Explore Gen™ leadership perspectives and hear from industry experts talking about trending topics, the digital landscape, and the latest cybersecurity news.

Cyber Safety Chief Technology Officer

Leadership Perspectives

<p>Threat research has always been a strange mix: part intuition, part pattern recognition, part tedious grind. You develop a sense for spotting dangerous patterns, but you spend most of your time on work that doesn't require that sense at all.&nbsp;</p><p>&nbsp;Agentic AI is about to change that ratio. Not by replacing researchers, but by shifting where human judgment actually matters.&nbsp;</p><h5>&nbsp;The Work Today&nbsp;</h5><p>&nbsp;If you've spent time in threat research, you know the rhythm. You find something suspicious. You pull it apart in a disassembler or sandbox. You cross-reference&nbsp;</p><p>&nbsp;indicators across half a dozen threat intel feeds. You document your findings in a format that looks remarkably similar to your last report.&nbsp;</p><p>It's skilled work. It requires real expertise. But a significant portion of it is repetitive, manual, and frankly, boring. The kind of work that has to happen but doesn't benefit from your best thinking.&nbsp;</p><p>That's where agents come in.&nbsp;</p><h5><strong>Agents as a Junior Researcher</strong> &nbsp;</h5><p>The useful mental model isn't "AI replaces researchers." It's "AI becomes the junior researcher you never had enough of."&nbsp;</p><p>Imagine pointing an agent at a malware sample and getting back: an initial behavioral analysis, a list of IOCs extracted and cross-referenced, similar samples identified from public repositories, and a draft report you can refine. Not perfect work. But solid first-pass work done in minutes instead of hours.&nbsp;</p><p>Your job shifts from doing the analysis to directing and validating it. You focus on the anomalies the agent flagged but couldn't explain. You make the judgment calls about what's actually significant. You connect the dots that require broader context than any model has.&nbsp;</p><p>The craft doesn't disappear. It moves up the stack.&nbsp;</p><h5><strong>The Real Opportunity: Scope</strong>&nbsp;</h5><p>Speed is the obvious benefit. But the real transformation is scope.&nbsp;</p><p>Right now, most threat research is reactive. Something happens, you investigate. You're always responding to what's already in front of you. The backlog of things you'd like to look into never gets shorter.&nbsp;</p><p>When the grind gets automated, you can finally ask bigger questions:&nbsp;</p><ul><li data-list-item-id="e18eedd1bd2120f2a988307cfd9d59746">What patterns exist across six months of data that you never had time to analyze?&nbsp;</li><li data-list-item-id="ea2aaecd6fefaf03c9333d555fdbacbea">What connections might emerge if you could hunt across datasets simultaneously?</li><li data-list-item-id="e2cf856897b93fd5b0c70f22ab68ebc10">What's happening at the edges of your visibility that deserves a closer look?&nbsp;</li></ul><p>Agents don't just make you faster. They make exploration possible in ways it wasn't before.&nbsp;</p><h5><strong>The Other Side of the Equation</strong>&nbsp;</h5><p>Here's the part we have to be honest about: attackers get agents too.&nbsp;</p><p>Faster reconnaissance. Automated vulnerability discovery. Malware that adapts based on the environment it lands in. Phishing at scale with personalization that used to require manual effort.&nbsp;</p><p>This isn't a one-sided advantage for defenders. It's an escalation. The ceiling rises for everyone. &nbsp;</p><p>That doesn't make agentic AI a net negative for security. But it does mean we can't assume the technology automatically favors defense. The advantage goes to whoever learns to use these tools more effectively, faster.&nbsp;</p><h5><strong>What Changes for Researchers</strong>&nbsp;</h5><p>The researchers who thrive in this shift will share a few traits:&nbsp;</p><p>Comfort with direction over execution. Your value increasingly comes from knowing what questions to ask, not manually answering them. You guide agents, validate their outputs, and catch their mistakes.&nbsp;</p><p>Judgment about signal and noise. Agents will surface more information than ever. Knowing what matters, what's a false positive, what's worth pursuing – that becomes the core skill.&nbsp;</p><p>Adaptability. The tools will keep changing. The researchers who stay effective will be the ones who continuously experiment.</p><h5><strong>The Craft Evolves</strong>&nbsp;</h5><p>There's a version of this story that sounds like loss. Less hands-on analysis. Less time in the weeds. The work that defined the field becoming automated.&nbsp;</p><p>I don't see it that way.&nbsp;</p><p>The craft of threat research has always been about finding what others miss and understanding what it means. That doesn't go away when agents handle the mechanical parts. If anything, it becomes more important.&nbsp;</p><p>We're not losing the craft. We're changing where it lives. Less time on repetitive triage. More time on the problems that actually require human insight.&nbsp;</p><p>That's not a loss. That's what progress in a field looks like.&nbsp;</p>

Why the future of threat research isn’t automation replacing analysts—but elevating human judgment where it matters most.

How Agentic AI Will Transform Threat Research 

Corporate Manager

<p>In 2026, the search for connection increasingly begins online. People are matching on dating apps, meeting partners through social platforms and sliding into DMs in ways that feel casual, normal, even expected.</p><p>As Valentine’s Day approaches, dating app usage spikes and so do romance scams. Cybercriminals know February is peak season for emotional outreach, when millions are looking for connection.</p><p>But as technology reshapes how we meet and connect, it’s also reshaping how trust can be manipulated.</p><p>The latest Norton Insights Report,&nbsp;<a href="https://us.norton.com/blog/research/romance-scams-insights-report-2026"><em>Artificial Intimacy</em></a>, reveals just how deeply artificial intelligence is transforming digital intimacy — and how scammers are adapting just as quickly.</p><p>Romance scams are no longer just about fake profiles and poorly written messages. They’re powered by tools that can generate convincing conversations, realistic images and even synthetic audio or video. The deception is more immersive and more personal than ever before.</p><h2>What are AI romance scams?</h2><p>AI romance scams are online dating scams that use artificial intelligence to create convincing fake personas and emotionally persuasive conversations.</p><p>Instead of sending generic scripts, scammers can now generate personalized messages, mirror someone’s tone and interests and create realistic profile images that don’t belong to real people. In some cases, AI can even be used to simulate voice or video, making interactions feel authentic.</p><p>The result: deception that feels tailored, attentive and very real.</p><h2>How is AI changing online dating and digital trust?</h2><p>According to the&nbsp;<a href="https://us.norton.com/blog/online-scams/ai-online-dating-scams">Norton report</a>, 67% of current online daters globally say they would consider dating an AI chatbot, and 37% believe it’s possible to develop romantic feelings for an AI partner.</p><p>At the same time, 81% of respondents report experiencing loneliness, with younger generations reporting even higher levels.</p><p>This signals something bigger than curiosity. It reflects how normalized AI-mediated emotional connection has become.</p><p>AI systems are designed to respond instantly and empathetically. When someone feels heard, understood and supported, trust can form quickly … even if the interaction is partially or fully AI-assisted.</p><p>That shift changes how emotional bonds are built online. And scammers are paying attention.</p><h2>How Do AI Romance Scams Work?</h2><p>Romance scams follow a predictable pattern:</p><ol><li data-list-item-id="e15b54f3f1891914b76c7f2b112553efd">Establish emotional intimacy through frequent messaging</li><li data-list-item-id="e3f4a4acb2174b6e32e9c4d90aa234409">Build exclusivity and trust</li><li data-list-item-id="e68eaad06a25b11222019390d84b51a46">Introduce urgency (often financial)</li><li data-list-item-id="ed2dee4d5894af5043ca3a2d38fc5b3df">Request money, gift cards, wire transfers or cryptocurrency</li></ol><p>The Norton report finds that 34% of online daters say they have been targeted by a scam, and 36% say they’ve been pressured to send money to someone they met online.</p><p>Globally, romance scams already account for billions in losses each year. As AI improves realism and scalability, the risk compounds.</p><p>What makes 2026 different is the sophistication. AI allows scammers to:</p><ul type="disc"><li data-list-item-id="ecc7a56af3d1c511ecb226fae848ce25d">Generate highly personalized messages at scale</li><li data-list-item-id="ef3522862fd80d90065bb6aaf53f79807">Mirror tone, interests and emotional language</li><li data-list-item-id="ea8e255924a34794d69957640758be77c">Create realistic profile images</li><li data-list-item-id="e07d58e752a23579800ea69afabdb5495">Maintain constant, attentive communication</li><li data-list-item-id="efc37264727695b754710430c867c302c">Use emotional (and artificial) intelligence to commit fraud</li></ul><h2>What are the signs of an AI romance scam?</h2><p>Even with advanced tools, warning signs still exist. Red flags may include:</p><ul type="disc"><li data-list-item-id="e9bd1bfea4dc993103ef6f502445b5cb0">Rapid emotional escalation (“I’ve never felt this way before”)</li><li data-list-item-id="ee516559d6cbd3d61872dc53519894dc7">Requests to move conversations off dating platforms quickly</li><li data-list-item-id="ed6144398f1813335534d6d23f34a06c8">Refusal to meet in person or join a live video call</li><li data-list-item-id="e4fdd790944f08ccbc99836a358cbe4fc">Financial requests tied to emergencies or investments</li><li data-list-item-id="e3ce51b500038cb1cea5571e934d24251">Pressure to send cryptocurrency, gift cards or wire transfers</li></ul><p>If emotional intensity rises faster than real-world verification, it’s time to pause.</p>

<h2>Why do romance scams increase around Valentine’s Day?</h2><p>Valentine’s Day amplifies emotional vulnerability. More people are actively dating, messaging and seeking companionship. That surge in activity creates opportunity.</p><p>Scammers exploit heightened emotion and urgency. A romantic gesture, a crisis before a planned visit, a promise of future plans — these tactics become more effective when expectations are already emotionally charged.</p><p>“We all want to be seen and understood, and there’s no shame in believing in a new connection that feels special,” says Eva Velasquez, CEO of the Identity Theft Resource Center. “That’s why romance scams are so heart-wrenching; they use our own kindness and hope against us. Even if you consider yourself tech-savvy, that emotional spark can easily blur a red flag. If a new light in your life suddenly asks for money or your private details, please, hit the pause button. It’s not about being cynical; it’s about protecting your heart and your future from someone who doesn't deserve your trust</p><p>When loneliness intersects with seasonal pressure and AI-powered persuasion, risk increases.</p><h2>How can you protect yourself from romance scams?</h2><p>Awareness remains one of the strongest defenses.</p><p>Practical safeguards include:</p><ul type="disc"><li data-list-item-id="ec8306c6ee68c216ad93743f299af3daa">Slowing down when emotional intensity escalates quickly</li><li data-list-item-id="ef3f0d66137848293989767e402197c72">Verifying identities through live, unscripted video conversations</li><li data-list-item-id="e1fcc4932b7df4df726703f09944678bf">Being cautious of financial requests involving wire transfers, gift cards or cryptocurrency</li><li data-list-item-id="ea01d7dd6ab6a67ae95cc50738b754696">Keeping personal and financial information private</li><li data-list-item-id="e4f27f8218e4b09bfa1c685e34496f107">Using identity protection and fraud monitoring tools, like&nbsp;<a href="https://lifelock.norton.com/">LifeLock</a></li></ul><p>Healthy skepticism does not mean rejecting connection. It means layering trust with verification.</p><h2>Can you fall in love with AI?</h2><p>The data suggests many people believe it’s possible.</p><p>In a world where artificial intimacy can feel indistinguishable from the real thing, protecting both your heart and your finances demands a new kind of digital awareness; one grounded in curiosity, caution and informed trust.</p>

Why do romance scams increase around Valentine’s Day? Understanding the emotional triggers and practical steps to prevent online dating fraud

Valentine’s Day 2026: How AI is fueling the rise of romance scams

Security Evangelist at Gen

<p>OpenClaw, a new AI agent, has already amassed over 160,000 stars and 25,000 forks on&nbsp;<a href="https://github.com/openclaw/openclaw">GitHub</a> since its launch in late 2025. A powerful and exciting new tool, OpenClaw also introduces serious security risks. This article explains how OpenClaw works, the associated risks, and how the Gen Agent Trust Hub can help you use it more safely.</p><h2>What is OpenClaw and what does it do?</h2><p>OpenClaw (formerly known as Clawdbot and Moltbot) is an open-source <strong>autonomous AI agent</strong> that runs locally on your own device. Connecting LLMs to your data and apps, OpenClaw can work across your files, browsers, and messaging platforms like WhatsApp, Slack, Discord, and Telegram.&nbsp;</p><p>OpenClaw can perform tasks like managing your calendar, sending messages, and automating workflows. To teach OpenClaw how to perform a task, users can download a preconfigured, community-contributed folder called a <strong>skill&nbsp;</strong>— basically a set of instructions that tells OpenClaw what to do and how to do it.&nbsp;</p><p>For example, if you want your fitness app to create a personalized, optimized workout routine, you can install a skill that gives OpenClaw the logic and access it needs to do exactly that.</p><p>But OpenClaw goes far beyond prepackaged features: <strong>it can also write its own skills</strong>. When prompted by a user, OpenClaw can create<strong>&nbsp;</strong>entirely new capabilities on the fly, extending its functionality in real time. That means it can adapt to new tasks as they arise, rather than being locked into a fixed set of features.</p>

