When it comes to cyberattacks, ransomware and business email compromises still grab the headlines, but they are no longer the whole story. Today's cyber attackers are just as likely to exploit trusted identities, artificial intelligence, third-party relationships, and ordinary business processes to access sensitive information, redirect funds, or disrupt operations.
Many of these attacks never involve a traditional network intrusion or obvious malware. Instead, the threat actor shows up looking like a trusted executive, an authenticated employee, an approved application, a new hire, or a critical vendor. In other words, the attack rides on the same people, credentials, tools, and relationships the business relies on every day, which makes it far harder to prevent and detect. Today, the most dangerous intruder may be the one who looks like they belong.
As Cybersecurity Awareness Month comes to a close, now is the time to assess whether your security program has kept pace with the threat landscape. Awareness is the starting point, but action is what reduces risk. Below are five evolving threats that deserve attention now and practical steps your organization can take to reduce cyber risk today.
Five Evolving Cyber Threats
1. Social Engineering and AI-Enabled Impersonation: Seeing (and Hearing) Is No Longer Believing
Artificial intelligence has made polished, personalized phishing messages inexpensive to produce, and deepfakes have made audio and video impersonations remarkably convincing. An attacker can now sound like your CFO, write like your vendor, and reference details only an insider should know, all while creating urgency around a payment, an account change, or a request for confidential information. The use of phone calls and voicemails (vishing) to trick employees into revealing credentials doubled in the first half of 2026. The old warning signs, such as poor grammar or an unfamiliar voice, no longer work. If your verification processes for wire transfers, account recovery, executive instructions, or hiring depend on recognizing a face or a voice, it is time to change.
2. Identity and Help Desk Attacks: Logging In Instead of Breaking In
Why break in when you can log in? Attackers increasingly obtain legitimate-looking access by stealing session tokens, compromising credentials, or manipulating internal or outsourced help desks. One persuasive phone call that convinces a support agent to reset a password, enroll a new multifactor authentication device, or change recovery information can turn an attacker into the "authorized" user. Push notifications and one-time passcodes can also be defeated through social engineering and attacker-in-the-middle techniques. The result can be a serious incident with no malware and no traditional network intrusion. Your help desk is now part of your attack surface, and your security program should treat it that way.
3. Prompt Injections and Shadow AI: When the Target Is the Machine
Social engineering has always targeted people. Prompt injection targets the AI model itself. Attackers embed malicious instructions in documents, webpages, emails, or other content that an AI tool processes, and an AI assistant with broad access may then be manipulated into disclosing confidential information, producing misleading output, or taking an unauthorized action. The more access and autonomy an AI tool has, the more damage a single hidden instruction can do.
Shadow AI, the use of AI tools the organization has not approved, compounds the problem. The concern is not simply that an employee uses an unauthorized tool; it is what the employee puts into it. Customer data, legal documents, source code, and financial or proprietary information can leave the organization's controlled environment in seconds. Once that happens, the organization may have little visibility into where the information went, how long it will be retained, or how it may be used, and the result can be significant legal exposure.
4. North Korean Remote IT Workers and Insider Threats: The Threat You Hired
Some threat actors do not need to break in, because you've hire them. Foreign operatives, including North Korean IT workers, have used stolen or fabricated identities, proxy interviewers, staffing intermediaries, U.S.-based facilitators, and laptop farms to land legitimate remote IT positions with U.S. companies. Once onboarded, they may receive authorized access to source code, trade secrets, customer information, credentials, and production systems. The consequences can extend well beyond payroll fraud to data theft, extortion, sanctions exposure, employment issues, breach notification, law enforcement involvement, and workplace safety. This threat is active: Earlier this month, the Department of Justice announced indictments of 14 individuals, including two Americans, for helping North Korean IT workers obtain remote jobs at U.S. companies. Identity verification is now a cybersecurity control, not merely an HR process.
5. Vendor and Supply Chain Compromise: Inheriting Someone Else's Incident
Vendor risk may be the least novel threat on this list, but it remains one of the most consequential. A critical cloud provider, managed service provider, payroll processor, software supplier, or other integration can become an attacker's front door into your environment. Even a strong internal security program cannot shield the organization from the operational and legal fallout of a trusted third party's failure. Customers may face business interruption, confidentiality concerns, notification duties, regulatory deadlines, contractual disputes, and litigation, often before the vendor has finished its investigation or provided reliable facts. Organizations need to know which vendors hold sensitive information, which have privileged connectivity, and what happens operationally if one of them goes down. Otherwise, you can have excellent security and still inherit someone else's cyber incident.
