Dr. Chris Pierson Founder & CEO, BLACKCLOAK.
Knowing who and what is real among family, friends and colleagues has taken on an entirely new meaning in the digital world. For generations, we have relied on familiar signals to establish trust. We recognize a person’s face. We know the sound of their voice. We recognize their phone number, email address or writing style. When a family member calls, an assistant sends a text or a financial advisor emails with a request, those familiar signals tell us we are communicating with the person we believe we are.
Artificial intelligence, deepfakes, voice cloning and sophisticated social engineering are making it easier for cybercriminals to convincingly impersonate the people we know and trust. An attacker no longer necessarily needs to break into a corporate network or compromise an executive’s account to cause significant damage. Sometimes, all they need to do is convince someone that they are a trusted person.
Why Trust Is The New Attack Surface
When cybersecurity professionals talk about protecting an individual, the focus is often on that person’s devices, accounts, passwords and data. But people do not operate in isolation. Each of us exists within a network of relationships.
For a business leader, that network might include a spouse, children, executive assistant, attorney, wealth manager, accountant or board member. It can also include household employees and caregivers. Cybercriminals recognize the value of those relationships.
If an attacker cannot compromise an executive, perhaps they can impersonate the executive to an assistant. If they cannot fool a financial advisor, perhaps they can impersonate the advisor to a client. And if they cannot convince someone to disclose sensitive information, perhaps a convincing call supposedly coming from a spouse or child will create enough urgency to overcome their skepticism.
This is where digital executive protection has evolved in recent years to encompass more than just the executive. Protecting a high-value individual in isolation is no longer enough when attackers can exploit the people around that individual as alternate paths to the same target.
Cybersecurity awareness can no longer focus solely on how individuals protect their own accounts, devices and information. It must also include an understanding of how our trusted relationships can be exploited and how our own digital identities can be weaponized against the people who trust us.
Keeping It Real: Seeing And Hearing Are No Longer Believing
Deepfakes have changed the equation. Until recently, receiving a video call from someone you knew provided a meaningful level of reassurance. Hearing a familiar voice on the telephone did the same.
Publicly available audio, video, photographs and personal information can provide criminals with the raw material needed to create increasingly convincing impersonations. But this is not exclusively an executive problem. The amount of information people routinely share online means many of us have created a digital library of ourselves without realizing it.
That changes one of the fundamental rules of digital safety: Recognition is no longer verification. A familiar voice is not proof. A familiar face is not proof. A familiar email address or phone number is not proof.
Knowing When Trust Needs Verification
The answer is not to become suspicious of every interaction with the people closest to us. Instead, we need to recognize the moments when trust requires additional verification.
Those moments frequently involve money, credentials, sensitive information or unusual requests. A message asking for a wire transfer deserves additional scrutiny. So does a request to change banking information, disclose an authentication code, provide confidential documents or take an action that falls outside the normal pattern of a relationship.
Social engineering succeeds because criminals understand human behavior. They create pressure specifically to prevent us from stopping and evaluating what is happening. A family emergency, confidential business transaction or financial deadline can cause an otherwise cautious person to act immediately. That is precisely when verification matters most.
One of the simplest principles people can adopt is to verify unusual or high-risk requests through a separate, trusted channel. If a suspicious request arrives by email, don’t simply reply to that email asking whether it is legitimate. If someone calls requesting an urgent financial transaction, don’t assume the familiar voice on the telephone proves who is speaking.
Contact the person independently using a method you already know. The principle is simple: Never use a potentially compromised communication to authenticate itself.
Redefining The Circle Of Trust
For years, cybersecurity has embraced the concept of zero trust, which means never automatically trusting a user, device or connection simply because it appears to be inside a trusted environment. Digital executive protection requires us to apply some of that thinking beyond corporate systems and into the personal digital lives and relationships surrounding high-value individuals.
You can trust your spouse completely and still verify that the text asking you to transfer money actually came from your spouse. You can have complete confidence in your financial advisor while authenticating an unexpected request supposedly coming from that advisor. You can trust your CEO while verifying an unusual message asking you to take an extraordinary action.
One of the most important behaviors we can adopt today is learning when trust needs to be verified. Cybersecurity has spent decades protecting systems by authenticating users. In an era of AI-powered impersonation, digital executive protection increasingly requires us to think about authenticating people to one another.
The New Rules Of Trust
In a world where a familiar face, voice or message can be convincingly replicated, knowing someone is no longer the same as knowing it is really them. So while we’ve been talking about cybersecurity hygiene for years, perhaps the most important lesson is also one of the simplest: Trust is still essential, but verification has never mattered more.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?