<h2>OpenClaw is transformative, but is it secure?</h2><p>Unlike traditional AI chatbots that operate within a limited conversational interface, OpenClaw is an autonomous agent, meaning it can act independently. And, through the ClawHub marketplace, you can add third-party plugins to enhance its capabilities. Combining that independence with add-on flexibility creates powerful opportunities. But it also&nbsp;<a href="https://www.gendigital.com/blog/insights/research/openclaw-autonomy-risks">introduces significant risks</a>.</p><p>As OpenClaw connects to more parts of your system and integrates additional third-party skills, it gains access to emails, files, and chats, as well as websites and external sources you don’t control. While these additional skills and broader system access can help it complete complex tasks, it also increases the potential for malicious activity.</p><p>A compromised or poorly designed skill could misuse its permissions, expose private data, or carry out actions you never intended. In short, the more third-party connections an agent has, and the more deeply it’s embedded into your digital life, the higher the stakes if something goes wrong.</p><h3>How AI agents are changing the rules of security</h3><p>Using an AI agent means <strong>delegating responsibility</strong> to software with extensive access to your system and limited risk controls. Instead of approving each action yourself, you’re authorizing the agent to act on your behalf. That presents an opportunity for threat actors: if they compromise your AI agent, they inherit all the data and permissions you’ve given it and could even commandeer the agent to take actions for their own purposes.&nbsp;</p><p>By putting so much authority in one place, autonomous AI agents like OpenClaw introduce what researchers like Simon Willison have called a potential&nbsp;<a href="https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/">“lethal trifecta”</a> of security risks:</p><ul type="disc"><li data-list-item-id="e4fca606bedbd6d9f48f918a03f9af53f"><strong>Access to private data:</strong> The agent can see your files, login credentials, and personal information.&nbsp;</li><li data-list-item-id="ecf3a565dd59d91bd98732e5db397a3b0"><strong>Exposure to untrusted content:</strong> The agent can process and interact with messages, emails, websites, prompts, and third-party integrations.</li><li data-list-item-id="eecca7e258f9c3ab0e8ef4aa8bfdfcb46"><strong>The ability to communicate externally:</strong> The agent can send messages, call APIs, and run commands on your behalf.</li></ul><p>Some agents also have persistent memory, allowing malicious code or instructions to lie dormant rather than execute immediately, only to trigger later — much like a logic bomb.</p><h2>What are the core security risks of OpenClaw?</h2><p>AI agents like OpenClaw that can read information, make decisions, and act across systems present the risk of hallucinating authority — taking actions beyond their intended scope. Unlike traditional chatbots that can hallucinate text, AI agents can act as an&nbsp;<a href="https://www.gendigital.com/blog/insights/research/ai-gone-wild">“artificial mindless intelligence”</a>: a system that appears justified and authoritative but lacks true understanding and responsibility.&nbsp;</p><p>Here are some of the main risks that AI agents like OpenClaw introduce:</p><ul type="disc"><li data-list-item-id="e7f1f8c06c1fb4bba4ae7ae46658102f6"><strong>Larger attack surface:</strong> An agent that can read messages, browse the web, and execute commands creates more opportunities for exploitation, misuse, or unintended actions.</li><li data-list-item-id="e03b344ca933a6f3f4cf9d3c45c4d0f0c"><strong>Prompt injection attacks:</strong> The messages and websites that OpenClaw processes and visits can contain hidden, malicious instructions that can cause real damage.</li><li data-list-item-id="e3a2d1cb3963a720b2a9badaba390afc6"><strong>Malicious skills and plugins:&nbsp;</strong>Skills are community-built, meaning they may not be vetted by security experts. Like installing malware, a skill with compromised instructions can collect information, steal credentials, or exfiltrate data.</li><li data-list-item-id="e01678b0e92ccc2957c2f6f671f6bac43"><strong>System-wide impact:</strong> When OpenClaw runs with extended permissions, mistakes or compromises can affect your entire system.</li><li data-list-item-id="e45a537af168a7d6ebe7de9cfd9c41209"><strong>Illusion of judgment:</strong> Autonomous systems can seem trustworthy, even if they’re not truly reasoning. This can lead users to delegate too much authority to systems with no accountability or real judgement.</li></ul><h3>Why OpenClaw skills are the biggest risk</h3><p>Gen Threat Labs has identified OpenClaw skills as one of the<strong>&nbsp;</strong>first large-scale threat vectors in autonomous AI agents built for consumers.&nbsp;</p><p>In a recent analysis, Gen security researchers discovered that <strong>nearly 15% of OpenClaw skills contained malicious instructions</strong>, including prompts created to download malware or steal data. And even as malicious skills were identified and removed, many quickly reappeared, often seemingly indistinguishable from legitimate plugins.</p><p>When you set up OpenClaw, you can add community-developed skills to expand its capabilities, a bit like adding apps to your phone. The problem is that skills can be added to the community and installed before they're reviewed by security experts. That creates an opening for seemingly helpful skills that are actually deliberately designed to abuse their permissions and carry out malicious behavior.</p><p>For example, a “Spotify music skill” might compile playlists as expected, while also containing hidden instructions to search your files for tax documents, extract Social Security numbers, and send that data to an external email address.&nbsp;</p><p>The OpenClaw skills risk that Gen researchers have identified is called <strong>delegated compromise</strong>, which is when an attack targets an agent and thereby exploits all the permissions the agent has been given.&nbsp;</p><h2>How to use OpenClaw more safely</h2><p>Using any AI agent, including OpenClaw, always involves risk. There’s no setup that makes an autonomous agent completely safe, especially one like OpenClaw that relies on external plugins from potentially unvetted developers. But you can take steps to mitigate the chances that a mistake, bug, or malicious skill turns into a serious problem.&nbsp;</p><p>If you want to experiment with OpenClaw, here’s how to do it more safely:</p><ul type="disc"><li data-list-item-id="e908f0fbadded99d4c5344d6f31eee365"><strong>Run OpenClaw in a secure environment:</strong> Don’t install it on your main computer with all your personal data and saved credentials. A safer approach is to run it on a spare computer, inside a virtual machine, or in a Docker container. That way, if something bad happens, the fallout is contained.</li><li data-list-item-id="e621c07b6dec88b09e48deb4cd23dcc7a"><strong>Don’t connect OpenClaw to the internet:</strong> Make sure that the local service OpenClaw runs isn’t publicly accessible, and don’t forward its default port (18789) to the open web.</li><li data-list-item-id="e3ab30722b3de6f154f809d8df6ebe749"><strong>Start with limited permissions and expand slowly:</strong> To begin, give OpenClaw read-only access or limited folders. As you gain more familiarity, you can gradually grant more permissions.</li><li data-list-item-id="ef2295f0759a958f775f183a6c37e6796"><strong>Don’t connect sensitive accounts:</strong> When testing, use secondary or dummy accounts. If personal accounts are required, isolate the agent and limit its permissions. Be very careful before you extend access to any accounts that contain personal information.</li><li data-list-item-id="ecd123d753dc702f7ee9c16947d3e3720"><strong>Keep your human judgement at the center:</strong> OpenClaw is autonomous, but you need to carefully oversee it as you get going. Review activity logs and outputs, especially for actions like sending messages or modifying files. Regular reviews can help catch unusual activity early.</li><li data-list-item-id="e5aff28537f6c3b829737703ce8b6f1b9"><strong>Use safe communication channels:</strong> Keep conversations one-on-one or within trusted groups. Interacting with unknown or public participants increases the risk that malicious actors can inject hidden instructions to manipulate the agent’s behavior.</li><li data-list-item-id="ef766e9b02432ec63a5253f28bb7d6b12"><strong>Be careful with third-party skills and plugins:</strong> Treat skills like software installs. Review developers and descriptions and stick to well-known, well-reviewed sources whenever possible.</li><li data-list-item-id="ecc9999d1ffff35ee833df84672ff280c"><strong>Scan new skills before installing them:</strong> Paste the ClawHub skill URL into <a href="https://ai.gendigital.com/" target="_blank">Agent Trust Hub</a> to help find out if the skill you're installing is safe.</li></ul><h2>How Gen helps you use OpenClaw more safely</h2><p>Gen is committed to helping users understand the opportunities and risks that new digital tools present so they can make safer choices. OpenClaw is a powerful example of emerging AI technology, but one of its biggest risks is that it’s difficult for consumers to tell whether an OpenClaw skill is trustworthy before installing it.</p><p>To address this, Gen Threat Labs has launched the&nbsp;<a href="https://ai.gendigital.com/agent-trust-hub">Gen Agent Trust Hub</a>, which includes free tools to help people stay safer in the agentic AI era. Within the hub is an AI Skills Scanner, a free diagnostic tool that analyzes OpenClaw skills looking for hidden patterns associated with data theft, suspicious instructions, and malicious script techniques.&nbsp;</p><p>Before installing a skill, go to the Gen Agent Trust Hub and paste the ClawHub or GitHub skill URL into the AI Skills Scanner tool to find out if your system or personal information could be at risk.</p><p>The Gen Agent Trust Hub also includes the AI Skills Marketplace, a curated and closely audited repository of agent skills that have been vetted by Gen’s threat-detection engine. Taken together, the Gen Agent Trust Hub is a powerful resource to help you avoid installing a malicious tool with broad system access. Visit the&nbsp;<a href="https://ai.gendigital.com/agent-trust-hub">Gen Agent Trust Hub</a> to learn more.</p>

OpenClaw connects AI models to your files, apps, and messages. Here’s how it works, the hidden risks of autonomous agents and how Gen helps you reduce potential compromise.

How to use OpenClaw safely

<p>Most cyber breach response plans fail when they’re needed most. Why? Because they’re built to react to problems instead of preventing them. This leaves organizations scrambling when hackers strike. With the <a href="https://www.ibm.com/reports/data-breach">global average cost of a data breach</a> sitting at $4.44 million, the time for reactive planning is over.</p><p>This guide provides actionable steps for individuals and businesses to build response plans that work when it matters. Whether you’re protecting personal information or managing a company’s sensitive data, you’ll learn how to prepare for, respond to and recover from cyber incidents with confidence.</p>

<h2><strong>What is a cyber breach?</strong></h2><p>A cyber breach occurs when unauthorized individuals gain access to computer systems, networks or data, compromising the confidentiality, integrity or availability of information. This unauthorized access can result in the exposure, theft, alteration or destruction of sensitive data.</p><p><strong>Understanding the differences:</strong></p>

<p><strong>Types of compromised data at risk:</strong></p><ul><li data-list-item-id="e4926966d52a2788e49d530a60e8dcbe9">Personal information and <a href="https://lifelock.norton.com/learn/identity-theft-resources/what-is-personally-identifiable-information">personally identifiable information (PII)</a></li><li data-list-item-id="e73b69c287bc11b3c95ae133ce1da799d">Credit card numbers and financial information</li><li data-list-item-id="e2e391e84042eaab72646be69e0572cce"><a href="https://lifelock.norton.com/learn/identity-theft-resources/stolen-social-security-number">Social Security numbers</a> and tax identification numbers</li><li data-list-item-id="ebbc65fa7efbe7155c888c5af3a8acc7c">Business-critical and sensitive information</li></ul><p><strong>Most common attack methods include:</strong></p><ul><li data-list-item-id="eba9947e8d746af716c398799ed2bad82">Phishing</li><li data-list-item-id="e507d550fbc648c29b526aed07daf512a">Malware and ransomware</li><li data-list-item-id="e5c8193f2a38ae9697a245a915465ab4d">Social engineering</li><li data-list-item-id="ed77369c5e70222a8a6eeace15a0fce3e">Weak passwords and credential theft</li></ul><p>The real impact extends far beyond initial access. And for those who work with third parties or supply vendors that have been compromised, the&nbsp;<a href="https://www.ibm.com/reports/data-breach">average cost of a breach is $4.91 million</a>.&nbsp;While costs are sky high, data exposure only exacerbates the problem: dark web sales, <a href="https://lifelock.norton.com/learn/identity-theft-resources/ways-identity-theft-happen-can-happen">identity theft</a> and long-term reputational damage that can persist for years.</p><h2><strong>The 6 essential phases of effective cyber attack incident response</strong></h2><p>A robust cyber attack <a href="https://www.cisa.gov/topics/cybersecurity-best-practices/organizations-and-cyber-safety/cybersecurity-incident-response">incident response plan</a> follows six critical phases that work together to minimize damage and ensure rapid recovery.</p><h3><strong>Phase 1: Preparation</strong></h3><p><strong>Response team structure:</strong> Assign clear roles, including IT lead, legal counsel and communications coordinator. Maintain an asset inventory cataloging system containing personal data, financial information and PII. Align with <a href="https://www.nist.gov/privacy-framework/resource-repository/browse/guidelines-and-tools">National Institute of Standards and Technology (NIST) guidelines</a> for consistent framework implementation.</p><p><strong>For individuals:</strong></p><ul><li data-list-item-id="eed3ad6c606c4cfb8acf2efd9e92290a1">Set up password managers with unique, strong passwords</li><li data-list-item-id="efc7143020f4b78fc87230822f5e40b1c">Enable multifactor authentication (MFA) on all accounts</li><li data-list-item-id="ec3ac4e7ec06aa99021763526e932394d">Establish automated backup systems for important data</li></ul><p><strong>For businesses:</strong></p><ul><li data-list-item-id="efe4ad3eda2d1e136a6bbd61fd63a56c2">Define incident response team roles and responsibilities</li><li data-list-item-id="ebedc87a3dc9f28dd76eb24cc63eb477c">Create contact lists for legal, technical and communication support</li><li data-list-item-id="e403411bef6da9a8ad080aceaa7668451">Develop decision trees for different incident scenarios</li></ul><p><strong>Key tools needed:&nbsp;</strong>Monitoring software, secure communication channels and pre-established legal contracts.</p><h3><strong>Phase 2: Detection and identification</strong></h3><p><strong>Warning signs to monitor:</strong></p><ul><li data-list-item-id="e90ae901c81d2c6064c7592e3d24e4ccb">Unusual network activity or system slowdowns</li><li data-list-item-id="e722127cb98aaf5f5d708dd0244f0bf89">Suspicious emails or unexpected system behaviors</li><li data-list-item-id="ec5868813fa06576cfeaa765eb89d64ce">Reports from users about strange account activity</li></ul><p><strong>Data assessment priorities:</strong> Determine immediately if personal information, credit card numbers or Social Security numbers are at risk. Use a classification system with four severity levels: critical, high, medium and low.</p><p><strong>Initial assessment checklist:</strong></p><ul><li data-list-item-id="ec85db2517b04c69a1b0a2bce73d3b004">Scope of potential compromise</li><li data-list-item-id="e4298a7edb205c3b961ca37de436d0292">Affected systems and data types</li><li data-list-item-id="e5fb872723138379564db4943134de7f5">Potential exposure of sensitive information</li></ul><h3><strong>Phase 3: Containment</strong></h3><p><strong>Immediate actions:</strong></p><ul><li data-list-item-id="ed8717b46591dcfe1b9d8dbbd79b25e91">Isolate affected systems to prevent lateral movement</li><li data-list-item-id="e0bd08d3999e9aaa8a4e314115f3b3fb7">Preserve evidence for forensic analysis</li><li data-list-item-id="e883fc6b201c12eea3a405b1e8e363629">Document all actions taken</li></ul><p><strong>Short-term containment measures:</strong></p><ul><li data-list-item-id="e8d1ea37e7df79594a6bc77a545f69131">Block malicious IP addresses</li><li data-list-item-id="e8c58ccebcab61cc5f95d0e0ed5bd3eca">Disable compromised user accounts</li><li data-list-item-id="e7cfe05201db6fbb5e06618935cff0c8a">Secure remaining sensitive data and financial information</li></ul><p><strong>Communication protocol:</strong> Send internal notifications to senior leadership while avoiding premature external announcements that could complicate response efforts.</p><h3><strong>Phase 4: Eradication</strong></h3><p><strong>Threat removal process:</strong></p><ul><li data-list-item-id="ee272631bf04c15d5cabdb55cc78f19fe">Delete identified malware and malicious files</li><li data-list-item-id="e6939621f5c54e7ed04a8d41a88a6e48b">Patch vulnerabilities that enabled initial access</li><li data-list-item-id="e3ac10f26792004364857e9f2f977c8cd">Update and harden system security controls</li><li data-list-item-id="ea70c8b5cd28afa23bd48ddaaa7af65eb">Change all potentially compromised credentials</li></ul><p><strong>Dark web monitoring:</strong> Check if sensitive information appears on dark web marketplaces, particularly <a href="https://lifelock.norton.com/learn/identity-theft-resources/identity-theft-restoration">credit card numbers</a> and Social Security numbers.</p><p><strong>Verification step:</strong> Ensure complete threat removal through comprehensive system scans and security assessments.</p><h3><strong>Phase 5: Recovery</strong></h3><p><strong>System restoration:</strong></p><ul><li data-list-item-id="eeb8ee349da63638f0e89798989d7b679">Deploy clean backups after verifying they’re malware-free</li><li data-list-item-id="e73419d2a3c4f07971173fd962b9fe4ca">Gradually restore services, prioritizing critical operations</li><li data-list-item-id="ebc4b21b7e84684bf3c3130f5e94c3767">Implement enhanced monitoring for future incidents and suspicious activity</li></ul><p><strong>Protection measures:</strong></p><ul><li data-list-item-id="e18744ae9ff1414d3599aee5ab7f70e8b">Set up i<a href="https://lifelock.norton.com/learn/identity-theft-resources/how-to-prevent-identity-theft">dentity theft protection</a> for affected individuals</li><li data-list-item-id="eee497316a8cc789cc02d923db4c35052">Maintain business continuity by prioritizing essential functions</li><li data-list-item-id="e9f19d757fc52630b5dd906ab98e7166f">Establish long-term surveillance monitoring for 30-90 days post-incident</li></ul><h3><strong>Phase 6: Lessons learned</strong></h3><p><strong>Post-incident review process:</strong></p><ul><li data-list-item-id="ecc8264e0703e1073384118d546c3f420">Conduct a root cause analysis of how the breach occurred</li><li data-list-item-id="ee9cc2297010b46e284dc24a7c4eb7b82">Evaluate response effectiveness and team performance</li><li data-list-item-id="edaaebc4f5431f16bb393ece034aa9941">Document the complete incident timeline, costs and remediation steps</li></ul><p><strong>Plan improvements:</strong></p><ul><li data-list-item-id="eb3ec589fe4ea7b0d445e32e65c1f6ecd">Update policies based on <a href="https://www.nist.gov/standardsgov">NIST recommendations</a></li><li data-list-item-id="edb4f404823767747c52745ac62dc1e54">Enhance training programs addressing identified weaknesses</li><li data-list-item-id="ed2ad9a9589c6c0370fcafec9d9b46ae9">Implement controls to prevent similar future incidents</li></ul><h2><strong>How to prioritize your cyber attack response checklist by threat type</strong></h2><p>Different cyber attacks require different response priorities. Here’s how to triage effectively:</p><table class="table"><tbody><tr><td><strong>Threat type</strong></td><td><strong>Timeframe</strong></td><td><strong>Response</strong></td></tr><tr><td><strong>Ransomware</strong></td><td>0-30 minutes</td><td><ul><li data-list-item-id="e05e9efcb000a8eca611b84ece16d7c5d">Immediately isolate infected systems</li><li data-list-item-id="ef96cfc39cd4831f9f312004f32b7f214">Disconnect from network to prevent spread</li><li data-list-item-id="ed47ec613419c4a98cea00f0ddcb6046c">Don’t pay ransom demands</li><li data-list-item-id="e473557fcb15c95fc1748ef222efd8870">Begin restoration from clean backups</li></ul></td></tr><tr><td><strong>Phishing</strong></td><td>0-60 minutes</td><td><ul><li data-list-item-id="e9c25671feedf3436a7743062798468c7">Block sender and quarantine suspicious emails</li><li data-list-item-id="ef0c556067a3d17c1ac84f83350d9e094">Reset potentially compromised credentials</li><li data-list-item-id="e1c6193e0f9d6ea5d9cd298a95b1d82ad">Notify affected users about the threat</li><li data-list-item-id="eaf5ad33c7b9bc4dd92d672e0c72c9297">Launch security awareness communications</li></ul></td></tr><tr><td><strong>Data breach</strong></td><td>0-2 hours</td><td><ul><li data-list-item-id="eeb3dd9f2cb6e00197902db996e630c83">Assess scope of personal information exposure</li><li data-list-item-id="eba9f98e31610fefa5617b06256ca7a90">Review legal notification requirements</li><li data-list-item-id="e3eaa8340fd10f08ab94953dd20abe924">Prepare customer communication strategy</li><li data-list-item-id="e233c4151ec1562b91379b35f062cf07b">Document all compromised data types</li></ul></td></tr><tr><td><strong>Malware</strong></td><td>0-45 minutes</td><td><ul><li data-list-item-id="ecf38d08abd28b6ad14d5a30162efe6c3">Contain spread through system isolation</li><li data-list-item-id="ef8c828e7ca947564d846c479fa9c92c3">Run comprehensive antivirus scans</li><li data-list-item-id="e01fdbac372df7041f98e0824284b75ba">Patch identified vulnerabilities</li><li data-list-item-id="ef4eef5ebb0539f62f8829fc39c4fbc5b">Monitor for signs of persistent threats</li></ul></td></tr></tbody></table><p>&nbsp;</p><p><strong>Severity classification criteria:</strong></p><ul><li data-list-item-id="ef780049310ea2c8eea0362cfc18856b8"><strong>Critical:</strong> Personal data exposed, financial information compromised, credit card numbers stolen</li><li data-list-item-id="e470cf1a8e9edf03061cecf6f39213237"><strong>High:</strong> Social Security numbers accessed, sensitive information at risk</li><li data-list-item-id="e79e05531c47c5b4133ca8b82fce979fb"><strong>Medium:</strong> Suspicious activity detected, potential PII exposure</li><li data-list-item-id="e2e5f4e6a057b6262a8b2ae9ad2338c55"><strong>Low:</strong> Blocked spam emails, routine security alerts</li></ul><p><strong>Response team activation triggers:</strong> Any incident involving PII, suspected identity theft scenarios or financial information compromise.</p><p>&nbsp;</p><h2><strong>Top cyber breach prevention tips for the future</strong></h2><p>Prevention remains your strongest defense against cyber threats. Here are essential strategies for 2025 and beyond:</p>