Five Steps Your Organization Should Take Right Now
1. Update Your Incident Response Plan
Most incident response plans were written for ransomware and data breaches. Today's incidents often look different: a deepfaked executive approving a wire, a help desk reset that hands over an account, an AI tool leaking data, a remote worker who is not who they claimed to be, or a vendor breach that lands on your desk. You should update your playbooks to cover each of these scenarios, and make sure the plan clearly identifies who makes the critical legal, operational, and communications decisions when an incident does not fit neatly into a traditional cyberattack scenario. If your team would have to improvise the first hour, the plan is not finished.
2. Prioritize Tabletop Exercises
In the midst of an incident is the worst time to discover that no one knows who can approve a ransom payment, call the insurer, or notify regulators. Tabletop exercises let your team find those gaps when the stakes are low. Build scenarios around the threats above, such as a deepfaked CFO requesting an urgent wire, a compromised help desk account, an AI tool risk, or a remote employee who turns out to be a foreign operative, and include senior leadership, not just IT. Cyber risk is a management and enterprise-wide issue, not merely a technical one. Baker Donelson facilitates tabletop exercises for clients across the country and routinely advises executive teams on these issues.
3. Conduct an AI and Identity Risk Assessment
You cannot protect access you do not know exists. Map how employees, contractors, applications, and non-human accounts reach your sensitive systems and information. The assessment should cover approved and unapproved AI tools, AI agents, service accounts, connected applications, privileged accounts, and account-recovery processes. In many organizations, non-human identities now outnumber employees and receive far less scrutiny. Once you have the map, prioritize stronger controls – such as phishing-resistant multifactor authentication, least-privilege access, and stricter help desk verification – around the identities and applications that can reach your most sensitive data.
4. Establish the Legal Response Framework Before an Incident
The worst time to choose your incident response team is during an incident. Identify outside incident response counsel, forensic investigators, and other key response partners now, and confirm that they are approved by your cyber insurer, which may require use of its panel vendors. Establish clear escalation procedures and decide in advance how counsel, forensic investigators, insurers, communications professionals, and senior leadership will be engaged. Doing that work ahead of time allows the organization to respond quickly and deliberately, and it positions counsel to direct the investigation and protect privilege while addressing regulatory, notification, and litigation issues.
5. Review Critical Third Parties
Your security is only as strong as the vendors you trust with your data and systems. Identify the vendors whose compromise or unavailability could materially affect the business, and review both the technical and contractual safeguards around those relationships. Ask practical questions:
- How quickly must the vendor notify you of an incident?
- Will it share forensic findings and cooperate with your investigation?
- Does it carry adequate cyber insurance?
- Who pays for breach-related costs?
If the contract is silent on these points, the time to fix it is before the vendor's incident becomes your legal and operational problem.
Cybersecurity Awareness Month may end on October 31, but attackers do not follow the calendar. The threats described above are already targeting organizations of every size, and the decisions made in the first hours of an incident often shape its legal, financial, and reputational impact for years. Experienced cybersecurity counsel can help you get ahead of these risks – from updating response plans and running realistic tabletop exercises to strengthening vendor contracts – and can also step in to direct a privileged investigation when an incident occurs.
To discuss how these evolving threats may affect your organization and what you can do now to prepare, contact the authors, Alexander F. Koskey, CIPP/US, CIPP/E, PCIP, and Matthew G. White, AIGP, CIPP/US, CIPP/E, CIPT, CIPM, PCIP, or any member of Baker Donelson's Data Protection, Privacy and Cybersecurity Team.
October is National Cybersecurity Awareness Month
Observed annually in October, Cybersecurity Awareness Month is a collaborative effort between the public and private sectors to raise awareness about cybersecurity. It was launched in 2004 by the U.S. Department of Homeland Security (DHS) and the National Cyber Security Alliance (NCSA).
Throughout Cybersecurity Awareness Month, we will provide proactive tips and information in order to mitigate your cyber risks.