Threat Intelligence Director

Explore Gen™ leadership perspectives and hear from industry experts talking about trending topics, the digital landscape, and the latest cybersecurity news.

Director of Threat Research & Applied AI

Leadership Perspectives

AI agents and assistants are here, and the industry is moving quickly to make them safer and protect against emerging threats. But without independent testing, how do we know those protections actually work? Gen initiated a collaboration with <a href="https://www.amtso.org/wp-content/uploads/2026/09/AMTSO_Guidelines_for_Testing_of_Agentic_Security_Products_FINAL_V1.0.pdf">AMTSO</a> to bring the industry together around independent testing standards for AI agent protection, resulting in the first industry standard for measuring the <a href="https://www.amtso.org/news/amtso-agentic-ai-guidelines-and-sandbox-llm-handling-paper-preprints-for-public-review/">safety of AI agents</a> and the products designed to protect them.<h2>Safety you cannot verify is just a promise.</h2>Early in 2026, our team started building protection for AI agents. It did not take long to notice something odd about the space we had walked into. Everyone agreed that the security of these systems mattered, but nobody could tell you how much of it there actually was.&nbsp;It reminded me of the old joke about connected devices: what does the S in IoT stand for? Security. There isn't one. To be fair, the joke no longer lands the same way for AI agents. Model vendors are shipping real safety work now, and some of them are good. But two other curves are climbing at the same time: attacks aimed at these systems, and damage caused by these systems. So, the problem is no longer that nobody is working on agent safety. The problem is that there has been no way to check any of it from outside. Every claim about how safe an AI agent comes from the same place the agent does.&nbsp;This September, that changed. The industry adopted its first guidelines for independently measuring the safety of AI agents and the products that protect them. This is the story of why it was needed and what it measures.<h2 class="text-align-justify">"Security is built in." We have heard that one before.&nbsp;</h2>Operating systems, browsers, mobile app stores, social networks. Each one reached a point where it told users that security was handled, built in, part of the platform. Each time, independent measurement found the gap between the claim and the experience, and each time that gap was where the harm to real people lived. We publish our own evidence on this twice a year. Our <a href="https://www.gendigital.com/blog/insights/reports/threat-report-h1-2026">H1 2026 Threat Report</a> and the&nbsp;<a href="https://fpi.gendigital.com/">Fearless Planet Index</a> exist because the honest answer to "is this platform safe" has always been a number, not a statement, and the number has always been more complicated than the statement.&nbsp;AI platforms are now at exactly that point in the cycle, and this time the claim is arriving faster than in any previous era. To their credit, some vendors publish their own figures. Anthropic did, for the safety layer in <a href="https://www.anthropic.com/engineering/claude-code-auto-mode">Claude Code</a>: it missed roughly one dangerous action in six. They called it “the honest number,” and it was. It was also measured on fifty-two examples, by the same people who built the thing being measured. That is not a criticism of them. Until now, the industry offered them no other option. The <a href="https://x.com/ClaudeDevs/status/2085794862608318627">mode</a> that number described was a preview in spring. By late summer it was the default.<h2 class="text-align-justify">Measure the platform first&nbsp;</h2>The first thing to measure is not a security product. It is the platform itself. An AI agent has a safety baseline of its own: what it refuses, what it questions, what it does without asking. That baseline is the floor everyone else builds on, and it has never been measured by anyone outside the company that ships it. The second thing to measure is whatever raises that floor. In that order because you cannot judge the second without knowing the first.&nbsp;Picture an agent booking a hotel for you.&nbsp;The hotel page contains hidden instructions telling the agent to ignore your request and follow someone else’s. You cannot see them, but the agent can.&nbsp;Whether your agent follows them is the whole question, and until now nobody has measured the answer.&nbsp;Existing test methods cannot simply be reused here. Classic threat detection is deterministic. There is a file, there is a verdict, and anyone can reproduce it. An attack on an AI agent is not a file. It exists only in the interaction, and the same attack tried twice can produce two different outcomes. A method built for files has nothing to grip.