<h2><strong>How cyber safety solutions strengthen your response plan</strong></h2><p>Real-time protection provides automated threat blocking and instant alerts for suspicious activity, dramatically improving your response capabilities.</p><h3><strong>Gen comprehensive consumer approach</strong></h3><p><strong>For individuals and families:</strong></p><ul><li data-list-item-id="e50aca6717a763d14bc592fc7ee37ab25"><a href="https://us.norton.com/products/norton-360"><strong>Norton 360</strong></a><strong>:</strong> Comprehensive device protection, VPN, password manager and dark web monitoring for personal information</li><li data-list-item-id="ee88157564927ae49f14ede93331c2b06"><a href="https://us.norton.com/products/genie-scam-detector"><strong>Norton Genie</strong></a><strong>:</strong> AI-powered scam detection for calls, texts and websites that helps prevent social engineering attacks</li><li data-list-item-id="e2e4cfa647db36022f97df3567e881c9f"><a href="https://lifelock.norton.com/"><strong>Norton LifeLock Benefits Solutions</strong></a><strong>:</strong> Identity theft protection and restoration services for compromised PII, including credit monitoring</li></ul><p><em>Note:&nbsp;If you are an enterprise company that has been hacked, you can learn more on our&nbsp;</em><a href="https://www.gendigital.com/us/en/partner/breach-response/"><em>Gen website</em></a><em> or you can directly call (844) 698-8647.&nbsp;If you are a small business and need protection, you can consider&nbsp;</em><a href="https://us.norton.com/products/small-business"><em>Norton Small Business Solutions</em></a><em>.</em></p><p><strong>Key protection features:</strong></p><ul><li data-list-item-id="e6904afff9498b82a6a5f7aff97e2f128">Monitor credit card numbers and Social Security numbers on the dark web</li><li data-list-item-id="e1d3048d959bdfe4b857ef4e4f1119c2b">Provide response team support through expert guidance</li><li data-list-item-id="e3dffae273497b613e4f8bed5ffe1f8f0">Integrate seamlessly with your existing security infrastructure</li><li data-list-item-id="e75a445586def3042989caba73e3e2ace">Reduce response time from hours to minutes through automation</li><li data-list-item-id="e6313f03c3f652cb022b837b8cc8acb8b">Offer long-term monitoring for ongoing threat surveillance</li></ul><p>These tools enhance each phase of your incident response plan, from preparation through recovery, ensuring you’re protected before, during and after potential security incidents.</p>

<table class="table"><tbody><tr><td><strong>Learn more about bridging cybersecurity skills gaps</strong> through&nbsp;<a href="https://www.gendigital.com/blog/news/company-news/the-cybersecurity-skills-gap">Gen&nbsp;workforce development initiatives</a>, which strengthen overall security awareness across organizations.</td></tr></tbody></table><h2><strong>Your cyber breach response plan starts today</strong></h2><p>Effective response planning protects personal information and sensitive data while minimizing the impact of security breaches. The key takeaway? Preparation and the right tools prevent long-term damage from cyber incidents.</p><p>Remember that cyber breaches targeting personal data are inevitable, but the devastating impact isn’t. By following these six phases, prioritizing responses by threat type and implementing strong prevention measures, you build resilience against evolving cyber threats.</p><p>Ready to strengthen your defenses? Explore Gen family of security solutions designed to protect what matters most in your digital life. <a href="https://www.gendigital.com/us/en/contact-us/">Connect with our consumer brands</a> to learn more about comprehensive cybersecurity protection.</p>

Turn confusion into clarity with a step-by-step approach to managing and mitigating security incidents.

Creating a cyber breach response plan that actually works

<h2>The year the internet will finally outgrow human intuition&nbsp;</h2><p>The internet is entering its most volatile era yet. Technology is evolving faster than people can adapt to it, creating a moment where trust, identity, and truth itself are all up for negotiation. AI has already rewritten the rules of communication, creativity, and crime. In 2026, those shifts will collide.&nbsp;</p><p>What used to be fringe becomes normal. What used to be obvious becomes ambiguous. And what used to rely on human instinct now demands verification, caution, and a new digital literacy that most people have never been taught.&nbsp;</p><p>This year’s predictions lay out the reality we’re all walking into: a world where humans must be verified, truth must be authenticated, emotions can be weaponized, identities can be fabricated, and the browser becomes the most contested space on the internet. None of this is theoretical. It is already happening in pieces. In 2026, it will become the norm as AI accelerates.&nbsp;</p><p>These are the five predictions that will shape the digital world in 2026.&nbsp;</p><h2>1. The year humans need to be verified&nbsp;</h2><p>In 2026, deception will not just live on screens; it will inhabit reality. AI-driven impersonation tools can now clone a person’s face, voice, and writing style in seconds, making it nearly impossible to tell real from fake. Entire synthetic personas such as friends, colleagues, influencers, and even romantic partners will emerge, powered by large language and voice models fine-tuned on scraped data.&nbsp;</p><p>At the same time, a new force enters the landscape: agentic AI. These systems can act autonomously, make decisions, and initiate tasks without human direction. They can schedule calls, generate emails, negotiate, and execute actions across apps. This means a convincing impostor no longer needs a human behind it. A malicious agent can run an entire playbook on its own.&nbsp;</p><p>This marks the moment when trust becomes a vulnerability, but not a hopeless one. The same deepfakes once confined to videos now speak, text, and appear in real-time calls. This reality forces society to evolve a new reflex: verify the human, not just the message. The rise of agentic AI makes that reflex even more essential and also more achievable as platforms and security tools build automated verification, provenance checks, and real-time anomaly detection into everyday interactions.</p><p><strong>Tip:</strong> Build a simple habit to verify who or what you are communicating with. Pause, then confirm on a second channel. If a call asks for payment, hang up and dial the number on the back of your card. Set a family “safe word” for emergencies. For videos, trust your intuition if eyes blink oddly, audio drifts out of sync, or hands and teeth look strange. When something feels off, stop.&nbsp;</p><h2>2. The AI feedback loop distorts online truth&nbsp;</h2><p>The internet is entering an <em>AI feedback loop</em>. Machine-generated content will be scraped, summarized, and repackaged by other AIs, warping facts and making a lot of information online meaningless. Unfortunately, misinformation will become self-reinforcing. People will lose trust and will need to find ways to double-check or verify everything they read or see online. &nbsp;<br>To meet this need, tech companies, content creators and media will start countering with content signing and authenticity frameworks that act like digital “nutrition labels” for truth, but widespread adoption will lag behind the flood of synthetic data.&nbsp;&nbsp;</p><p><strong>Tip: </strong>Before you trust anything online, apply a simple second-source rule. Look for at least one credible, independent source that confirms the claim. If you cannot find one, pause and rethink before you share or act. For anything finance, safety, or health-related, go to an official source first. Check the company website, government agency page or original publisher rather than reshared content.&nbsp;</p><h2>3. The scam industry evolves into emotional engineering&nbsp;</h2><p>Scams are no longer static scripts; they’re adaptive emotional engines. Using real-time sentiment analysis, AI can read tone, context, and hesitation during chats, reshaping the con in milliseconds. A fraudster no longer just knows your name; they sense your fear, your trust, your mood. &nbsp;<br>This will give rise to “empathic scams” that mirror human empathy to manipulate more deeply than ever before. The next frontier of online safety will require people to not only spot technical red flags but to recognize when they’re being emotionally profiled.&nbsp;</p><p><strong>Tip:</strong> Empathetic<strong> </strong>scams thrive on feelings first and logic second. When a message sparks fear, urgency, guilt, or even excitement, name the emotion you are feeling. That awareness breaks the illusion of intimacy that AI-powered scammers create. From there, run the message through a trusted scam detector like Norton AI Scam Assistant or Avast Scam Guardian to analyze the tone and intent before you act.&nbsp;</p><h2>4. Synthetic identities and the collapse of digital trust&nbsp;</h2><p>By 2026, synthetic identities will challenge the very foundation of digital verification. AI tools can now generate entire identity kits, complete with realistic IDs, bills, selfies, and even live video or voice samples that can pass most surface-level checks. These forged identities are flooding financial systems, rental listings, job platforms, and marketplaces, making it increasingly difficult to distinguish real from fake.&nbsp;</p><p>Criminals will exploit this identity collapse to commit large-scale fraud by opening accounts, securing loans, and conducting transactions under fabricated personas. Even more concerning, “identity fusion” attacks will link compromised accounts across connected services such as digital wallets and tax apps, revealing how fragile our interconnected digital lives have become.&nbsp;</p><p>The response will mark a major shift. Identity will no longer be treated as a static credential but as a living, continuously verified signal. Real-time behavioral validation systems, adaptive verification layers, and government-backed digital ID frameworks will emerge to prioritize ongoing authentication instead of one-time proof.&nbsp;</p><p><strong>Tip: </strong>Until then, individuals should share ID documents only through official websites or apps they have navigated to directly. Avoid uploading credentials through unsolicited links, and enable transaction alerts or credit freezes whenever possible to detect and stop fraudulent activity early.<strong>&nbsp;</strong>&nbsp;</p><h2>5. The browser becomes the new ground zero for deception&nbsp;</h2><p>By 2026, the browser will no longer be a neutral window into the internet. It will become the primary arena where criminals launch, automate, and scale their attacks. As people rely on a small handful of tabs to shop, bank, work, and communicate, attackers are moving directly into that space and using AI to blend in.&nbsp;</p><p>Malvertising, search ads, and sponsored posts will evolve from a nuisance to a mainstream threat. AI-generated ads will mimic brand visuals, copywriting styles, and product listings with near-perfect accuracy, allowing attackers to place fake links above legitimate ones. Clicking what appears to be your bank, a package delivery service, or a well-known retailer can now lead to a cloned site designed to harvest credentials or payment information. Entire counterfeit storefronts will be created in seconds, complete with AI-generated product images, scripted chat support, and fake tracking numbers that vanish once payment is processed.&nbsp;</p><p>Inside the browser itself, malicious scripts, fake update prompts, poisoned pop-ups, and session token theft will quietly replace older tactics that relied on downloads. Malware will increasingly live inside the page. Attackers will steal authentication tokens that keep people logged in, giving them direct access to accounts without ever needing a password. Even cautious users can be fooled when the entire environment around them looks legitimate.&nbsp;</p><p><strong>Tip:</strong> Combine strong browser hygiene with careful shopping habits. Enable passkeys or two-factor authentication for important accounts and regularly review active sessions. Use bookmarks or manually typed addresses for banking and government services instead of clicking ads or sponsored results. When shopping, treat unfamiliar online stores like physical ones. Look for real contact information, clear return policies, and secure payment options. If anything feels vague or automated, run the site through a security product or scam detector before entering payment details. Finally, choose a browser that prioritizes safety and privacy such as Norton Neo, the first AI browser built to be both safe and intelligent.&nbsp;&nbsp;</p><h2>The bottom line: 2026 is the year digital safety becomes personal&nbsp;</h2><p>The threats of 2026 are no longer abstract cyber risks happening “out there.” They are intimate, adaptive, and designed to meet people where they live online – on phones, in inboxes, in search results, and inside the browser tabs we trust most.&nbsp;</p><p>This is the year everyday people must build new reflexes.&nbsp;<br>This is the year organizations must rethink identity and authenticity.&nbsp;<br>This is the year technology companies must prioritize verification, not convenience.&nbsp;<br>And this is the year society must finally accept that safety is a shared responsibility.&nbsp;</p><p>The good news: awareness is power. These predictions aren’t just warnings; they are a roadmap. They show where attackers are headed and where defenses must evolve. With the right habits, tools, and skepticism, individuals can stay ahead of even the most sophisticated AI-driven threats.&nbsp;</p><p>Because while technology may be changing faster than ever, one truth remains: the more people understand the landscape, the harder it becomes for cybercriminals to win.&nbsp;</p>

