Security Leaders Weigh In

Mika Aalto, Co-Founder and CEO at Hoxhunt:

Phishing no longer resides solely in your inbox. It has spread across the entire corporate communications environment. Attackers now move between email, Microsoft Teams, Slack, text messages, phone calls, and remote-access tools, with each interaction making the next one feel more credible. Technology is evolving for malicious purposes, but attackers continue to target people because manipulating trust remains extraordinarily effective and profitable.

On collaboration platforms, organizations should monitor new external identities, internal-sounding support names, repeated call attempts, and rapid movement from a chat request to a voice call. On endpoints, they should pay particular attention to unexpected launches of Quick Assist or other remote-management tools, PowerShell downloads, and unusual SMB or NTLM activity. Identity teams should treat password resets, MFA changes, device enrollment, and privileged-access requests made during unsolicited support interactions as high-risk events. Those signals need to be correlated rather than managed in separate queues. 

Organizations should also limit external collaboration and remote-support capabilities according to business need, require an approved support ticket, and verify sensitive requests through a known internal channel before granting access.

Aviv Nahum, Co-founder and CEO at Above Security:

With AI, an attacker no longer needs to simply spoof a phone number or write a convincing email. They can increasingly reproduce someone’s voice, writing style and conversational patterns, and maintain that deception across multiple channels.

That makes this fundamentally a trust problem. We’ve spent decades teaching people to recognize suspicious messages, but the traditional signals are disappearing. A message can sound like your boss, come with the right context, and even use a familiar voice. The security model therefore must shift from ‘does this look real?’ to ‘can I independently verify that this person is who they claim to be?’ Sensitive requests, new phone numbers and moves to another messaging platform should all trigger verification through a previously trusted channel.

AI isn’t eliminating the human element of cybersecurity. It’s making it much easier to exploit it. The next generation of social engineering will be less about obviously fake phishing and vishing, and more about convincingly impersonating people we already trust.

Jason Soroko, Senior Fellow at Sectigo:

Attackers are simultaneously exploiting the inherent trust in IT support workflows and the absence of cryptographic verification during human interactions. Help desks exist to assist employees facing access issues and typically rely on fragile knowledge-based authentication that skilled threat actors bypass effortlessly. Whether attackers call in posing as locked-out users or impersonate IT staff reaching a tired employee, they weaponize the very mechanisms intended to keep the business running. Defending against these campaigns requires moving beyond awareness training to robust identity verification. Perhaps mandatory video verification and certificate based authentication.

Shane Barney, Chief Information Security Officer at Keeper Security: 

Attackers are no longer looking for gaps in your perimeter. They are looking for the systems your organization already trusts and finding ways to move through them undetected. Collaboration platforms, identity providers, and third-party integrations all carry implicit trust that rarely gets the same scrutiny as administrative access or privileged accounts. That is the blind spot.

The practical response is applying zero-trust principles consistently, not selectively. Every session should be validated, every access path monitored and anomalous behavior flagged regardless of whether the traffic originates from a trusted tool. The organizations with the strongest position here are those that have already extended that discipline beyond traditional IT infrastructure to include the collaboration layer.

Kern Smith, Vice President of Global Solutions at Zimperium:

Phishing has evolved into real-time, interactive deception designed to defeat MFA — especially on mobile devices. The risk isn’t just credential theft; it’s attackers weaponizing trusted identity workflows through coordinated vishing campaigns. Security teams need layered defenses that combine strong identity platforms, with on-device mobile threat detection, to stop these attacks before credentials and sessions are ever exposed.

Louis Eichenbaum, Federal CTO at ColorTokens:

Security awareness training helps; however, it will never eliminate a tactic that is designed around urgency, authority, and trust. The more durable defense is a mandatory verification process: any unexpected approach, particularly from a new number or account, should be authenticated through a previously established channel before the conversation continues. Repeated incidents suggest the problem is not simply that individuals have failed to recognize a scam. Organizations have not yet made strong identity verification sufficiently routine and frictionless.