&nbsp;Getting to a workable methodology also meant settling questions the industry had never had to answer together. Harm counts even when there is no attacker: an agent that deletes the wrong thing or sends personal data to the wrong place because it misread the task, has harmed the user just the same. Consumer systems count as much as enterprise ones, because agents already run inside browsers, phones and everyday tools, and those settings carry risks a corporate network does not. And how a protection layer is wired into the agent changes what it can see, so two products with the same headline score can be doing entirely different jobs.&nbsp;<h2 class="text-align-justify">A lock or good manners?</h2>There is one design question underneath all of this that the industry has not settled. Should the attack be allowed to reach the model at all?&nbsp;Most protection today works by letting the model see the hostile content and trusting it to behave. That should be the fallback, not the default. Once hostile content is inside the model's context, everything that follows is a judgement made by a system that has already been shown the attack. Nothing after that point is trustworthy in the way a lock is trustworthy.&nbsp;When you test an attack against an agent, there are four possible outcomes. It never reached the model. It reached the model, and the model declined. Someone noticed and did not stop it. Nobody noticed. Most safety claims today do not distinguish between the first two, and yet they are the difference between a lock and good manners. A single number that covers both cannot tell you which one you have. The new methodology records them separately. It also separates noticing an attack from stopping it, and it treats blocking legitimate work as its own kind of failure, because a protection layer that gets in the way of the task is one users switch off. Published vendor claims get recorded too, and then marked as confirmed, unconfirmed or contradicted.&nbsp;And there is the part nobody in this field likes to say out loud. These systems are not deterministic. They are getting better, quickly, and they will keep getting better. They will also keep giving you a slightly different answer to the same question. Would you accept a lock that works nine times out of ten? A protection layer for an AI agent runs thousands of times a day. The tenth time is not a rounding error; it is somebody's data.&nbsp;<h2 class="text-align-justify">From one internal thread to an industry standard</h2>This did not need another vendor framework. It needed the vendors and the testers in the same room, agreeing on rules both sides could live with. That is what AMTSO has done since 2008, and it is why the work went there rather than into a Gen white paper.&nbsp;Gen initiated it. It started in an internal thread about where the industry was heading, and one of us said the obvious thing: somebody independent should be measuring all of this. Including us. Under the AMTSO AI Security Working Group, with testing organizations and vendors from across the industry, the first version went from that conversation to an adopted, published standard in a couple of months. For a standards body, that is fast.&nbsp;We have been building in this space since the start of the year: AI Agent Protection in Norton and Avast, <a href="https://github.com/gendigitalinc/sage">Sage</a> released as open source for the community, and <a href="https://github.com/gendigitalinc/aarts">AARTS</a> and<a href="https://www.gendigital.com/blog/news/company-news/ai-agent-trust-hub-standards"> Skill IDs</a> published as open standards anyone can implement. More is coming soon. And because a call for measurement carries little weight from someone unwilling to be measured, our intention is clear. When independent evaluations built on this standard start running, we want our own products on the list.&nbsp;<h2 class="text-align-justify">Measured, not announced&nbsp;</h2>I do not want AI to be a thing people are afraid of. I also do not want it to be a thing people believe on faith. It should make life better, and for tens of millions of people it already does. What is missing is trust, and trust is not something a company can announce.Being fearless about AI doesn’t mean trusting it blindly or ignoring its risks. It means understanding those risks, measuring them and building the protections that give people the confidence to use it.Every previous era of computing learned this the same way: the claim comes first, the measurement comes later, and the gap between them is paid for by users. This time the measurement is arriving early. That is the whole point of it.