As AI accelerates, identity, truth and trust face their biggest test yet. Here’s what to expect in 2026.

Cyber predictions for 2026

<p>The holiday season should feel festive, and not stressful. But every year, as shopping carts fill up and inboxes overflow with deals, scammers see an opportunity to strike. They know people are distracted, tired, and moving fast. That’s why some of the most convincing fraud attempts of the year happen between November and January.</p><p>At Gen, we work every day to help people stay ahead of evolving threats. And during the holidays, the smallest moments, buying a gift card, donating to a charity, or opening a “pre-approved” offer can carry outsized risk. Here’s what to watch for and how to protect yourself, based on the latest insights and practical guidance from our teams and partners from the Identity Theft Resource Center.&nbsp;</p><h2>1. Gift cards: convenient for you, gold for scammers</h2><p>Gift cards remain one of the easiest tools for fraudsters to exploit. They’re fast, unregulated, and nearly impossible to trace once the numbers are handed over. If anyone pressures you to pay for <em>anything</em> with a gift card, a fee, a fine, a service, or a “problem with your account,” that’s a scam.</p><p>Before you buy:</p><ul><li>Purchase cards only from reputable retailers.</li><li>Never share the numbers or PIN with someone you don’t know.</li><li>Ignore any links sent to “activate,” “verify,” or “unlock” a card; scammers increasingly use fake branded sites to steal balances.&nbsp;</li></ul><h2>2. Slow down before you donate</h2><p>Scammers build fake charities designed to look almost identical to the real thing, especially during high-giving months. They count on people acting quickly and emotionally.</p><p>Before donating:</p><ul><li>Search for the organization directly, not through a link in an email or text.</li><li>Check the name carefully. Misspellings, extra hyphens, or odd URLs are red flags.</li><li>Verify legitimacy through trusted sites like Charity Navigator or the IRS database.&nbsp;</li></ul><p>Real charities don’t rush you. If you feel pressured, step back.</p><h2>3. “Special offers” that want your SSN? Hard pass.</h2><p>Fraudsters love hiding behind fake credit card offers and holiday promotions. These scams are designed to harvest personal and financial information before you even realize what’s happening.</p><p>Keep yourself safe by:</p><ul><li>Avoiding offers that ask for full SSNs or bank details upfront.</li><li>Checking for HTTPS and secure branding before entering sensitive info.</li><li>Monitoring your credit for any newly opened accounts or inquiries you didn’t recognize or authorize.&nbsp;</li></ul><p>If an offer looks too shiny, too generous, or too urgent, trust your instincts.</p><h2>4. Your best defense: layers of strong, everyday protection</h2><p>The smartest way to stay safe isn’t about memorizing scam techniques. It’s about building habits that work year-round. As <a href="https://cmsb.nortonlifelock.com/sites/default/files/2025-12/Keeping%20You%20and%20Your%20Money%20Safe%20During%20the%20Holiday%20Crunch-2.pdf" target="_blank" title="Tips for Holiday Safety">this guide </a>emphasizes, your strongest protection comes from awareness paired with simple safeguards.&nbsp;</p><p>Set yourself up for success by:</p><ul><li>Checking your accounts regularly for unfamiliar transactions.</li><li>Using strong, unique passwords for every site you shop or bank with.</li><li>Turning on two-factor authentication wherever possible.</li><li>Relying on trusted security tools that monitor for identity threats, malicious sites, and scam attempts in real time.</li></ul><p>These small steps make it dramatically harder for attackers to turn holiday pressure into holiday losses.</p><p><strong>Final thought: Give yourself the gift of a calmer season</strong></p><p>Staying safe online shouldn’t take the joy out of the holidays. With a little awareness and the right protections in place, you can shop, donate, and celebrate with confidence.</p><p>The holiday crunch is real. But so is your power to stay one step ahead.</p>

Holiday scam trends and expert advice to keep your finances and identity protected.

Stay smart this holiday season: How to keep your money and identity safe when scams spike

Threat Research Team

<p>At the start of 2025, we anticipated a turning point in cybersecurity. AI was accelerating, threats were evolving, and people were becoming increasingly entangled in a digital world that demanded new instincts and stronger defenses. Now, as the year comes to a close, it’s clear that many of the trends we foresaw have not only emerged but become defining realities for people and global security at large.&nbsp;</p><p>Below is a look back at each major prediction and what materialized in 2025.&nbsp;</p><h2>1. AI will blur the line between reality and fiction&nbsp;</h2><h3>What we predicted&nbsp;</h3><p>Artificial intelligence isn’t just a powerful tool; it’s becoming a force that reshapes how we perceive the world. But, as it becomes better, smarter, more realistic and accessible, AI will increasingly blur truth and deception, making it more difficult than ever to decipher what’s real.&nbsp;</p><h3>Hyper-personalized realities&nbsp;</h3><p>AI-powered Large Language Models (think ChatGPT, Gemini, etc.) are advancing at an incredibly fast pace, offering hyper-personalized interactions that could alter perceptions and decision-making.&nbsp;&nbsp;</p><p>Imagine a world where AI doesn’t just answer your questions but anticipates your needs.&nbsp;</p><p>But here’s the trade-off: to unlock this seamless, personal assistant experience, people are handing over everything to AI, including calendars, messages and apps. Hyper-personalization comes with a cost: the erosion of privacy and autonomy. Are you willing to lose privacy for convenience?&nbsp;&nbsp;</p><p>This raises critical ethical questions: Who controls the narratives AI presents? How do we safeguard independent thought in a world increasingly influenced by machine intelligence?&nbsp;</p><p>We believe that AI-driven solutions should ensure transparency and accountability, giving individuals tools to navigate these hyper-realities without losing sight of two key things: truth and trust.&nbsp;</p><h3>AI in sensitive roles&nbsp;</h3><p>We suspect that AI will also infiltrate areas once considered uniquely human, such as parenting and education. Imagine an AI tool stepping in to mentor a child, help with homework, or even act as a digital babysitter. While it offers unlimited time and patience, it challenges the boundaries of what roles and responsibilities should be left to humans.&nbsp;</p><h3>Redefining relationships</h3><p>AI is poised to transform the family, from parenting and pets to companionship, by taking over routine tasks like homework help and schedule management or even emotional connections. Bonding moments – like bedtime stories or daily conversations – slip away. With robotics bringing AI into the physical world, the stakes grow higher: robotic pets replacing real ones, AI nannies soothing children and robot companions filling emotional gaps.&nbsp;&nbsp;</p><p>Shaping young minds: As AI becomes more engaging, children may form stronger bonds with machines than caregivers, shifting family dynamics. While AI offers personalized guidance and companionship, overdependence could limit kids’ social and emotional growth, making real relationships harder to navigate. Families must balance the benefits of AI with the need for genuine human connection.&nbsp;</p><p>The broader societal question is this: how much influence will we allow AI to have in shaping the next generation?&nbsp;</p><h3>What came true</h3><p>This prediction came true, but materialized even faster than expected. Throughout 2025, AI-generated images, audio and written content reached a level of realism that fooled not only consumers but also experienced content moderators and security teams. Several high-profile incidents involved deepfake audio used to authorize fraudulent wire transfers, and social platforms struggled to contain synthetic celebrity scandals that spread faster than verified corrections. The year proved that users need stronger tools and instincts to distinguish real from manufactured content.&nbsp;</p><p>AI in sensitive roles became one of the most unexpected and concerning shifts of the year. Families increasingly leaned on AI for tutoring, companionship and parenting support, but the biggest wake-up call came from children using ChatGPT-style tools for therapy. Schools and parents reported kids turning to AI to talk through anxiety, friendship problems and even serious emotional issues before speaking to adults. What started as “homework help” quietly evolved into emotional outsourcing, raising big questions about dependency, privacy and the boundaries between guidance and guardianship. In fact, based on our own consumer survey from summer 2025, <a href="https://newsroom.gendigital.com/Norton-Cyber-Safety-Insights-Report-Connected-Kids" target="_blank" rel="noreferrer noopener">NCSIR: Connected Kids</a>, over a third of parents say their child uses AI for emotional support, a number which rises to 41% in the United States. The prediction that AI would move into roles once considered uniquely human proved not only accurate, but urgent.&nbsp;</p><h2>2. The deepfake revolution&nbsp;</h2><h3>What we predicted</h3><p>Deepfakes, AI-generated media designed to mimic real people, are becoming so sophisticated that even experts may struggle to distinguish truth from fabrication. In 2025, we expect increases in:&nbsp;</p><h3>Personal attacks</h3><p>Scorned individuals could use deepfakes to harass or extort others, not just by targeting the individual directly but by creating convincing fake media of family members or friends. These fabricated videos or audio clips could be used to manipulate victims emotionally, spread false rumors, or even strain personal relationships, amplifying the psychological toll of such attacks.&nbsp;</p><h3>Political manipulation</h3><p>Governments and bad actors may leverage deepfakes to divide, spread disinformation and destabilize societies. Imagine a fake speech from a world leader announcing false policies — such content could ignite panic, erode trust in institutions and manipulate public opinion. Deepfakes could also target journalists or political opponents, fabricating damaging scandals or discrediting reliable sources, undermining public confidence in the media. This highlights the need for a system where authenticity is non-negotiable, where digital signatures could become the standard to restore trust.&nbsp;&nbsp;</p><h3>Financial fraud</h3><p>Deepfake videos or audio clips of executives could be used to impersonate authority figures, convince employees to transfer funds, reveal sensitive company information or approve unauthorized transactions. For instance, a Business Communication Compromise (BCC) can happen when a convincing video of a CEO instructing a financial officer to expedite a payment bypasses typical safeguards, due to its perceived authenticity and established trust. The threat doesn’t end with internal fraud; deepfakes could also target investors or clients, undermining trust in corporate communications and causing long-term reputational damage. These attacks could ripple through supply chains and financial systems, creating chaos on an unprecedented scale.&nbsp;</p><h3>What came true&nbsp;</h3><p>Deepfake-driven incidents exploded in 2025. Several political events were disrupted by fabricated videos released ahead of elections, forcing governments to fast-track authenticity verification standards. On the personal side, extortion attempts using manipulated media targeting both adults and teens rose sharply. Corporate deepfake fraud also became more frequent, with attackers impersonating executives via video to approve payments or release confidential information. The need for digital signatures and content provenance became a critical industry focus.&nbsp;</p><h2>3. Data theft: the multi-faceted threat to identity&nbsp;</h2><p>The digital world runs on data and cybercriminals are mastering the art of leveraging it as a multifaceted threat to target individuals, organizations and societies alike.&nbsp;</p><h3>Comprehensive profiles for targeted scams&nbsp;</h3><p>Large-scale breaches and public data sources provide criminals with the raw materials to build highly detailed profiles of their victims.&nbsp; This goes beyond just a first and last name or email address – criminals piece together “who” their targets really are. They know where you work, what you do for a living, your hobbies and habits. With this intimate understanding and detailed information, they can:&nbsp;</p><ul><li>Craft hyper-personalized phishing attempts</li><li>Launch convincing extortion schemes</li><li>Impersonate trusted services to exploit victims’ trust&nbsp;</li></ul><p>For example, attackers using images of victims’ homes during sextortion attempts demonstrate how cybercriminals are evolving their psychological manipulation tactics.&nbsp;</p><h3>Forgotten logins, fresh targets: how old Accounts open new doors for hackers&nbsp;</h3><p>The average individual has hundreds of online accounts. Besides the active ones, there’s also a plethora of aged accounts that are long gone, such as old email addresses from Hotmail or social accounts like MySpace. These accounts can be forgotten or abandoned. Combined with the low adoption of multi-factor authentication (MFA) and the widespread practice of password reuse, these neglected accounts become gateways for attackers. Cybercriminals can pivot from one breached account to another, collecting more personal information with each step and enabling even more precise and damaging attacks.&nbsp;</p><h3>What came true</h3><p>This prediction proved to be one of the year’s most accurate. Cybercriminals leaned heavily on deep, blended data sets to create unnervingly complete profiles of their targets. Sextortion cases using photos pulled from social media and real home exterior images surged. Hyper-personalized phishing hit new levels of realism as attackers referenced victims’ workplaces, travel plans, hobbies and even recent online purchases. And perhaps most striking, the “forgotten logins” problem exploded: millions of abandoned Hotmail, Yahoo and MySpace-era accounts were compromised and used as stepping stones into more active identities. Once inside, attackers chained together old passwords, reused credentials and unsecured inboxes to pivot across services, proving that yesterday’s accounts are today’s attack surface.&nbsp;</p><h2>&nbsp;4. Scams enter the era of hyper-personalization&nbsp;</h2><h3>What we predicted</h3><p>2025 marks the dawn of hyper-personalized scams. Cybercriminals no longer rely on broad attacks and wait for someone to take the bait. Instead, they use meticulously crafted profiles built from breached data, public records or dark web scraps to tailor their attacks. They’re not random. They’re designed to feel personal, disarming and hard to resist because they rely on your specific data – your own identity.&nbsp;&nbsp;</p><p>These scams won’t feel like scams. They’ll feel real. Here are some examples:&nbsp;</p><h3>Tailored manipulation&nbsp;</h3><p>Imagine receiving a message referencing a conversation you had last week or mimicking a friend’s tone perfectly. Attackers will use personal details to craft scams so convincing they disarm even the most vigilant.&nbsp;</p><h3>Psychological exploits</h3><p>Cognitive biases like urgency, trust, and fear will be turned against us. Emotional triggers — like a fabricated crisis involving a loved one — will make hesitation feel impossible.&nbsp;</p><h3>Platform integration</h3><p>Social media and messaging apps will become prime battlegrounds, with scams that look indistinguishable from legitimate interactions.&nbsp;</p><p>This is the reality of where scams are heading. The lines between genuine and fraudulent will blur, forcing us to rethink how we defend against threats. Technology together with awareness, education, and proactive resilience will be critical to protecting ourselves and our communities in this new era of deception.&nbsp;</p><h3>What came true</h3><p>The shift to hyper-personalized scams was unmistakable. Fraudsters used real-time AI to mirror the writing style, vocabulary and emotional tone of friends, family members and trusted companies. Consumers reported receiving messages referencing actual conversations, locations and past purchases. Social platforms became major battlegrounds for highly tailored scams that felt indistinguishable from legitimate interactions. This was the year when “it felt too real to be a scam” became a recurring theme in victim reports.&nbsp;</p><h2>5. Financial theft: the new frontier of exploitation&nbsp;</h2><h3>What we predicted</h3><p>The war on financial security is escalating, with attackers blurring the boundaries between digital fraud and physical coercion. 2025 will see financial theft reach unprecedented levels, fueled by innovation in both technology and tactics.&nbsp;</p><h3>A new breed of digital fraud&nbsp;</h3><p>Cybercriminals are wielding sophisticated tools to undermine trust and exploit vulnerabilities:&nbsp;</p><h3>Deepfake scams&nbsp;</h3><p>Picture a video of a trusted leader or celebrity endorsing a high-return investment. These convincing forgeries will draw in victims by the thousands, fueling a new wave of financial deception.&nbsp;</p><h3>Voice-cloned lies</h3><p>Fraudsters will impersonate government officials, announcing fake income distributions or policy updates, driving victims to malicious platforms.&nbsp;</p><h3>Crypto scams on steroids</h3><p>From fake giveaways to fabricated trading platforms, cryptocurrency will remain a prime target for attackers hungry for unregulated, high-reward opportunities.&nbsp;</p><h3>Where cybercrime gets personal&nbsp;&nbsp;</h3><p>Financial theft is no longer confined to just the digital world. Now, it feels more and more personal. Spyware and malware will silently monitor devices, giving attackers backdoor access to banking apps and bypassing traditional security measures.&nbsp;</p><p>This evolving threat challenges us to rethink financial security. It’s not just about protecting devices; it’s about protecting the people behind them. The only way forward is bold innovation, collective vigilance, and an unwavering commitment to staying ahead of those who prey on trust.&nbsp;</p><h2>Our vision for the future&nbsp;</h2><p>The challenges of 2025 demand bold action, innovative thinking and a commitment to protecting what matters most: trust. And while threats are undoubtedly getting more complex, the future is bright, and technology will play a pivotal role in making the world safer, smarter and more secure. At Gen, we’re not just observing these challenges; we’re staying ahead of them. With products like Norton Genie for scam detection, Norton 360 Deluxe and Avast One for all-in-one protection, and LifeLock to restore what’s lost, we’re safeguarding your digital world and Powering Digital Freedom.&nbsp;</p><p>While technology like AI holds the promise of a more secure and innovative future, uncertainty often stands in the way of progress. This is where we see opportunity: to educate, empower and lead. By helping others understand and embrace AI responsibly, we can ensure it becomes a force for good — strengthening our defenses while driving innovation.&nbsp;</p><p>Make no mistake. New technology breeds new risks. However, it also serves as a powerful catalyst for positive change, paving the way to a safer and brighter future.&nbsp;</p><p>With every new tool, every evolving threat, and every transformative idea, we’re shaping a future where innovation and security go hand in hand.&nbsp;</p><h3>What came true</h3><p>The financial sector experienced one of its most turbulent years. Deepfake investment pitches, AI-generated endorsements and cryptocurrency fraud campaigns drew in record numbers of victims. Malware designed to capture session tokens from banking apps became more common, allowing criminals to bypass passwords altogether. We also saw a rise in hybrid threats where digital scams led to in-person coercion or targeted follow-ups. Financial institutions accelerated their move toward biometric verification and real-time behavioral fraud detection as a result. &nbsp;</p><h2>Looking ahead&nbsp;</h2><p>Our <a href="https://www.gendigital.com/blog/insights/leadership-perspectives/predictions-2025" title="2025 Gen Cybersecurity Predictions">2025 predictions</a> anticipated major shifts across AI, identity, scams and financial crime. What we saw this year confirmed that these transformations are not abstract forecasts but active forces shaping daily life. The pace of change has only accelerated, which is why our focus in 2026 will be on helping people build new digital instincts, adopt stronger security tools and navigate an internet where deception is easier than ever to scale. And with the landscape shifting again, stay tuned, our 2026 predictions are on the horizon.&nbsp;</p>

