A finance worker pays out $25 million after being tricked by a deepfake of his company's CFO. Rogue AI agents escape their testing environment to infiltrate a $13 billion company.
There's a media fascination with AI-powered threats that defy belief. Beyond the headlines about hyper-realistic video deepfakes and advanced autonomous exploits, however, there is a much more subtle and pervasive impact of widespread AI on the types of social engineering and fraud attempts small and mid-sized businesses are coming up against each day.
The primary threats organizations are grappling with today don't read like a sci-fi novel. Instead, they involve an erasure of traditional phishing "red flags" that organizations have relied on for decades. It's a small change powered by AI and sophisticated social engineering that's having a dangerous and outsized impact on daily risk.
Disappearing Indicators
Traditional social engineering indicators were easy to spot. Bad actors were often revealed by using poor grammar or broken English, unusual formatting, or suspicious email addresses.
Later iterations improved language, email appearance, relevancy of requests (no more long-lost inheritances!), and visually similar email address spoofing. These flags were harder to detect, but easier to teach through employee training.
Today, cybercriminals are armed with a new and powerful tool: AI. This means today's threats can have flawless language translation, which can even be hyper-localized to a specific region, brand, or person's tone. Communications are contextualized using information or examples scraped from public or corporate data. Individuals can be targeted with spear-phishing campaigns that are personalized quickly, and at scale.
These malicious campaigns are also no longer confined to the email inbox. Attackers are reaching mobile users via SMS phishing ("smishing"), on their social media accounts by impersonating trusted personas, and even through bad links disguised as QR codes.
AI's impact is adding up. According to research from Verizon, phishing is now involved in 36% of successful data breaches. Those compromises can happen quickly; cybersecurity firm Huntress recently found that the median time it takes for a user to click a phishing link and submit their information is under 60 seconds.
Cyber Insurance Claims in 2026
Looking at BOXX Insurance's real-world claims data, we see this AI-powered shift playing out significantly in 2026. The move from generic phishing to targeted, wildly convincing social engineering is having its desired effect.
Malicious actors are breaking through with increased success rates when it comes to Business Email Compromise (BEC) and funds transfer fraud in particular. Although many businesses are less familiar with this type of risk, BOXX's data reveals that cybercrime and invoice manipulation have supplanted ransomware as the most common type of claim filed.
In one real case, an organization had six-figure losses stemming from three instances of invoice manipulation. The criminal enterprise used spoofed domains to impersonate legitimate customers and send in orders for a popular condiment, which the insured shipped and invoiced, with the criminals absconding with the product and the invoices never being paid. For a typical small business customer of BOXX, this was a potentially devastating loss. Fortunately, their cyber policy covered this claim - even though their small team was unfamiliar with invoice manipulation.
Reducing Risk and Impact
Organizations, of course, are taking an active role in adapting their defenses to meet the new social engineering attack head-on.
This includes rigorous security awareness training for employees. Unfortunately, even for well-resourced teams, cybersecurity training falls short when it relies on humans spotting errors. SMEs looking to make the most of their cybersecurity budgets should keep in mind that as those red flags disappear, even the most highly trained employees are susceptible due to advanced social engineering techniques. Human defense mechanisms can only go so far in combating AI, and at its worst, employee training can create overconfidence and a false sense of security.
Businesses should also implement stricter operational controls, such as known-source dual authorization for financial transactions. Rather than expecting employees to manually spot hyper-realistic social engineering attempts, these safeguards can protect against loss before it occurs.
Advanced all-in-one cyber insurance and protection solutions can provide expert guidance and technology tools to help businesses reduce digital risk. Cyber awareness training programs and modules provided by modern-day insurtechs help employees and business owners spot early indicators of risk and report suspicious activity before an incident escalates. Resources like a vCISO to review operational controls (such as out-of-band verification steps for wire transfers and multi-factor authentication) can reduce reliance solely on human error detection. Real-time 24/7 breach response and mitigation teams can help contain compromised email accounts, revoke unauthorized access, isolate systems, and prevent illicit wire transfers from going through - all reducing the risk to a business's operations.
Prevention and response measures like these can make a massive difference to the bottom line. The BOXX Hackbusters® team, for example, has been able to prevent more than $1 million in fraudulent transfers this year alone due to quick mitigation techniques.
Brokers' New Role
Brokers have a vital role in cybersecurity awareness today, assessing risk and helping clients see beyond the AI headlines. When discussing evolving risks, there is actionable guidance brokers can bring to the client conversation:
- Bring awareness to social engineering. While extreme AI and deepfake attacks are fueling the news cycle, our data shows that social engineering attacks are growing more powerful and pervasive. Companies considering only ransomware in their risk calculations are ignoring one of their biggest attack surfaces.
- Underscore human limitations. Employees and management are on the front lines in the fight against social engineering attacks. While training can reduce risk, it's important to acknowledge that people cannot reliably spot modern AI-crafted fraud. That's why processes to uncover it are crucial.
- Address potential coverage gaps. Commercial liability policies may have a cyber add-on, but it will fall short of comprehensive cyber coverage and not include services like 24/7 breach response. In addition, some cyber policies may not ensure affirmative coverage for AI-driven social engineering and fraud attacks. Check for policy language and caps that may prevent payouts in the event of one or more losses.
Traditional cyber and crime policies may leave gray areas in coverage around AI-assisted deception. As social engineering evolves, insurance coverage needs to evolve along with it - providing financial recovery, response services, and ongoing risk management through rapid periods of change. Defensive strategies of SMEs must similarly shift from training and prevention to robust response practices, coupled with modern insurance backing.
The once obvious red flags may be disappearing, but if anything, cyber risks are growing - not just for the largest enterprises, but for businesses of all sizes. In this next evolution, brokers can be a lifeline for their SMB clients by educating their clients about this next wave of risk. Helping clients understand how a broad cyber policy with AI coverage can be a true lifeline to the business, as the cost of the policy will more than make up for the cost of recovery, halted operations, or reputational damage.