Gen is leading the industry to develop the first standardized benchmarks for AI protection

Your AI agent is safe. Says who? 

Security Evangelist at Gen

I am more afraid of a malicious person with a powerful AI system than I am of AI suddenly deciding, on its own, to harm us. AI does not need bad intentions when the person using it already has them. That view comes from more than 25 years I’ve spent studying malware, scams and the way criminals adapt to new technology. The tools keep changing, but greed, power, revenge and ideology remain. AI gives those motives an inexpensive way to turn intent into action at a scale we have not seen before.This does not make autonomous AI risk imaginary. Systems can misinterpret goals, bypass weak controls or take actions their creators did not expect. Recent security evaluations give us good reasons to take that possibility seriously. My concern is about emphasis. The public debate often jumps to focus on a machine developing its own hostile intent, while ignoring the fact that people are already &nbsp;using AI to make fraud, manipulation and cyberattacks cheaper and more effective.<h2>Powerful tools inherit human intent</h2><a href="https://www.iaea.org/topics/nuclear-technology-and-applications">Nuclear science</a> is the clearest historical comparison for me. It can generate electricity and support medicine, agriculture and scientific research. It also enabled weapons capable of destroying entire cities. The discovery did not arrive with one moral purpose. What followed depended on what people built, who controlled it and the limits society imposed.We have seen the same dual use with the internet and cryptography. The internet connected billions of people and also created a global attack surface. Strong encryption protects banking, health records and private communication, while criminals use it to hide their operations. This does not mean technology is neutral in its effects. Design choices and access rules shape outcomes. It means a ban on the underlying capability is usually a crude response to a problem rooted in how people apply it.AI also inherits something from us before anyone types a prompt. Large language models are trained largely on human-produced text, code and other material. In that sense, they learn not only from what we know, but from a record of who we are, including how people persuade, deceive, evade controls and cause harm. Training and post-training allow models to combine and generalize that knowledge in new ways, so they are not simply repeating their source material. But much of the playbook still comes from us. The human element appears in the knowledge used to build the model, the decisions governing its deployment and the intent of whoever puts it to work.AI adds something genuinely new to this pattern. It can combine language, reasoning, code and tools in one system, then operate at machine speed. A person with limited expertise can use it to research a target, draft convincing messages, translate them and automate parts of a campaign. A more capable attacker can accelerate vulnerability research or make sense of stolen data.&nbsp;<h2>AI gives attackers more leverage</h2>In threat research, I have watched criminals move toward anything that reduces effort and increases their return. AI offers both. It can personalize phishing, remove the language errors that once exposed a scam, clone a trusted voice and adjust social engineering while a campaign is running. Attackers no longer need to choose as sharply between scale and personalization.People do not need AI to become malicious. We already lie, steal, manipulate, intimidate and exploit one another. What AI changes is the amount of skill, time and money required to do it. A person who once had the intent but not the capability can now borrow that capability from a machine.Until now, many forms of harm have had natural limits. A scammer could only write so many convincing messages. An impersonator needed the right language skills. A criminal researching a victim had to spend time piecing together information. AI erodes those limits. It can help one person research thousands of targets, tailor a different approach to each of them and communicate convincingly across languages, cultures and channels. The malicious intent is human, but its reach no longer has to be limited by human capacity.The danger also goes far beyond better phishing emails. AI can be used to manufacture evidence, impersonate people we trust, create convincing voices and images, identify vulnerable targets, analyze stolen information and automate parts of an attack. It can make manipulation feel personal even when it is being produced on an industrial scale. AI did not invent personalized manipulation, but it makes that combination cheaper, faster and more convincing.I worry that the debate focuses too narrowly on whether AI itself becomes malicious. We do not have to wait for a machine to develop bad intentions. There are already people with bad intentions who are eager to give machines instructions.The AI agent also becomes a target. <a href="https://www.gendigital.com/blog/insights/research/infostealers-your-ai-agent">Research from our team</a> found information stealers collecting access tokens, credentials in Model Context Protocol configurations, prompt histories and project data from AI-assisted development tools. A criminal who steals an agent's context may learn what its user is working on, what services the agent can reach and how to make malicious activity look legitimate. That can be more useful than stealing a password in isolation.&nbsp;My greatest concern is what happens when AI is put in the hands of people who already understand how to cause serious harm. Well-resourced criminal groups or state operators already have the motive and expertise. AI can help them research faster, experiment more cheaply, analyze more information, make their deception more convincing and adapt their operations as defenders respond.Defenders operate under rules, approval processes and legal obligations. Attackers do not. Safety controls in mainstream AI products are essential, but the adversaries we most need to constrain are also the most willing to probe those controls, combine multiple systems, modify models or seek out tools with fewer restrictions.