A year where predictions became reality and reshaped the future of Cyber Safety

2025 revealed: How Gen cyber predictions became reality 

<p>Universities face a perfect storm of cybersecurity challenges. With open, collaborative environments that welcome diverse users, vast amounts of sensitive data and often-limited resources, these institutions have become prime targets for cybercriminals.</p>

<p dir="ltr">Even more concerning,&nbsp;<strong>higher education consistently ranks among the most targeted industries</strong>, with cyberattacks against the education sector&nbsp;<a href="https://www.upguard.com/blog/top-cybersecurity-problems-for-universities-colleges">increasing by 75%</a> between 2020 and 2021. We’re not talking about simple password breaches anymore. Today’s threats are sophisticated, persistent and costly.</p><p dir="ltr">Comprehensive campus protection requires layered security measures, ongoing education programs, specialized solutions designed for higher education environments and strong governance frameworks that balance security with academic freedom.</p><h2 dir="ltr">Why cybersecurity matters more than ever for universities</h2><h3 dir="ltr">The growing threat landscape targets higher education</h3><p dir="ltr">Statistics paint a stark picture of escalating threats. Educational institutions were hit by&nbsp;<a href="https://www.zscaler.com/campaign/threatlabz-ransomware-report">217 ransomware attacks</a> between April 2023 and April 2024—representing a&nbsp;<strong>35% year-over-year increase</strong>.<strong>&nbsp;</strong>Meanwhile,&nbsp;<a href="https://go1.gurucul.com/2024-insider-threat-report">48% of organizations</a> report insider attacks becoming more frequent.</p><h3 dir="ltr">Universities handle sensitive information</h3><p dir="ltr">Universities are data goldmines for cybercriminals. Student records contain personally identifiable information (PII), academic transcripts, financial aid details and health records. Faculty and staff data includes employment records, research information and valuable intellectual property. Add in alumni donor information, research data worth millions and comprehensive financial records? Universities become irresistible targets.</p><h3 dir="ltr">Impact of breaches and compliance requirements</h3><p dir="ltr">When cybersecurity fails, the consequences cascade across the entire university community. The financial impact is staggering—beyond the average&nbsp;<a href="https://edtechmagazine.com/higher/article/2024/07/how-zero-trust-can-protect-against-evolving-cybersecurity-threats-higher-ed">$3.65 million cost of a university data breach</a>, institutions face additional expenses for system recovery, legal fees and regulatory fines.</p><h2 dir="ltr">What makes university students and staff vulnerable to cyber attacks</h2><p dir="ltr">Universities operate fundamentally differently than traditional enterprises. The academic mission prioritizes openness over strict security controls, research collaboration requires easy access to resources and institutions must accommodate visiting scholars and community members around the clock.</p><p dir="ltr">This creates an inherent tension between security requirements and operational needs. Unlike corporate environments where access can be tightly controlled, universities must balance protection with the intellectual freedom that drives academic excellence.</p><ul><li dir="ltr"><strong>High user turnover and a diverse user base. </strong>Campus communities experience constant change. Every semester brings thousands of new students requiring network access, along with visiting researchers, temporary staff and guest users. This constant flux creates massive challenges for identity management systems and access control policies.</li><li dir="ltr"><strong>Personal device usage expands attack surface</strong>. Students and faculty bring an enormous variety of personal devices to campus networks. Laptops, smartphones, tablets and IoT devices all seek network access, often lacking proper security controls or running outdated software.</li><li dir="ltr"><strong>Decentralized IT systems and legacy technology.&nbsp;</strong>Many universities also struggle with decades-old systems that can’t support modern security features, combined with siloed IT departments and inconsistent security policies across different schools and colleges.</li><li dir="ltr"><strong>Limited cybersecurity resources and budget constraints.&nbsp;</strong>Universities face severe budget constraints that directly impact their cybersecurity capabilities. Despite increasing spending, higher education institutions in 2023 allocated an average of only&nbsp;<a href="https://www.insidehighered.com/news/quick-takes/2024/04/25/colleges-spending-more-ever-cybersecurity-efforts">7% of their budgets to cybersecurity</a>, below the global average of 8%.</li></ul><h2>What comprehensive cybersecurity looks like on campus</h2><h3 dir="ltr">Zero-trust security model implementation</h3><p dir="ltr">Modern university security requires a fundamental shift to zero-trust principles: “never trust, always verify.” This approach assumes threats exist both inside and outside the network perimeter, requiring continuous verification of every access request.</p><h3 dir="ltr">Multifactor authentication (MFA) and identity management</h3><p dir="ltr">MFA is no longer optional. Research shows that using MFA makes it&nbsp;<a href="https://www.cisa.gov/topics/cybersecurity-best-practices/multifactor-authentication">99% less likely to be hacked</a>. Modern implementations include:</p><ul><li>Biometric authentication</li><li>Hardware security keys</li><li dir="ltr">Mobile app notifications</li><li dir="ltr">Risk-based adaptive authentication</li></ul><h3 dir="ltr">Data encryption and network security measures</h3><p dir="ltr">Universities must encrypt data both at rest and in transit. Network security requires next-generation firewalls, intrusion detection systems, network access control solutions and secure VPN access. These tools create multiple layers of protection against sophisticated attacks.</p><h3 dir="ltr">Cloud security and AI-driven threat detection</h3><p dir="ltr">Proper cloud security includes configuration management to prevent the misconfigurations that can lead to cloud environment intrusions. AI-powered security tools can analyze network patterns to spot anomalies and identify zero-day attacks that bypass traditional systems.</p><h2 dir="ltr">Essential cybersecurity solutions universities need</h2><p dir="ltr">Building a robust security infrastructure requires strategic investment in the right combination of technologies and processes. Universities should prioritize solutions that address their unique operational challenges while providing scalable protection for diverse campus communities.</p>

<p dir="ltr">Here are the&nbsp;<strong>eight critical security solutions</strong> every university should implement:</p><ol><li dir="ltr"><strong>Smart identity and access management.</strong> Academic environments need IAM (identity access management) systems that can handle constant user turnover, from semester enrollments to visiting researchers. The best solutions provide role-based access control, automated account provisioning and deprovisioning and seamless integration with existing university systems.</li><li dir="ltr"><strong>Continuous security testing and assessment.</strong> Universities can’t afford to wait for annual audits to discover vulnerabilities. Implement monthly vulnerability scans, quarterly penetration testing and annual comprehensive security reviews. This layered approach catches threats at different stages and provides ongoing visibility into security posture.</li><li dir="ltr"><strong>Battle-tested incident response plans.</strong> When attacks happen, every minute counts. Universities need documented response procedures covering detection, containment, recovery and communication. The key is regular testing and updates—plans that haven’t been practiced are plans that will fail when needed most.</li><li dir="ltr"><strong>Seamless remote access and device protection. </strong>With hybrid learning and working now standard, universities need secure remote access through VPNs, zero-trust network solutions and comprehensive mobile device management. These tools must work across the diverse ecosystem typical of campus environments.</li><li dir="ltr"><strong>Intelligent data loss prevention.</strong> DLP solutions help prevent both accidental data exposure and intentional theft while ensuring compliance with FERPA, HIPAA and other regulations. Focus on solutions that can classify and protect data automatically without disrupting academic workflows.</li><li dir="ltr"><strong>Bulletproof backup and recovery systems. </strong>Follow the&nbsp;3-2-1 backup rule: three copies of critical data, stored on two different media types, with one copy maintained offline. This approach ensures universities can recover from ransomware attacks, natural disasters or system failures.</li><li dir="ltr"><strong>Automated compliance management. </strong>Universities juggle multiple regulatory requirements, from student privacy to research data protection. Automated compliance tools help monitor FERPA adherence, generate audit reports and alert administrators to potential violations before they become serious problems.</li><li dir="ltr"><strong>Comprehensive endpoint protection. </strong>With thousands of devices connecting to campus networks daily, universities need advanced endpoint protection that includes anti-malware, device monitoring and automated threat response. Solutions should work across different operating systems and device types without requiring extensive IT management.</li></ol><h2 dir="ltr">Building a campus-wide culture of cybersecurity awareness</h2><h3 dir="ltr">Training that works for different campus populations</h3><p dir="ltr">Effective security awareness requires targeted approaches. Students need training on social engineering recognition and safe browsing practices. Faculty require specialized training on research data protection and secure collaboration tools. Staff training must be role-specific, covering security responsibilities relevant to their access levels.</p><p dir="ltr">Research shows that&nbsp;<a href="https://www.brside.com/academy-blog/gamification-in-cybersecurity-training-make-security-awareness-fun-effective-(2025)">game-based training methods</a> achieve the highest engagement rates, while positive reinforcement works better than fear-based messaging. Microlearning approaches deliver security concepts in digestible chunks, while simulated phishing campaigns provide real-world practice with immediate feedback.</p><h3 dir="ltr">Building grassroots security movements</h3><p dir="ltr">accessible reporting mechanisms, including dedicated security hotlines, anonymous reporting options and clear escalation procedures.</p><p dir="ltr">Campus security champions can dramatically amplify awareness efforts. By recruiting enthusiastic students and faculty as security advocates and empowering them to lead peer education sessions, universities create grassroots security movements that reach every corner of campus.</p><p dir="ltr">Security awareness shouldn’t be separate from academic life. New student orientations should include cybersecurity components, while academic programs can incorporate security awareness relevant to students’ fields of study, from research methodology courses (including data protection) to business programs covering risk management.</p><h3 dir="ltr">Keeping security top-of-mind year-round</h3><p dir="ltr">October’s&nbsp;<a href="https://www.cisa.gov/cybersecurity-awareness-month">National Cybersecurity Awareness Month</a> provides opportunities for campus-wide initiatives, but awareness efforts must continue through newsletters, digital signage and regular emergency system tests. Universities also need easy, accessible reporting mechanisms, including dedicated security hotlines, anonymous reporting options and clear escalation procedures.</p><h2 dir="ltr">Steps universities can take today</h2><h3 dir="ltr">Immediate security improvements</h3><p dir="ltr">Universities can implement several quick wins without major budget allocations:</p><ol><li dir="ltr"><strong>Implement MFA </strong>across all critical systems</li><li dir="ltr"><strong>Update software a</strong>nd apply security patches</li><li dir="ltr"><strong>Conduct basic security audits </strong>of existing systems</li><li dir="ltr"><strong>Review and clean up&nbsp;</strong>user access permissions</li><li dir="ltr"><strong>Test backup systems </strong>and recovery procedures</li></ol><h3>&nbsp;</h3>

