How can I protect my business against AI-driven attacks?

One of the most effective defences against deepfake and voice-clone fraud is a process that cannot be overridden by a single call or video conference. Spotting deepfakes by eye or ear is not reliable, and their quality keeps improving. Rely on fixed rules instead:

Call back on a known number: every unusual payment instruction, every change of bank details and every request for credentials is confirmed through a second, independent channel, for example by calling back the number from the company directory, never the number supplied in the request. Four-eyes principle for transfers above a defined amount. No exceptions for urgency or confidentiality: that is exactly the pressure attackers build up. Some companies also agree on a code word for emergencies.

Management must explicitly apply these rules to itself as well. Employees need to be able to question an instruction "from the top" without negative consequences.

Better phishing emails almost always target credentials. Passwords and SMS codes can be intercepted, and one-time codes from authenticator apps can be relayed in real time through fake login pages. Phishing-resistant methods such as FIDO2 security keys or passkeys bind the sign-in to the genuine address of the service and fail on a fake page.

Start with administrator accounts, remote access (VPN, Remote Desktop), email and cloud services such as Microsoft 365. Our Microsoft 365 Security Check shows where your Microsoft 365 environment currently stands.

Many training courses still teach warning signs that AI has removed: clumsy language, wrong salutation, poor logos. It is more effective to watch for the triggers every social engineering attack needs: time pressure, secrecy, an unusual channel and a request to bypass a rule.

Practise concrete situations: the call from supposed management, the voice message asking for a transfer, the video conference with a poor picture and "technical problems". In addition, Article 4 of the EU AI Act requires organisations that use AI systems to promote the AI literacy of their staff. Training on AI risks fits well with this requirement.

If attackers exploit known vulnerabilities faster, patching has to keep pace. Prioritise internet-facing systems such as firewalls, VPN gateways, mail servers and web applications, and set fixed deadlines for critical updates.

This requires a complete picture of your attack surface. A vulnerability scan and structured patch management provide that foundation.

Bans alone rarely stop shadow AI; they merely shift usage to private devices. A clear policy works better: Which AI tools are approved? Which data may be entered and which never (customer data, HR data, trade secrets, source code)? Who decides on new tools?

Also establish where AI is already in use, including in purchased software. This is the basis for any further assessment, including your obligations under the EU AI Act. Our AI Compliance & Governance service supports you here.

Operating chatbots, AI assistants with access to internal documents or AI agents creates a new attack surface. Prompt injection ranks first in the OWASP Top 10 for LLM Applications (2025 edition): an attacker hides instructions in an email, document or web page, and the model follows them.

The basic rules: AI applications get only the permissions and data they need for their task, consequential actions require human approval, and inputs and outputs are logged. For more depth, see our guide to autonomous AI agents and AI Security & Testing.

Whether an attack begins with an AI phishing email or an exploited vulnerability, it only causes major damage once it gains far-reaching permissions. Separate administrator accounts from everyday accounts, grant admin rights only for limited periods and log privileged sessions. Access by external service providers belongs in scope as well.

No protection is complete. Define who does what when something looks suspicious: with a fraudulent transfer every hour counts, because a bank can recall a payment only for a short time, if at all; with instant transfers this usually fails entirely. An incident plan for social engineering, central logging and monitoring for unusual sign-ins are part of the basic toolkit.

If your organisation qualifies as an important or particularly important entity under the German BSI Act (Germany's NIS2 implementation), reporting obligations apply as well: significant security incidents must be reported without undue delay, and no later than 24 hours after becoming aware of them, in an initial notification to the joint reporting office of the BSI and the BBK. A fuller notification follows no later than 72 hours after becoming aware of the incident, and a final report no later than one month after that notification. See our NIS2 consulting page for an overview.