<h2>Autonomous failures remain real</h2>Human misuse is my main concern, but of course there are other important issues at stake. In July 2026, AI models operating in OpenAI's cybersecurity evaluation environment circumvented controls intended to keep them off the internet. According to <a href="https://openai.com/index/hugging-face-incident-and-the-road-ahead/">OpenAI's account</a>, they used unauthorized channels and compromised parts of OpenAI's research infrastructure and Hugging Face. Anthropic later described <a href="https://www.anthropic.com/news/investigating-three-incidents-in-our-cybersecurity-evaluations">three incidents</a> in which Claude models reached the internet from evaluation environments and accessed real systems. Nobody had instructed the models to attack those organizations.These events happened during controlled testing, and OpenAI's case involved reduced safeguards. They do not show conscious machines choosing to do evil. They show something more ordinary and operationally serious: a system with a goal, tools and permissions can take harmful steps that nobody explicitly requested. Once an agent has credentials and network access, a mistaken or poorly aligned objective can travel.Human decisions still create the conditions for that failure. People and organizations design the system, set its objectives, grant its permissions and decide which safeguards stand between an unexpected action and a real-world consequence. Responsibility should follow the authority and control held at each stage. Autonomy cannot become an accountability loophole, but neither should it allow providers to transfer every consequence to the person using the agent. Once deployed, however, an autonomous system can still carry the damage faster and further than any of those people intended. Malicious use and autonomous failure can also reinforce each other. An attacker can deliberately manipulate an agent through the information it consumes, while an ordinary user can cause damage by giving the same agent too much access.<h2>A pause only works if it can be verified</h2>Should the major AI laboratories slow down? In some areas, yes. If a system can defeat its sandbox, conceal consequential actions or reach unrelated external systems, its release should wait. Dario Amodei has <a href="https://darioamodei.com/post/we-must-pace-the-frontier">argued for pacing frontier development</a> so that safeguards and independent evaluation have time to catch up. I agree with that principle. I am less convinced that an agreement among a handful of companies can stop the race.AI is a strategic capability. Even if the largest American laboratories agreed to pause, other companies, open-weight communities and state-backed programs could continue. China deserves particular attention because it has the resources and strategic incentive to compete at the frontier. We should still be precise. China joined the United States and other countries in signing the <a href="https://www.gov.uk/government/publications/ai-safety-summit-2023-the-bletchley-declaration/the-bletchley-declaration-by-countries-attending-the-ai-safety-summit-1-2-november-2023">Bletchley Declaration</a>, so it would be wrong to claim that dialogue is impossible. A declaration, however, is not a verifiable restriction on model training, access to compute or military use.The central problem is verification. Training can happen behind closed doors, military applications may remain secret, and governments on every side have incentives to defect if they believe a rival is gaining an advantage. A pause observed only by responsible actors could leave the world with the same race, led by participants whose practices are less transparent and whose incentives are harder to influence. That could increase the risk.China is not the only complication. Model weights can be copied, computing power can be rented across borders, research spreads quickly and criminal markets do not sign safety declarations. A company pledge can improve safety inside that company, which is valuable. It cannot substitute for international rules, technical verification and controls aimed at the capabilities that could cause the most harm.<h2>What I would stop</h2>I would not stop AI research or ordinary uses that help people. The benefits in medicine, science, education, accessibility and cybersecurity are real, and a blanket ban would be both undesirable and nearly impossible to enforce. I would stop the deployment of systems that fail specific safety thresholds. This is how security works: isolate the dangerous component, understand the failure, fix the controls and test it again.An agent that cannot remain inside its sandbox, respect permissions, record consequential actions or be reliably cut off should not operate with real accounts. If a model materially lowers the barrier to severe cyber or biological harm and its controls cannot be independently verified, access should remain restricted until that changes. Technical progress does not create an automatic right to deployment.The nuclear comparison is useful here too. Society did not apply the same rules to a medical isotope facility, a power plant and a nuclear weapon. It built different levels of access, monitoring and inspection around the risk. That regime is imperfect, but the principle is sound. An AI writing assistant and an autonomous cyber operator should not face the same requirements.After more than 25 years in cybersecurity, I value internal testing without confusing it with independent validation. AI laboratories should give qualified external evaluators enough access to test the complete system, including the model, tools, memory, credentials, sandbox and logs. A product claim is not a safety certificate.<h2>&nbsp;What responsible deployment requires</h2>&nbsp;We need to focus much more attention on the people and organizations deciding how these systems are built, deployed and used. Agents should only receive access to what’s required for the current task. Consequential actions should require confirmation, credentials should expire quickly, and people need a reliable record of what an agent did and an immediate way to revoke its access. These controls help whether the danger comes from a malicious operator or from unintended AI behavior.I remain more afraid of a person with bad intentions and powerful AI than of a machine spontaneously becoming malicious. History gives us too many examples of human beings turning useful discoveries into weapons. AI raises the stakes because it can scale human intent and continue acting after direct oversight fades.We should not anthropomorphize the threat to the point that we overlook the human role. An AI system does not need to experience greed, hatred, revenge or a desire for power. A person with those motives can give it an objective and the access needed to act, while the machine adds speed, knowledge and reach.AI development will continue, and human ambition, competition and malice will remain part of the race. Our responsibility is to prevent those forces from gaining unchecked power through systems we cannot understand, monitor or contain.