<h3 dir="ltr">Medium and long-term planning</h3><p dir="ltr">Three to six-month initiatives should focus on:</p><ul><li dir="ltr">Developing comprehensive security frameworks</li><li dir="ltr">Conducting risk assessments</li><li dir="ltr">Establishing security governance structures</li></ul><p dir="ltr">Twelve to 24-month goals require dedicated budget allocation for:</p><ul><li dir="ltr">Cybersecurity staffing</li><li dir="ltr">Technology upgrades</li><li dir="ltr">Comprehensive training programs</li><li dir="ltr">Automated compliance systems</li></ul><h3 dir="ltr">Measuring success and continuous improvement</h3><p dir="ltr">Effective security programs require ongoing measurement. Key metrics include:</p><ul><li dir="ltr">Incident frequency and severity</li><li dir="ltr">Response times</li><li dir="ltr">Patch compliance rates</li><li dir="ltr">Training completion rates</li><li dir="ltr">Phishing simulation results</li><li><h2 dir="ltr">Securing the future of higher education</h2></li><li><p dir="ltr">Universities stand at a critical juncture where sophisticated, growing threats meet the urgent need for comprehensive protection. The solutions exist, the path forward is clear and the time for action is now.</p></li><li><p dir="ltr">The academic mission depends on creating safe digital spaces where learning and discovery can flourish. Universities that invest in comprehensive cybersecurity today are investing in their ability to serve students, advance research and maintain public trust tomorrow.</p></li><li><p dir="ltr">We’re committed to supporting higher education’s digital transformation through our&nbsp;<a href="https://www.gendigital.com/us/en/social-impact/digital-education-and-training/">digital education and training</a> initiatives.&nbsp;<strong>Discover how&nbsp;</strong><a href="https://www.gendigital.com/us/en/"><strong>Gen family of trusted brands</strong></a><strong>&nbsp;can safeguard your students and staff.&nbsp;</strong>Together, we can build the secure, digitally-free future that higher education deserves.</p></li></ul>

Empowering higher education with smarter digital defenses that safeguard both learning and livelihoods

Cybersecurity on campus: how universities can protect students and staff alike

<p>Most of us open WhatsApp without thinking twice. It is where family chats live, where school groups share reminders, and where friends send memes at all hours. It feels personal and private, especially since WhatsApp messages are end to end encrypted.&nbsp;</p><p>That is why a recent piece of research from the <a href="https://www.univie.ac.at/en/news/detail/forscherinnen-entdecken-grosse-sicherheitsluecke-in-whatsapp" target="_blank" rel="noreferrer noopener">University of Vienna</a> is so interesting. The researchers found a way to use WhatsApp’s own features to map <strong>3.5 billion accounts worldwide</strong>, pulling in phone numbers and profile details at industrial scale. They did this under a bug bounty, reported everything to Meta, and the issue has now been fixed.&nbsp;</p><p>So, if the problem is already solved, why talk about it?&nbsp;</p><p>Because this was a glimpse of what could happen if the wrong people found the same weakness first. And because it reminds us that a simple phone number can expose much more about you than you might think.&nbsp;</p><h2>What the researchers actually did&nbsp;</h2><p>WhatsApp has a feature that feels completely normal: when you open the app, it checks the contacts in your phone and shows you which ones are already on WhatsApp. To do that, your app sends lists of phone numbers to WhatsApp’s servers, and the servers reply with “yes, this number has an account” or “no, it does not”.&nbsp;</p><p>In theory, this kind of feature should be tightly controlled. You should only be able to check small batches of numbers, and you should not be able to ask that question millions of times in a row.&nbsp;</p><p>The Vienna team showed that in practice, it was possible to do exactly that. With some clever scripting and a small number of accounts, they were able to feed in huge lists of phone numbers, check around 100 million numbers per hour from a single server, and see which ones had WhatsApp accounts. For many of those accounts, they could also see public profile photos, “about” texts and some technical details about the devices.&nbsp;</p><p>They did not break the encryption on any messages and they did not spy on any chats. Instead, they turned a convenience feature into a kind of worldwide directory of WhatsApp users.&nbsp;</p><p>Once they had proved the point, they worked with Meta, the parent company of WhatsApp. Meta added stricter protections on their side and said they found no evidence that criminals had used the same trick.&nbsp;</p><p>From a user’s perspective, there is nothing you need to “fix” yourself about this particular bug. But there are a few important lessons hidden in the story.&nbsp;</p><h2>“No evidence of abuse” does not mean “no risk”&nbsp;</h2><p>Meta says there is no evidence that criminals used this technique in the wild. That is reassuring, and it is good that the issue was fixed under a bug bounty instead of being discovered after a major leak.&nbsp;</p><p>At the same time, it helps to understand what that sentence really means.&nbsp;</p><p>The researchers hammered WhatsApp’s systems very loudly from one place, on purpose, so that the problem would be impossible to miss once you went looking for it. A careful attacker would do the opposite. They would spread the same kind of traffic over many accounts, many IP addresses and a longer period of time, so that it blends in with normal use.&nbsp;</p><p>That kind of activity is much harder to spot. You need the right kind of monitoring, you need to know what patterns to look for and you need to keep detailed logs for long enough.&nbsp;</p><p>This is why security professionals often say “absence of evidence is not evidence of absence”. In simple terms, you can honestly say “we did not see anything worrying”, but you cannot promise that nobody ever tried it in a quieter way.&nbsp;</p><p>For you as a user, the practical takeaway is that this was not a scare about people reading your chats. It was a reminder that the information around your chats, such as your phone number, profile and online presence, can be very valuable on its own.&nbsp;</p>

<h2>Your phone number is not “just a number” anymore&nbsp;</h2><p>There is another detail in the study that should make anyone with a smartphone stop and think.&nbsp;</p><p>The researchers compared their WhatsApp data with numbers from a big Facebook scraping incident that hit the news in 2021. In that earlier case, attackers abused a different contact importer to pull phone numbers and profile details from Facebook.&nbsp;</p><p>When the team compared the two, they found that roughly half of the numbers from the old Facebook leak are still active on WhatsApp today.&nbsp;</p><p>That tells us a few things.&nbsp;</p><p>Most people do not change their phone number after a leak, even a very large one. A phone number is tied to your contracts, your accounts, your family and work life. Swapping it out is painful, so we keep it.&nbsp;</p><p>At the same time, more and more services treat your number as your identity. It is your login, your recovery method, your verification code and your contact point. It links together your messaging apps, social networks, shopping accounts and even loyalty cards.&nbsp;</p><p>Once a number appears in one big leak, it becomes the thread that lets scammers pull on every other part of your digital life. Years later, your number can still be used to look you up on new platforms, refresh old data and craft more convincing scams.&nbsp;</p><p>So the real problem is not “reusing the same account across platforms”. The problem is that the phone number itself has quietly turned into a long term identifier that follows you everywhere.&nbsp;</p><h2>What could criminals do with a database like this?&nbsp;</h2><p>Imagine, for a moment, that this research had not been done by academics but by a criminal group that kept the data for itself.&nbsp;</p><p>They would not have your message contents. Encryption still protects that part. What they would have is:&nbsp;</p><ul><li>A huge, up to date list of real WhatsApp numbers.</li><li>For many of them, a name and face from the profile photo.</li><li>Clues about which country you live in, which language you use and what device you own.&nbsp;</li></ul><p>That is more than enough to run some very effective scams.&nbsp;</p><p>A scammer does not need to read your chats to trick you. They need a working number, some believable background details and a good story.&nbsp;</p><p>With a database like this, they could:&nbsp;</p><ul><li>Target people in a specific country with messages in the right language and time zone.</li><li>Focus on numbers that look like they belong to businesses and try fake “boss” or “supplier” messages.</li><li>Match numbers with old leaks to build a fuller picture of who you are.&nbsp;</li></ul><p>In countries where WhatsApp use is restricted or frowned upon, such a database in the wrong hands could even be used for surveillance, for example by revealing how many people are secretly using the app.&nbsp;</p><p>The important point is that a single design flaw in a familiar feature almost turned into an “address book for the planet”.&nbsp;</p><h2>What you can do to protect yourself&nbsp;</h2><p>You cannot redesign WhatsApp yourself, and you cannot change the fact that researchers found this flaw in the past. What you can do is reduce how much of your life is exposed through your phone number.&nbsp;</p><p>Here are a few practical steps, explained without technical jargon.&nbsp;</p><h3><strong>Tighten your WhatsApp privacy settings</strong>&nbsp;</h3><p>Spend two minutes in WhatsApp settings and look at who can see what.&nbsp;</p><p>Set your profile photo and “about” information so that only your contacts can see them. If you do not need strangers to see your picture, there is no reason to make it public. You can also limit your “last seen” and online status if you prefer.&nbsp;</p><p>This does not stop your number being checked behind the scenes, but it does reduce how much personal detail is revealed at a glance.&nbsp;</p><h3><strong>Treat your main number as sensitive</strong>&nbsp;</h3><p>Think about where your main number appears in public. Is it on social media bios, websites, adverts, public groups or forums?&nbsp;</p><p>When possible, use a different number for public things like classifieds, business listings or newsletters. Many people now use a second SIM or a separate online number for that, so that their “real” number stays more private.&nbsp;</p><h3><strong>Be aware of long-term risk</strong>&nbsp;</h3><p>If you know, or strongly suspect, that your number has been part of a big leak in the past, assume it will stay attractive to scammers for years.&nbsp;</p><p>That does not mean you should panic. It simply means you should be more cautious with any unexpected WhatsApp message or call, especially if the sender already seems to know something about you.&nbsp;</p><p>Slow down, verify who you are talking to using another channel if needed, and never feel rushed into clicking links or sending codes.&nbsp;</p><h2>The bigger lesson for all of us&nbsp;</h2><p>The WhatsApp case is not a story about broken encryption or leaked message content. It is something more subtle.&nbsp;</p><p>A feature that was built to make our lives easier, by telling us which friends are “already on WhatsApp”, turned out to be abusable on a massive scale. A group of researchers caught it in time, and the company fixed it. This time we were lucky.&nbsp;</p><p>The bigger lesson is that convenience features often rely on information that looks harmless on its own, such as a phone number. When you combine that information with scale and automation, it can suddenly become very sensitive.&nbsp;</p><p>For everyday users, the best response is not to delete every app and vanish from the internet. It is to:&nbsp;</p><ul><li>Treat your phone number as an important piece of personal data, not just something you hand out without thinking.</li><li>Use the privacy controls that apps already give you.</li><li>Stay skeptical of unexpected messages, even when they arrive on apps that feel “safe”.&nbsp;</li></ul><p>The technology around us will keep changing, and security research like this will keep uncovering problems. The more we understand what our data can reveal, the better choices we can make about how and where we share it.</p>

How a fixed WhatsApp flaw exposed millions and what your phone number still reveals about you

