies harvested with AI to launch precision attacks on company employees. In addition, Gen AI can help cybercriminals eliminate misspellings and grammar mistakes so that their emails seem like credible copies of communications from a bank or tax authority. Cybercriminals can also use Gen AI to rapidly build convincing landing pages to harvest logins and passwords from people they duped.

With this backdrop and companies taking end user education seriously, one would imagine that employees would be more alert, but the reality is that cybersecurity has become a topic that bores many end users. Not only have they tuned out from the warnings they get from their IT department on an almost daily basis, but they have also started to become tired of the friction that cybersecurity causes in their working lives.

Employees who experience cybersecurity training fatigue become less attentive and vigilant when it comes to identifying potential phishing threats. They are more likely to overlook suspicious indicators or engage with malicious content without critically assessing its legitimacy. As such, cybersecurity training fatigue can weaken an organisation's defences against phishing attacks.

More than a third of users cut security corners

One international study found that 54% of office workers are ignoring important cybersecurity alerts and warnings due to digital communication information overload. Nearly 47% agreed that information overload is inhibiting their ability to identify threats such as phishing emails, while 36% admitted to cutting corners on cybersecurity practices. Shockingly, less than a quarter report being engaged in their cybersecurity training.

Unless every end user is hyper-vigilant, it is only a matter of time before an attacker gets their hands on credentials or tricks someone into downloading a ransomware file. As such, it is essential to combat cybersecurity fatigue and keep users deeply engaged in the importance of security. It is helpful to understand why cybersecurity fatigue sets in, in order to rectify or prevent it.

As the research implies, one of the major issues lies in the sheer amount of information employees need to deal with. In addition to constant cyber threat warnings and frequent cybersecurity training, they may also receive a range of other compliance-related information in their inboxes. As a result, they may feel overwhelmed and start to tune out, or their ability to retain information might be compromised.

For employees who are under pressure to perform every day, cybersecurity training sessions might become an unwelcome chore. That is especially the case when they start to feel that the training is repetitive or that they already know the material. Then there is the effort involved in complying with security procedures, such as remembering long passwords or using multifactor authentication (MFA) every time they sign on.

Part of the answer lies in implementing information best practices such as policies dictating multifactor authentication (MFA) and strong passwords. These first lines of defence will foil most attempted breaches via phishing attacks. Zero-trust architectures, where no device, user or traffic is implicitly trusted, can also help stop attacks in their tracks. Passwordless authentication can reduce friction for end users.

Strengthening the weakest link

Ultimately, humans remain the weakest link. To mitigate this risk, organisations should deliver engaging, targeted training initiatives that address employees' specific needs and foster a culture of continuous learning and improvement. Microsoft's phishing simulation tools can be a helpful way to keep people on their toes, correct behaviour, and understand end user behaviour. Strategies such as gamification, role-based training, micro-learning, and reward programmes are also effective.

We also find that it helps to take a positive slant, focusing on what employees should do rather than what they must not do. This means offering ways for employees to do their jobs and remain productive — clear guidance around the right cybersecurity behaviours and principles. Positive reinforcement works better than a punitive approach, especially when the goal is to get users to report to IT when they see a suspicious message or believe they have fallen for a scam.

Ultimately, the objective is to create an environment where every employee understands the importance of addressing cyberthreats and commits to playing their part. With the right technology and an engaged, vigilant workforce, enterprises can be optimistic about their odds of success, but it requires an environment where people feel rewarded for constantly learning and adapting.

For more information, go to https://www.plusonex.com




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
SMARTpod talks to The Risk Management Forum
SMART Security Solutions Editor's Choice News & Events Security Services & Risk Management Videos Training & Education
SMART Security Solutions recently released its first SMARTpod podcast, discussing the upcoming Risk Management Forum Conference 2024, which will be held on 26 September 2024 at the Indaba Conference Centre in Fourways, Johannesburg.

Read more...
There is a SaaS for everything, but at what cost, especially to SMEs?
Editor's Choice Information Security Security Services & Risk Management
Relying on SaaS platforms presents significant cybersecurity risks as the number of providers in your landscape increases, expanding your attack surface. It is important to assess the strength of the SaaS providers in your chain.

Read more...
Addressing today’s mining challenges: cyber risks beyond IT
Editor's Choice Information Security Mining (Industry)
Despite the mining industry’s operational technology systems being vulnerable to cyberattacks, many decision-makers still see these threats as purely an IT issue, even though a breach could potentially disrupt mining operations.

Read more...
Get proactive with cybersecurity
Information Security
The ability to respond effectively to a cybersecurity breach is critical, but the missing piece of the puzzle is a thorough, proactive evaluation to ascertain weaknesses and identify any hidden threats.

Read more...
How to effectively share household devices
Smart Home Automation Information Security
Sharing electronic devices within a household is unavoidable. South African teens spend over eight hours per day online, making device sharing among family members commonplace. Fortunately, there are methods to guarantee safe usage for everyone.

Read more...
How to securely manage your digital footprint
Information Security Training & Education
Managing your online presence is critical to safeguarding your privacy and security. It is imperative to take a proactive approach, including using robust cybersecurity best practices.

Read more...
The state of code security in 2024
Information Security
The 2024 State of Code Security survey reveals that organisations have continued to shore up application security defences over the last year, according to OpenText Premier Partner iOCO Application Management.

Read more...
What is the level of safety and integrity of the software supply chain?
Information Security IoT & Automation
Organisations are embracing AppSec practices and focusing on their software security posture. However, they highlight that insufficient funding and security resources, plus a disconnect between developers and security teams, remain major roadblocks.

Read more...
Cybercriminals target financial service providers to get at sensitive client data
Information Security
According to Ryan van de Coolwijk, Product Head for cyber at iTOO Special Risks, hackers target financial service providers because they hold sensitive client information that unauthorised individuals could use for fraudulent activities.

Read more...