Why malicious use worries me more than machines acting alone 

The Most Dangerous Part of AI Is Still Human 

Chief AI & Innovation Officer

Last week, Gen joined more than 100 technology, cybersecurity and infrastructure companies, including Google, Microsoft, OpenAI and Anthropic, in calling for stronger collective cyber defenses before AI-powered attacks become dramatically more widespread and sophisticated. Gen is proud to be part of that effort; we also bring a distinct perspective to it.As a global leader in consumer Cyber Safety, Gen protects nearly 500 million people around the world through brands including Norton, Avast, LifeLock, and MoneyLion. We see what cyber risk looks like not only inside enterprises, but in the everyday digital lives of individuals and families. That matters because the AI cyber challenge will not stop at the enterprise boundary.The same forces highlighted in last week’s open letter will increasingly reach consumers, and consumers have far fewer resources to defend themselves.The letter makes three important calls to action: the security status quo will not be enough, defenders need access to powerful AI, and cyber defense has to become a collective effort. We strongly agree. And we believe consumer Cyber Safety needs to be a central part of that collective defense.&nbsp;<h4>The status quo will not be enough for consumers either</h4>Historically, sophisticated cyberattacks required expertise, time and money. That naturally concentrated attackers on higher-value targets.AI changes the economics. Attackers can increasingly automate research, personalize phishing, generate convincing text and images, clone voices, translate scams across languages and adapt attacks to individual victims at very low marginal cost.Sophistication is also becoming commoditized. That means attacks that once made economic sense primarily against enterprises or high-value individuals can increasingly be aimed at anyone. At Gen, we already see attackers moving closer to the systems and relationships consumers trust. Our latest threat research shows attacks increasingly hiding inside booking platforms, messaging conversations, legitimate accounts, software workflows and AI agents operating with permissions users themselves granted.For consumers, cybersecurity therefore has to evolve. Stopping malware remains essential. But Cyber Safety increasingly has to help answer much more fundamental questions: Is this person real? Is this message authentic? Can I trust this website? Should this AI agent have access to this information? Should this action be allowed to happen?Trust itself is becoming part of the security perimeter.&nbsp;<h4>Powerful defensive AI has to reach the consumer too</h4>The open letter calls for cyber-capable AI to be placed in the hands of defenders, and we strongly support that goal, but we should define “defender” broadly.A defender can be a security professional protecting a hospital, government agency or data center. It can also be technology protecting a parent from an AI-generated impersonation scam, stopping malicious code before an AI agent executes it, or preventing an autonomous agent from sending credentials somewhere it should not.Consumers cannot suddenly become cybersecurity experts simply because AI makes attacks more sophisticated. The technology has to do more of the defending for them.That is precisely why Gen began rolling out the Agent Trust Hub (ATH) earlier this year. ATH is designed as an independent security and trust layer around increasingly autonomous AI. It can evaluate agent capabilities before they run, observe agent behavior during execution and help stop dangerous actions in real time.We have since expanded that architecture through technologies including Sage, Agent Detection and Response, VPN for Agents, Norton AI Agent Protection and AARTS, our open standard for AI agent runtime safety.The goal is straightforward: protect consumers at the points where AI risk actually emerges, from the tools an agent uses to the commands it executes, the data it accesses and the networks it connects to. AI increasingly has to help defend us from AI.&nbsp;<h4>We need to prepare before emerging capabilities become common threats</h4>The urgency in the letter is important because AI capabilities are advancing extraordinarily quickly.Recently, OpenAI released detailed findings from a security incident involving OpenAI and Hugging Face infrastructure. During cybersecurity evaluations, highly capable experimental agents circumvented sandbox controls, found ways to reach the internet, exploited vulnerabilities and established unauthorized ways to communicate. OpenAI described the incident as a “warning shot.” These behaviors remain unusual today, and we should not exaggerate the current threat, but that is precisely why the industry has a window to act.We can now see capabilities emerging that could become much more consequential as AI systems become more autonomous, persistent and interconnected. The question is not whether every consumer faces this threat today, the question is whether we can build the defenses before they do.&nbsp;<h4>Collective defense must connect frontier AI to the consumer edge</h4>This is where Gen’s role in the coalition becomes especially important. Frontier AI companies see emerging model capabilities first, cloud and infrastructure companies understand the systems those models run on, and cybersecurity companies understand attackers, vulnerabilities and defensive controls.Meanwhile, governments can coordinate standards, intelligence and policy. What’s lacking across these is the consumer Cyber Safety perspective at global scale. We see what happens when new technology reaches hundreds of millions of people who do not have a CISO, a SOC or a security engineering team protecting them. All of these perspectives need to connect.That means sharing threat intelligence, defensive technologies and best practices. It means creating open standards rather than isolated security systems around individual AI platforms. And it means ensuring that breakthroughs in frontier cyber defense ultimately become protections that ordinary people can benefit from automatically.That is why Gen has been working across the AI ecosystem while also developing open approaches such as AARTS, designed to create a common way for security systems to understand what an AI agent is doing and intervene when necessary.Collective defense cannot stop at enterprise networks and critical infrastructure, it has to reach the consumer edge.&nbsp;<h4>The defenders’ window is open now</h4>Gen joined the call because we believe the central premise is right: AI will strengthen attackers, and AI can strengthen defenders even more. But that will happen only if the industry moves early, works together and ensures that the benefits of advanced cyber defense reach everyone.For Gen, protecting consumers is a critical part of that mission. Nearly 500 million people already trust Gen brands to help keep their digital lives safer. As AI becomes more autonomous and more deeply integrated into everyday life, that responsibility expands.We will need stronger AI for defenders, we will need independent trust layers around autonomous systems, and we will need shared intelligence and open standards.We also will need to treat consumer Cyber Safety as an essential part of the same collective defense mission protecting enterprises, governments and critical infrastructure. Gen is proud to stand with the more than 100 companies making that call. Now we need to make sure collective cyber defense protects everyone. &nbsp;