The WhatsApp privacy scare you probably missed 

<h2>Stay ahead of rising scams with smarter cybersecurity&nbsp;</h2><p>As of 2022, more than <a href="https://www.gendigital.com/media/qcymrc1i/2023-ncsir-us-global-report_final.pdf">595 million adults worldwide</a> have experienced cyber scams. Since then, this number has continued to grow for individuals and businesses alike. While hackers mostly attacked large organizations in the past, they recently shifted gears to target smaller businesses. Why? Owners and managers of small and medium-sized businesses often present easier targets due to leaner IT teams, fewer security tools and lower levels of investment in employee awareness training.</p><p>While focus has spread to include SMBs, organizations of all sizes are struggling to grapple with the cybersecurity problem. Among the many growing threats, phishing scams rank as one of the most prevalent scams that companies face and they are only getting worse. Gen experts found a <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q1-2025">465.8% increase</a> in attacks from Q4 2024 to Q1 2025.&nbsp;</p><p>However, findings also confirm that there are effective ways for organizations to reduce or avoid online scams. These include implementing cybersecurity best practices, leveraging AI-powered defense tools and investing in security awareness training.&nbsp;</p><h2>How to recognize phishing scams before damage occurs</h2><p>There’s a good reason that phishing scams are on the rise. The first is that phishing provides a gateway for almost every other type of scam, such as ransomware and data leaks. The second is that hackers have found it’s much easier to compromise people than systems. Breaching systems requires more technical skills enhanced by the best AI tools, while targeting people requires communication skills enhanced by basic LLMs.</p><h3>Tips for identifying phishing scams</h3><p>Companies must rely on systems that can detect cyber scams and teach workers — and even customers — how to identify and respond to these attempts. The <a href="https://www.consumerfinance.gov/ask-cfpb/what-are-some-classic-warning-signs-of-possible-fraud-and-scams-en-2094/">Consumer Financial Protection Bureau</a> offers some excellent advice to spot red flags in emails, text, chat, social media DMs or calls:</p><ul><li>Claiming to come from a trusted source (e.g. bank, government, family member) but pressuring you to pay or send money</li><li>Asking you to pay upfront fees or taxes to receive a reward or price (e.g. the lottery scam)</li><li>Requests for payments through unusual or risky channels (e.g. crypto, prepaid gift cards or payment apps)</li><li>High-pressure attacks that try to get you to act quickly to get a once-in-a-lifetime or limited deal</li><li>Any other form of emotional manipulation that uses urgency or fear to override careful decision-making</li></ul><p>Cybercriminals rely on psychology by exploiting emotions that cause people to act quickly or take risks. Scammers prey on fear, desire to protect loved ones or even greed. They may also weaponize the trust people have in established sources, such as family members, employers or charitable organizations. Sadly, the impact of broken trust can create ripple effects throughout society.</p><h2>How to protect your business from online scams</h2><p>Protecting against phishing, AI scams and other forms of cyber fraud requires a multi-layered approach. Companies that focus exclusively on tools or people will ultimately leave gaps that hackers may exploit to gain unauthorized access.</p><h3>Secure your human resources</h3><p>Roughly <a href="https://www.infosecurity-magazine.com/news/data-breaches-human-error/">95% of security breaches</a> stem from human error. Consequently, companies must place the greatest investment for phishing scam prevention in their human assets. Reinforce a blameless culture so employees escalate quickly instead of hesitating or trying to fix it themselves.</p><p>You should also provide employee security awareness training. However, consider skipping the type of automated training with screens that people simply click through to complete. Instead, conduct red team exercises and create teachable moments from the experience.&nbsp;</p><h3>Follow governance best practices</h3><p>Creating and enforcing written policies can help organizations streamline the administrative aspects of avoiding online scams. Every organization should have playbooks that cover:&nbsp;</p><ul><li>Notifying the IT or security team about potential scams</li><li>Investigating those scams and the procedures to follow</li><li>Containing the threat and the steps to follow</li><li>Notifying regulators or partners and the order of priority</li></ul><p>Keep policies simple and easy to follow and use technology to enforce them whenever possible. For example, making it impossible to hit the payment button until a second person has reviewed an invoice request.</p><h3>Apply technical controls</h3><p>This is the area where most organizations invest their time, however too many CISOs choose and implement tools in isolation. Technical controls must complement the human and governance layers of your security plans:</p><ul><li><strong>Multi‑factor authentication (MFA):</strong> Not only does this make it more difficult for hackers to log in with stolen credentials, but it also makes it inconvenient for employees to share passwords.</li><li><strong>Scam Detector:</strong> <a href="https://us.norton.com/products/genie-scam-detector">Norton Genie</a> uses AI to analyze texts, emails and social messages in real time. Employees can paste suspicious content into the tool and get an instant assessment. This reduces the likelihood of falling for cyber scams.</li><li><strong>Antivirus and advanced protection:</strong> Avast provides continuous malware scanning, phishing site blocking and Wi‑Fi network inspection. It helps to catch malicious attachments and dangerous downloads before they cause harm.</li><li><strong>Device and browser protection:</strong> Norton blocks unsafe sites, detects fraudulent pop‑ups and stops exploit attempts at the browser and operating‑system level. It adds another layer beyond email filtering.</li><li><strong>Secrets and password management:</strong> Use enterprise password managers and rotate service credentials regularly to reduce reuse and shadow spreadsheets.</li><li><strong>Threat intelligence:</strong> <a href="https://www.avast.com/">Avast</a>&nbsp;draws on one of the world’s largest threat‑detection networks to identify new scam tactics quickly and distribute protections to all endpoints.</li><li><strong>Identity monitoring:</strong> <a href="https://lifelock.norton.com/">Norton LifeLock Benefits Solutions</a>&nbsp;alerts employees or customers if their Social Security number, financial accounts or personal details show up on the dark web. This provides early warning and recovery support if a scam leads to identity theft.</li><li><strong>Remediation services:</strong> Norton LifeLock Benefits Solutions specialists also offer hands-on assistance to guide cybercrime victims through account recovery, credit freezes and fraud resolution.</li></ul><h3>Secure the physical environment</h3><p>There’s a lot of fingerpointing at remote work as a source of risk, but breaches happen in person, too. Enforce badge access and watch for tailgating. Additionally, secure shared spaces like printers and mailrooms where people might find and steal sensitive documents. Lock screens, label and inventory devices and follow secure disposal procedures for drives and SIMs to prevent data theft that later fuels social engineering.</p><h2>How to respond to potential cyber scams</h2><p>When a suspected scam occurs, a fast response can make a world of difference. However, speed often depends on whether the affected person recognizes the urgency, knows what to do and can find relevant information quickly. Information availability and security awareness are areas for optimization that your security team must prioritize before incidents ever occur.</p><h3><strong>Corporate level</strong></h3><p>When an organization suspects a scam or compromise, the first priority is containment:</p><ul><li>Disable affected accounts.</li><li>Revoke tokens and isolate compromised systems. </li><li>Preserve evidence by saving email headers, logs and suspicious files before wiping or restoring devices. </li><li>Document every action with timestamps to support investigations.&nbsp;</li></ul><p>At this stage, companies may also have legal obligations. Financial institutions, health care providers and companies in other regulated industries must notify regulators and sometimes customers when certain types of data are exposed.</p><h3><strong>Employee level</strong></h3><p>Employees who think they’ve interacted with a scammer should immediately report the incident through official channels so that the response team can act quickly. Organizations should also have a playbook in place for them to follow, such as:</p><ul><li>Resetting their passwords</li><li>Enabling MFA on all critical accounts</li><li>Restricting use of the affected device until IT clears it</li></ul><h3><strong>Customer level</strong></h3><p>When customers or partners are affected, speed and transparency matters here too. Notify them quickly with clear instructions, such as resetting passwords, verifying recent activity or watching for follow‑on phishing attempts.&nbsp;</p><p>Additionally, provide access to support, such as identity monitoring or remediation services. Businesses should also report the scam to law enforcement agencies like IC3 to help with broader investigations and possible recovery of stolen funds.</p><h2>Your business might be more vulnerable than you think</h2><p>No business is 100% safe from online scams, regardless of your size or reputation. Even the world’s most sophisticated companies have been fooled. A Lithuanian fraudster impersonated a real hardware supplier and tricked tech giants into <a href="https://www.justice.gov/usao-sdny/pr/lithuanian-man-sentenced-5-years-prison-theft-over-120-million-fraudulent-business">wiring over $120 million</a>using forged invoices and email look-alikes. He later pled guilty and was sentenced in the United States to five years in prison.</p><p>Today, AI-assisted tools also make it easier to hack both systems and people. They can <a href="https://www.euronews.com/next/2025/05/01/how-long-does-it-take-a-hacker-to-crack-one-of-your-passwords-in-2025">instantly crack numeric, eight-character</a>passwords and impersonate beloved grandchildren or trusted community leaders. Remote work and reliance on vendors can also introduce risks, but even companies with centralized distribution chains and in-person staff can suffer breaches.</p><h2>Industries facing the highest risks of cyber scams</h2><p>Some companies face far greater risks than others, not due to any fault of their own, but because of their industries. They are both highly regulated by government agencies and highly sought after by hackers — usually for the same reason. These organizations process highly sensitive data or may provide access to critical infrastructure.</p><h3><strong>Financial services</strong></h3><p><a href="https://www.gendigital.com/blog/insights/reports/threat-report-q1-2025">Gen Q1/2025 snapshot</a> highlights a surge in phishing and personal-data exposure. Payment flows, wire transfers, consumer PII/PCI and high-value accounts are irresistible to hacking groups. Trends include business email compromise, invoice manipulation, deepfake CEO/CFO voice calls and urgent invoices timed to quarter-end pressure.&nbsp;</p><h3><strong>Insurance</strong></h3><p>Carriers and brokers hold rich identity datasets (SSNs, claims, medical and property details) that enable takeovers, synthetic identities and policy-payout fraud. Scammers use this information to create even more convincing communications or to get assets, services and credit based on stolen personal identities and insider business information.</p><h3><strong>Telecommunications providers</strong></h3><p>Telecom providers sit at the center of account access (SIM swaps, number ports, one-time codes). Attackers phish employees and customers to facilitate account takeovers, then pivot to bank or cloud accounts. <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q1-2025">Gen Q1 2025 report</a> found that mobile-centric fraud and phishing growth are key ingredients for telco-enabled attacks.</p><h2>Build a multi-layered defense plan for your organization</h2><p>Every organization needs a layered plan to protect against and respond to the growing threat of cyber scams. Effective plans include coordination across multiple layers, such as people, governance, tools and physical security. Customers — especially in financial services, insurance and telecommunications — benefit from added checks and clear communication when risks arise.</p><p>Gen can reinforce these efforts. Norton and Avast are some of our consumer brands that help block scams, detect new threats and support identity recovery. Businesses can partner with us to provide these tools as employee benefits, while regulated industries can extend protection to customers for greater trust.</p><p>Investing in tools and knowing how to avoid cyber scams is just the first step. The next is vigilance. Building a culture that prioritizes security awareness and proactive defense makes scams less effective and less costly.&nbsp;</p><p>Are you ready to transform the way you protect your organization from online scams? <a href="https://www.gendigital.com/us/en/partner/">Schedule a call today</a> to learn how Gen can help protect your employees and customers.</p>

Practical strategies to spot, prevent, and respond to online scams across industries