Why consumer Cyber Safety must be a central part of the collective defense against AI-powered attacks

The Cyber Defense Window Must Include Consumers

Corporate Manager

There’s a quiet shift happening with money right now. Gen Z isn’t just earning, spending and saving differently; they’re doing it in a world where your financial life is fully online, constantly moving and, frankly, a little chaotic. One minute it’s budgeting tips on TikTok, the next it’s a “too good to be true” investment ad sliding into your feed.So let’s strip it back. Financial safety isn’t about being perfect. It’s about being prepared before something goes sideways.&nbsp;<h4>Start with this: safety beats strategy</h4>There’s a lot of noise around investing early, building passive income or chasing the next big thing. And yes, Gen Z is already jumping into investing earlier than previous generations, often using digital platforms to take control of their finances.But here’s the part that gets skipped: none of that works if your foundation isn’t solid.Financial safety starts with three basics: • Cash buffer (even a small one) • Controlled spending • Awareness of risk (scams, debt, bad advice)Because right now? A lot of Gen Z doesn’t have that safety net. Around 62% don’t have emergency savings, and many rely on credit cards to get through unexpected expenses.That’s not a personal failure. It’s the reality of higher costs, unstable income and a system that wasn’t exactly designed to be easy.But it does mean one thing: building your own safety net matters more than ever.&nbsp;<h4>The smartest move: know where your money is going</h4>You don’t need a complicated system. You just need visibility.Call it budgeting, call it tracking, call it not being surprised at the end of the month. It’s all the same thing.A simple framework like 50/30/20 (needs, wants, savings) still works. But Gen Z is remixing it into something more real: intentional spending. Think “loud budgeting,” being honest about what you’re prioritizing and what you’re not.Translation: You’re not broke. You’re choosing where your money goes.That mindset shift alone is powerful.&nbsp;<h4>Build a buffer before you build wealth</h4>It’s tempting to jump straight into investing. But if one unexpected expense can wipe you out, you’re building on shaky ground.Start smaller: • Aim for $500 to $1,000 in emergency savings • Then grow toward 3 to 6 months of expensesIt doesn’t happen overnight. That’s fine. Consistency beats intensity here.Because when something goes wrong, and it will, you won’t have to rely on high interest debt to survive it.&nbsp;<h4>Watch the digital traps</h4>This is where financial safety gets very real.Gen Z lives online. That means your money does too. And that’s exactly where scammers operate.Fake ads. Impersonation. “Investment opportunities” that look just legitimate enough. These aren’t edge cases. They are designed to blend in with everything else you scroll past.And it works.There’s also a gap worth calling out: confidence doesn’t always equal protection.Gen Z is one of the most confident generations when it comes to spotting scams, but they’re also engaging with them at significantly higher rates than older generations, in some cases nearly double. (<a href="https://dataconomy.com/2025/08/11/gen-z-fall-for-online-scams-more-than-twice-as-often-as-older-ones/?utm_source=chatgpt.com">dataconomy.com</a>)And when scams work, they don’t just take money. They take identity.According to the Identity Theft Resource Center, many of today’s scams are designed to get people to willingly share personal information, including login details, Social Security numbers or verification codes. That information is then used to open new accounts or take over existing ones. (<a href="https://www.prweb.com/releases/identity-theft-resource-center-2025-trends-in-identity-report-impersonation-scams-rise-148-percent--become-top-reported-scam-302477300.html?utm_source=chatgpt.com">prweb.com</a>)That shift matters. Because identity theft isn’t a future problem. It is often the next step after a single click, message or seemingly harmless interaction.As Eva Velasquez, CEO of the Identity Theft Resource Center (ITRC), puts it: “We have to stop looking at identity theft and financial loss as two separate problems. Your identity is the ‘key’ to your entire financial house. If a scammer gets your login or your Social Security number, they don’t just take your money; they take your ability to build a future. Protecting your personal data is the most foundational investment you can make in your financial health.”If your financial life lives online, your identity is part of your financial safety net. Protecting it isn’t optional anymore. It is foundational.A few rules that hold up:<ul><li data-list-item-id="e68f7e0771c4abf542347cf3d63d577c2">If it creates urgency, pause</li><li data-list-item-id="eb8ea324e46df96adbfd24483ec6a98f6">If it promises easy money, question it</li><li data-list-item-id="e74a7beb276a369d3825446def9da1a64">If it looks legit but feels off, trust that instinct</li></ul>Being skeptical isn’t negativity. It’s protection.If you want to go deeper, the&nbsp;<a href="https://www.idtheftcenter.org/reports/?utm_source=chatgpt.com">Identity Theft Resource Center’s latest reports and resources</a> break down how these scams are evolving and what to watch for.