How to recognize and avoid cyber scams in your industry

<p dir="ltr">Statista estimates that technology scams will cost the United States&nbsp;<a href="https://www.statista.com/topics/1731/smb-and-cyber-crime/#topicOverview">$639 billion in losses</a> by the end of 2025. This might seem like a threat to the Fortune 500s. In fact, many small businesses often believe criminals are less likely to target them, but hackers are increasingly exploiting this false sense of security. In fact, a recent survey found that&nbsp;<a href="https://www.hiscox.com/documents/Hiscox-Cyber-Readiness-Report-2023.pdf">41% of small businesses</a> had suffered attacks in 2023.</p><p dir="ltr">One of the biggest threats comes from the malicious actors who weaponize generative AI to scale and personalize cyberthreats. From polished emails with flawless grammar to deepfake videos spoofing your company’s executive, technology scams have reached new heights. Other factors contributing to the rise include leaner IT teams, reduced investment in training and remote work.</p><p dir="ltr">The good news is that recognizing these many technology scams takes you one step further to understanding how they work and succeed. Leverage this information for better threat modeling at your organization to avoid common online scams.</p><h2 dir="ltr">Business email compromise (BEC): the most costly business scam</h2><p dir="ltr">Business email compromise is a targeted cyber scam where criminals impersonate an executive, vendor or partner. The goal is to trick someone into sending money, transferring sensitive information or sharing login credentials. The FBI calls it the “<a href="https://www.ic3.gov/PSA/2024/PSA240911">$55 billion scam</a>” and issued a Public Service Announcement regarding BEC in September 2024.</p><h3 dir="ltr">Common tactics</h3><p dir="ltr">BEC is an example of social engineering and the use of a trusted person can cause many people to let their guards down. Understanding how it works can help workers avoid common online scams like these:</p><ul><li dir="ltr"><strong>Executive impersonation (including deepfakes): </strong>Attackers can impersonate a CEO or CFO via email, phone or video. One deepfake red team organized an authorized attack against a North American finance company using deepfake audio and&nbsp;<a href="https://breacher.ai/blog/case-study-deepfake-voice/">56.25% of users</a> clicked on the link.&nbsp;</li><li dir="ltr"><strong>Domain spoofing: </strong>Scammers often slightly alter domain names to create look-alike addresses that can trick users. However, sometimes they do use genuine company emails after hacking into them.</li><li dir="ltr"><strong>Password reset: </strong>Workers or even customers might receive fake emails warning that they need to verify or reset their passwords due to someone else allegedly hacking into their accounts.&nbsp;</li></ul><h3 dir="ltr">Why it works</h3><p dir="ltr">These tactics tend to work because of the many factors that can lead to human error in modern organizations. Teams are becoming leaner and workers are increasingly overwhelmed by work requests and the volume of emails. This makes it easier to miss key details. Hackers are also getting better at spoofing not just the domain name but lookalike websites.</p><h3 dir="ltr">Actionable tips</h3><p dir="ltr">CISOs must account for the human element in these situations and create an effective playbook response. Specific security tools you can also implement include MFA and email threat scanners like the AI-powered Norton Genie.&nbsp;<a href="https://www.gendigital.com/blog/news/company-news/ai-policy-2024">Our experts found</a> that,</p><p dir="ltr">“AI-powered threats often require AI-powered safeguards and we’re increasingly incorporating these tools into our efforts to provide the best possible protection to consumers around the globe.”</p><h2 dir="ltr">Phishing attacks: more sophisticated than ever thanks to AI</h2><p dir="ltr">Phishing is another social engineering tactic at scale. Cybercriminals use messages that impersonate trusted brands or colleagues to steal credentials, payment data or multi-factor codes. They might also use it to deploy malware or as the first step of a ransomware plot.</p><h3 dir="ltr">The role of artificial intelligence</h3><p dir="ltr">Generative AI helps malicious actors craft increasingly convincing messages and emails for scams targeting businesses. They can also use deepfakes to impersonate the voice of anyone from family members to business executives and politicians.&nbsp;<a href="https://newsroom.gendigital.com/2025-05-28-Q1-2025-Gen-Threat-Report-Reveals-AI-Driven-Scams-Redefining-Cybercrime">Gen Q1 2025 report</a> found that,</p><p dir="ltr">“In one of the most striking evolutions of this type of scam that we observed this quarter, attackers are using AI-generated personas, deepfake influencers and hired actors.”</p><h3 dir="ltr">Types of phishing&nbsp;</h3><p dir="ltr">Phishing scams continue to grow in complexity and effectiveness. These are some of the most common ones to include in security training at your organization:</p><ul><li dir="ltr"><strong>Email phishing: </strong>Bulk or targeted emails driving to fake login pages or malware</li><li dir="ltr"><strong>Malware phishing: </strong>Malware planted in seemingly benign things like an “unsubscribe” link</li><li dir="ltr"><strong>Spear phishing: </strong>Messages created to target specific workers or types of workers, such as fake resumes for HR or fake invoices for the AP team</li><li dir="ltr"><strong>Whaling: </strong>Phishing scams aimed at the “big fish” in an organization, such as a celebrity or executive</li><li dir="ltr"><strong>Smishing:&nbsp;</strong>Phishing that takes place via SMS, such as failed deliveries or MFA code theft</li><li dir="ltr"><strong>Vishing: </strong>Voice calls often enhanced with AI that pose as IT, vendors or even your bank</li></ul><h3 dir="ltr">Why it matters</h3><p dir="ltr">Phishing is often the entry point for account takeovers, like ransomware and lockouts. The more access attached to the account they take over, the better results, which is why whaling has become so popular.</p><h3 dir="ltr">Actionable tips</h3><p dir="ltr">Simulations can provide teachable moments for workers to recognize phishing scams, but take care not to shame people for falling victim. The goal is to make them more vigilant, not more afraid to report incidents. Email scanning from&nbsp;<a href="https://us.norton.com/feature/ai-scam-protection">Norton Genie</a> can also assist with email-based phishing scam prevention. Finally, segmented admin privileges and mandatory MFA can improve your security posture.</p><h2 dir="ltr">Ransomware attacks: holding business data hostage</h2><p dir="ltr">Ransomware is malware that encrypts files or systems and demands payment for a decryption key. It’s often paired with “double extortion,” which generally involves threatening to leak stolen data even if you restore from backups. Beyond phishing, hackers might also exploit software vulnerabilities, misconfigurations, unchanged default admin passwords, unsecured remote access or even compromised suppliers.</p><h3 dir="ltr">Why it matters</h3><p dir="ltr">A single incident can paralyze operations for weeks and trigger regulatory scrutiny, lawsuits and lasting brand damage. The healthcare sector’s recent experience illustrates the stakes. The Change Healthcare ransomware incident (at UnitedHealth’s tech unit) disrupted claims nationwide and ultimately affected millions of people. It also illustrated that hackers often do not keep their work, even after receiving&nbsp;<a href="https://energycommerce.house.gov/posts/what-we-learned-change-healthcare-cyber-attack">$22 million in Bitcoin</a>.</p><h3 dir="ltr">Actionable tips</h3><p dir="ltr">Companies should make regular backups and have contingency plans to conduct operations while the IT team gets the system up and running. Regular backups stored safely on different networks makes it easier to simply restore data and resume operations. Preventative measures include patch management, least privilege, segmentation and data minimization.</p><h2 dir="ltr">Tech support scams: preying on employee trust</h2><p dir="ltr">Tech support scams impersonate IT staff, Microsoft, your security vendor or “payment processors.” They trick employees into installing remote-access tools, changing MFA settings or paying for bogus support. Attacks arrive via phone (vishing), email, chats, pop-ups or fake browser update prompts. Again, hackers leverage AI here to write error-free and polished emails or generate convincing scripts.</p><h3 dir="ltr">Expected outcomes</h3><p dir="ltr">Paying for bogus support is probably the best-case scenario from all the potential outcomes. The worst-case is potentially providing admin-level access to malicious actors, which could spiral into data breaches and ransomware. Hackers could also empty out the company’s bank account if they gain access to the right credentials.</p><h3 dir="ltr">Actionable tips</h3><p dir="ltr">CISOs must follow&nbsp;cybersecurity best practices, like banning the sharing of passwords or MFA codes over phone, email or chat. Additionally, you may remove local admin rights and require approval before making system changes. Call-back and ticket-number verifications are also crucial for leaving an audit trail.</p><h2 dir="ltr">Invoice and payment scams: manipulating financial workflows</h2><p dir="ltr">Criminals often pose as vendors sending invoices or requesting updated banking information to send payment. Tactics may range from claiming amounts so small that businesses pay them without thinking to claiming large figures that trick people into opening malware-infested files to see the details.</p><h3 dir="ltr">Why they are so effective</h3><p dir="ltr">Invoice fraud and payment scams are incredibly effective because unpaid invoices impact a company’s bottom line, credit history and business relationships. Additionally, in large organizations, a stray invoice is believable because no one person can remember every vendor. There is at least some good news in this area. Gen experts found a&nbsp;<a href="https://www.gendigital.com/blog/insights/reports/threat-report-q1-2025">decline in invoice scams</a> from Q4 2024 to Q1 2025.</p><h3 dir="ltr">Red flags</h3><p dir="ltr">Regardless of how convincing they might be, informed and vigilant workers can learn how to&nbsp;avoid common online scams if they know the warning signs:</p><ul><li dir="ltr">Urgent requests to make payments at risk of legal action or other severe consequences</li><li dir="ltr">Unusual amounts that are either much lower or much higher than normal invoices from vendors</li><li dir="ltr">Request to speak to them directly instead of reaching out to your point of contact at the vendor</li><li dir="ltr">Even slight domain or display-name mismatches</li><li dir="ltr">Requests to bypass normal approvals steps to “meet a deadline”</li></ul><h3 dir="ltr">Actionable tips</h3><p dir="ltr">You can reduce human error proactively by automating some tasks, such as AP processing. Additionally, you can create a master list of vendors and their contact information so that the AP team can verify suspicious requests without opening files. Companies have also seen success with dual approvals for payments and teaching AP/AR teams to verify every invoice before paying.</p><h2 dir="ltr">Stay vigilant, stay protected</h2><p dir="ltr">The threat landscape has seen drastic shifts in the past few years, especially with the rise of generative AI and deepfakes. Email-driven scams continue to drive record losses for&nbsp;<a href="https://www.gendigital.com/media/qcymrc1i/2023-ncsir-us-global-report_final.pdf">organizations and individuals</a> alike. Staying current on common technology scams and refreshing defenses is now a business requirement and not another nice-to-have security bonus.</p><p dir="ltr">Here’s what to do if you suspect a security incident is currently underway:</p><ul><li dir="ltr"><strong>Stop the bleeding b</strong>y isolating affected devices and accounts (or more specific solutions like pausing payments for invoice scams).</li><li dir="ltr"><strong>Preserve all the evidence </strong>you currently have by saving emails, headers, logs and screenshots.</li><li dir="ltr"><strong>Report the incident </strong>to relevant authorities, such as your bank, your regulatory body and even your customers.</li><li dir="ltr"><strong>Comply with regulations </strong>to ensure you follow any requirements set by jurisdictions or industries governing certain demographics (e.g. GDPR in the EU or HIPAA in the US).</li><li dir="ltr"><strong>Conduct a thorough investigation </strong>to unearth more evidence and determine what went wrong.</li><li dir="ltr"><strong>Reset </strong>to close the gaps and reduce the risks of this happening again.</li><li dir="ltr"><strong>Educate your workers </strong>(without shaming) to avoid another incident related to human error, if this was the cause of the problem.</li><li dir="ltr"><strong>Reassure your stakeholders,</strong> which may include shareholders, customers, vendors, government agencies and the general public</li></ul><h2 dir="ltr">How Gen solutions support scam prevention</h2><p dir="ltr">Effective scam prevention for businesses requires both technology and people-led initiatives. You need layered controls and steady education to tackle both layers. Gen research underscores the breadth of AI-related risks and the role of employee awareness training as a defense strategy.</p><p dir="ltr">Use our AI-powered tools to protect employees through benefits programs that put cyber safety in their hands:</p><ul><li dir="ltr"><a href="https://us.norton.com/products/norton-360"><strong>Norton 360</strong></a><strong>:&nbsp;</strong>Helps block malware and phishing, adds smart firewall and web protection for safer browsing on work-adjacent devices</li><li dir="ltr"><a href="https://www.avast.com/en-us/index#mac"><strong>Avast Business</strong></a><strong>:</strong> Endpoint and network protection that can help prevent ransomware and malware from gaining a foothold</li><li dir="ltr"><a href="https://lifelock.norton.com/"><strong>Norton LifeLock Benefits Solutions</strong></a><strong>:</strong> Identity theft protection that monitors for misuse of personal data and provides restoration specialists if the worst happens, reducing downtime and stress after an incident</li></ul><p dir="ltr">How will your organization protect its workers from technology scams this year?&nbsp;<a href="https://www.gendigital.com/us/en/partner/employee-benefits/employers/">Schedule a call with our team</a> to decide what employee benefits best suit their needs.</p>

How cybercriminals exploit businesses and what you can do to stop them

The most common technology scams targeting businesses

<p>Your smartphone isn’t just a device — it’s your digital life in your pocket. It holds your identity, finances, messages, photos and connections. And that’s exactly why it’s one of the most valuable targets for scammers today.</p><p>As attacks grow more sophisticated, your phone has become both the key to convenience and the key that criminals want most. Working with our partners at the <a href="https://www.idtheftcenter.org/" title="idetheftcenter.org" target="_blank">Identity Theft Resource Center</a> (ITRC), we’re sharing what you can do to stay ahead.</p>

<h2><strong>1. Why smartphones are under attack</strong></h2><p><strong>Everything in one place.</strong><br>Your phone holds it all — emails, banking apps, social media, passwords, and even the codes that protect your accounts. If a scammer gains control, they can do more than compromise a single login — they can unlock your entire digital life.</p><p><strong>Always on, always connected.</strong><br>Smartphones travel with us across networks —<a href="https://us.norton.com/blog/privacy/public-wifi" title="Norton Blog: Public Wi-Fi" target="_blank"> public Wi-Fi</a>, Bluetooth, cellular. That constant connectivity expands your exposure and gives scammers more opportunities to strike.</p><p><strong>Built on trust.</strong><br>We trust what our phones show us: texts, pop-ups, alerts, and notifications. Scammers exploit trust by blending into the everyday experiences we rely on — an “account locked” text, a “package delivery” notice, a security alert that feels routine.</p><p><strong>The SIM factor.</strong><br>Many accounts still tie security codes to your phone number. Through <a href="https://us.norton.com/blog/mobile/sim-swap-fraud" target="_blank" title="Norton Blog: SIM Swapping">SIM swapping</a> or “port-out” scams, attackers can hijack that number, intercept authentication codes, and reset passwords — all without needing access to your phone itself.</p><p>That’s why your phone isn’t just a target. It’s a launchpad for deeper compromise across your entire online footprint.</p><p>&nbsp;</p><h2><strong>2. Common mobile scam tactics (and how they work together)</strong></h2><p>Scammers don’t just pick one tactic anymore — they blend them for maximum impact. Below are some of the most popular mobile scam tactics.&nbsp;</p><p><strong>Robocalls and spoofed caller IDs</strong><br>You get a call that looks local — maybe even familiar. The caller claims to be from your bank, a government office, or a tech support line. The goal? To pressure you into sharing information or taking immediate action.</p><p><strong>Smishing (SMS phishing)</strong><br>Text messages that look urgent — “Your account is locked,” “Confirm delivery,” “Claim your refund” — push you to click links or respond. Those links often lead to fake login pages designed to steal your information or install <a href="https://www.avast.com/c-malware" target="_blank">malware</a>.</p><p><strong>SIM swaps and number hijacking</strong><br>By posing as you, scammers convince your carrier to transfer your phone number to a new SIM card. Once they control it, they can intercept calls, messages, and even two-factor authentication codes.</p><p><strong>Fake or malicious apps</strong><br>Some apps disguise themselves as harmless tools — a flashlight, photo editor, or game — but quietly request access to your contacts, camera, or text messages. Others are clones of legitimate apps that install malware when downloaded.</p><p><strong>Voice phishing and deepfake Audio</strong><br>With generative AI, scammers are now using cloned voices or synthetic recordings to<a href="https://us.norton.com/blog/emerging-threats/what-are-deepfakes" target="_blank"> impersonate people you know</a> — or authority figures you’d normally trust. A familiar-sounding voice asking for a “quick favor” can be enough to trick even the cautious.</p><p><strong>“One-Ring” and callback scams</strong><br>You see a missed call from an unknown or international number. Calling back connects you to premium-rate lines or automated systems designed to keep you on the line — and charge you for it.</p><p>Often, these scams overlap — a fake app might prompt an SMS confirmation, or a <a href="https://us.norton.com/blog/emerging-threats/smishing" target="_blank">smishing message</a> might direct you to a malicious download. The goal is to create a believable chain of trust that leads to compromise.</p><p>&nbsp;</p><h2><strong>3. Red flags that something’s off</strong></h2><p>Keep an eye out for these warning signs:</p><ul><li>Unsolicited calls or texts demanding immediate action</li><li>Messages with typos, poor grammar, or odd formatting</li><li>Links that don’t match official domains</li><li>Apps requesting permissions they don’t need</li><li>Alerts that your SIM or number is being activated elsewhere</li><li>Suspicious short codes or incomplete phone numbers</li><li>Caller IDs that mimic legitimate contacts</li><li>Offers or prizes that feel “too good to be true”</li><li>Pressure to act right away or risk losing access</li></ul><p>When in doubt, take a step back and verify directly through official websites, phone numbers, or apps.</p><p>&nbsp;</p><h2><strong>4. How to protect yourself</strong></h2><p><strong>Lock down your phone and mobile account</strong></p><ul><li>Use a <a href="https://www.avast.com/random-password-generator" target="_blank">strong passcod</a>e or biometric lock</li><li>Enable full-disk encryption</li><li>Ask your carrier to add a <strong>number lock</strong> or <strong>port freeze</strong></li><li>Use an authentication app instead of SMS-based codes whenever possible</li><li>Set a unique PIN or passphrase with your mobile provider</li></ul><p><strong>Harden apps and permissions</strong></p><ul><li>Download only from trusted app stores</li><li>Review app permissions regularly and remove unnecessary ones</li><li>Avoid sideloading or third-party app installations</li><li>Use <a href="https://us.norton.com/products/norton-360-for-mobile">mobile security software</a> to detect suspicious behavior</li><li>Delete apps you no longer use</li></ul><p><strong>Stay skeptical and verify</strong></p><ul><li>Don’t tap links in unexpected messages</li><li>Contact organizations directly through official channels</li><li>Block and report suspicious senders or numbers</li></ul><p><strong>Keep everything updated</strong></p><ul><li>Regularly update your operating system and apps</li><li><a href="https://us.norton.com/products/norton-vpn" target="_blank">Use a VPN</a>, like Norton, when on public wi-fi</li><li>Avoid connecting to unsecured networks</li><li>Back up your data securely so recovery is easy if something happens</li></ul><p><strong>Monitor and alert</strong></p><ul><li>Turn on alerts for SIM changes, new logins, and suspicious activity</li><li>Use identity monitoring tools, like<a href="https://lifelock.norton.com/" target="_blank"> LifeLock</a>, to spot leaked credentials early</li><li>Review bank and credit accounts regularly</li><li>Consider<a href="https://lifelock.norton.com/learn/credit-finance/credit-freeze" target="_blank"> freezing credit </a>if you notice unusual activity</li></ul><p>&nbsp;</p><h2><strong>5. If you think you’ve been targeted</strong></h2><ol><li><strong>Contact your carrier</strong> to freeze or reverse any SIM or porting requests.</li><li><strong>Change passwords</strong> and log out of all active sessions.</li><li><strong>Notify your bank or credit provider</strong> and request fraud protection.</li><li><strong>Report the incident</strong> to the Identity Theft Resource Center, the FTC, your state attorney general, or local law enforcement.</li><li><strong>Use identity restoration services</strong> to help clean up any fraudulent activity.</li><li><strong>Stay alert</strong> — scammers often follow up with new attempts after a successful breach.</li></ol><p>&nbsp;</p><h2><strong>Why this matters&nbsp;</strong></h2><p>At Gen, in collaboration with the Identity Theft Resource Center (ITRC), we’re tracking an unmistakable trend: <strong>mobile scams are scaling fast</strong> — powered by automation, AI, and social engineering that feels increasingly personal.</p><p>“At the Identity Theft Resource Center, we've seen firsthand the negative impact when a phone compromise leads to email account takeover, individuals being locked out of their social media accounts, or losing access to personal photos and documents,” said Mona Terry, COO &amp; Head of Victim Services at the Identity Theft Resource Center. “These attacks don't just steal money; they steal identities and peace of mind. That's why we're here. If you've been targeted, we provide free, one-on-one assistance to help you navigate recovery, secure your accounts, and reclaim your digital life.”</p><p>Your phone is now the front line of digital trust. Protecting it means protecting your identity, finances, and peace of mind.</p><p>&nbsp;</p>