<h4>Use tools that actually help you move forward</h4>This part matters more than ever: you don’t have to figure all of this out alone.The line between financial health and digital safety is disappearing. That’s why platforms are starting to bring both together.MoneyLion, now part of Gen, is a good example of that shift. It’s built to help people not just manage money, but actually move forward with it: tracking spending, building credit, accessing tools that make financial progress feel doable.Because financial safety isn’t just about avoiding risk. It’s about having the confidence to act.&nbsp;<h4>You’re not behind. You’re early</h4>It’s easy to feel like you’re late with money. Like you should already have it figured out.You’re not. You’re early.Gen Z is already reshaping how money works. There are more open conversations, earlier investing and more willingness to question the system.The goal isn’t perfection. It’s momentum.Start with:<ul><li data-list-item-id="e25fe3be553f9c23cfc8ba4ecd87a05ae">Knowing your numbers</li><li data-list-item-id="e947fbae986f88ac1b2176531fd700260">Building a small safety net</li><li data-list-item-id="e1072ff692e39775a264cf450c494ccb5">Staying sharp online</li><li data-list-item-id="eaa82b9c8751df887da9a64a66a4100ff">Using tools that actually support you</li></ul>That’s Financial Safety 101.Not flashy. Not viral. But it works.And once that foundation is there, everything else, investing, growing, building real wealth, gets a whole lot easier.

From budgeting to scams to identity theft, here’s how Gen Z can build a financial foundation that actually holds up online

Financial Safety 101 for Gen Z: Build It Before You Need It

“Is this a scam?” has become one of the defining questions of the digital era.&nbsp;What is changing is not just the volume of these messages. It is how people respond to them. Only now, instead of asking a friend this question, they’re turning to ChatGPT. This shift marks a profound inflection point in human technology interaction. AI is no longer just a productivity tool or a content assistant. It is becoming a decision layer. A reasoning partner. A first checkpoint before action.&nbsp;At Gen, we see this as more than a trend. It signals the emergence of a new trust architecture for the internet.&nbsp;<h2>AI is becoming the first line of defense&nbsp;</h2>According to the <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q4-2025" target="_blank" rel="noreferrer noopener">Gen Threat Report</a>, more than 90 percent of threats targeting people in 2025 stemmed from scams, phishing and deceptive advertising. The dominant risk online today is not malware quietly infecting a system. It is manipulation persuading a person.&nbsp;In parallel, AI tools like ChatGPT are becoming deeply embedded in everyday workflows. People use them to draft emails, compare products, research decisions and increasingly to validate suspicious messages.&nbsp;That convergence creates both opportunity and responsibility. If AI is where decisions are being shaped, then security intelligence must live there too.&nbsp;<h2>From reactive security to decision-centric protection&nbsp;</h2>In the <a href="https://us.norton.com/blog/ai/how-to-spot-scams-before-you-click" target="_blank" rel="noreferrer noopener">Norton integration within ChatGPT</a>, AI evaluates patterns such as impersonation tactics, urgency cues, requests for sensitive information and domain anomalies. Norton Genie, the world’s first AI-powered scam detector, pairs technical signals with behavioral indicators because modern fraud operates on both layers.&nbsp;But this product moment sits within a much larger transformation.&nbsp;<h2>The rise of autonomous AI and the trust imperative&nbsp;</h2>Our <a href="https://www.gendigital.com/blog/insights/research/openclaw-autonomy-risks" target="_blank" rel="noreferrer noopener">OpenClaw</a> research on autonomy risks explores how AI agents with increasing independence can introduce new security challenges. When AI begins to act on our behalf, make decisions or initiate actions, trust can no longer be assumed. It must be engineered.&nbsp;Autonomy without guardrails amplifies risk. Autonomy with transparency amplifies trust.&nbsp;That is why Gen has introduced the <a href="https://ai.gendigital.com/" target="_blank" rel="noreferrer noopener">AI Agent Trust Hub</a>, a framework and resource center focused on building responsible AI ecosystems. The Trust Hub emphasizes governance, explainability, accountability and human oversight as core design principles. This is not theoretical. As AI agents begin handling financial transactions, personal data and operational workflows, they will inevitably become targets themselves. The next phase of cybersecurity will not only protect humans from malicious actors. It will protect AI systems from manipulation and misuse. And it will protect humans from over-reliance on AI without understanding its limitations.&nbsp;<h2>Designing AI that augments human judgment&nbsp;</h2>The future of AI interaction is not about replacing decision-making. It is about strengthening it.&nbsp;When someone pastes a suspicious message into ChatGPT and asks “Is this legit?” they are not outsourcing responsibility. They are seeking clarity. They are extending their cognitive reach.&nbsp;That balance between automation and empowerment is critical.&nbsp;AI must be capable enough to identify emerging global scam patterns, including fake delivery notifications, banking impersonation attempts and AI generated voice phishing. But it must also remain interpretable. Transparent. Accountable. The Norton app, within ChatGPT, can be that.&nbsp;&nbsp;<h2>Building the next trust layer of the internet&nbsp;</h2>We are entering an era where AI will mediate much of our online experience. It will draft our communications. Curate our information. Screen our interactions. Execute transactions. The question is not whether AI will become part of our security posture. It already is.&nbsp;The real question is whether we build it with trust at the core.&nbsp;At Gen, our approach is grounded in three ideas:&nbsp;<ul type="disc"><li data-list-item-id="e965bc2f74345432db64ab84b0e13580d">Innovation must move at the speed of AI growth.&nbsp;</li><li data-list-item-id="ea2d5c939c934043a266b4f4c41bf1f08">Security must integrate into the environments where decisions happen.&nbsp;</li><li data-list-item-id="ec0f44d4a8b7612a7b70893f9bbe16d34">Trust must scale alongside autonomy.&nbsp;</li></ul>The integration of AI-powered scam detection into conversational platforms is one step in a broader journey. It reflects a belief that protection should not sit on the sidelines. It should sit inside the interaction.&nbsp;“Is this a scam?” may have been a common question in 2025. But tomorrow the more important question will be: Can we trust the AI systems helping us answer it?&nbsp;The future of cybersecurity will be defined by how well we design trust into every layer of AI interaction.&nbsp;And that future is being built now.&nbsp;

Why protecting people now means embedding security intelligence directly into AI tools like ChatGPT

The future of cybersecurity lives inside AI conversations 

Join us at the end of October for a conference about new advances in machine learning. You will see how AI can help protect people against the bad guys on the Internet – a goal we trully believe in. We have teamed up with Czech Technical University to bring together the best minds in tech and academia. Experts from many universities world wide as well as a few of our own will share their vision for what the future holds and debate the possibilities of tomorrow’s digital landscape.<h2>Speakers’s spotlight:</h2><ul><li>Doug Tygar – UC Berkeley</li><li>Alex Halderman – University of Michigan</li><li>Matthias Grossglauser – EPFL Switzerland</li><li>Rachel Greenstadt – New York University</li><li>Christopher Kiekintveld – University of Texas</li></ul>You’ll have a chance to meet our new CTO Michal Pechoucek. He is a seasoned security specialist and a father of AI at CTU. Michal will give the opening talk.<h2>Call for posters</h2>If you’re a PhD student there is also a poster session where you’ve be able to present your research and achievements. The deadline is August 18th 2019.<h2>More Info</h2><ul><li>When: October 25th 2019</li><li>Where: Prague, Czech Republic</li><li>Details: <a href="https://www.cybersecprague.ai/">https://www.cybersecprague.ai/</a></li></ul>

CyberSec & AI Prague 2019

Speakers’s spotlight:

Call for posters

More Info