Each safety crew has a model of the identical nightmare: an worker receives a message that appears and sounds precisely prefer it got here from the boss — after which acts on it. Regardless of how a lot coaching an organization gives, one thing ultimately slips by the cracks, leaving the IT division scrambling. This underscores the significance of preparedness throughout the risk lifecycle.
Throughout a latest webinar sponsored by Doppel and hosted by its chief technique officer, Bobby Ford, two NFL expertise leaders, Costa Kladianos, EVP and head of expertise for the San Francisco 49ers, and Christina Morillo, senior director and head of data safety for the New York Giants, walked by how AI has rewritten the social engineering playbook heading into the 2026 season. Their environments are excessive, however the classes apply on to any enterprise.
The risk didn’t change, however the economics did.
Social engineering stays one of the vital accessible methods for attackers to focus on a corporation. Generative AI has modified the velocity, scale, and believability of those assaults. “I don’t assume that threats created by AI are a brand new factor,” Morillo stated. “I simply assume that AI made it a bit of bit easier. Like, this course of might doubtless take minutes, whereas up to now it might have taken a day or two or three.”
She additionally pointed to the collapse within the ability required. “Earlier than, we used to simply speak about script kiddies, and also you needed to know which instruments to make use of. Now it doesn’t actually take a lot. You possibly can go to any of those fashions, and the instruments are good there. Simply pay $20 a month, and also you’re in.”
Ford cited analysis indicating that AI-enhanced phishing can produce greater click-through charges and that AI-assisted impersonation is rising. The velocity and scale of those assaults involved each executives, who stated the quantity dealing with sports activities organizations was already substantial.
The opposite change is in high quality. “Earlier than, it was, ‘I’m from this nation, ship me your checking account, and I’ll ship you a billion {dollars},” Morillo stated. “Now it may very well be coming from a vendor, a accomplice, or somebody you’re employed with, and it might not be them. They’re simply very, very convincing now.”
Kladianos framed the deepfake downside in phrases most enterprises underestimate: the extra public your individuals are, the extra uncooked coaching materials an attacker has. “Everybody is aware of who George Kittle and Christian McCaffrey are, and that makes them simple targets,” he stated. “It’s very simple to go on there, use social media, and deploy a deepfake, and it’s extremely convincing. The attention check is one thing, however they’re getting extremely good.”
Substitute your CEO’s keynote movies, your CFO’s earnings name audio, and your gross sales crew’s LinkedIn presence, and the publicity stays similar. The assault floor now extends far past programs IT controls, encompassing impersonated executives, faux accounts, lookalike domains and cryptocurrency scams on exterior platforms.
Extra must-read AI protection
Sensible recommendation for IT and safety leaders
A number of defensible practices emerged that don’t require an NFL funds.
Make verification a course of, not a judgment name. Kladianos’ warning in regards to the after-hours request is the session’s most transferable perception: “The assaults come at any time, and so they can come when your guard is down. That 2 a.m. name — I have to get in, I would like to do that.” His reply is gates and governance, and refusing to deal with low-friction requests as low danger. “You want to try this for belongings you contemplate small, like password resets. They’re not small. That’s the gateway to what you’ve in your group. Safe your assets such as you safe your cash, as a result of they’re the identical factor.”
Morillo’s model makes use of out-of-band affirmation by default. “One in every of our gamers simply referred to as. How do I validate that that’s who that’s? They may spoof his quantity, they might spoof his no matter.” Her crew depends on face-to-face contact and pre-established aspect channels for high-consequence requests. In follow: cash motion, credential resets, MFA enrollment, and entry escalation ought to all be confirmed on a second channel the requester didn’t select.
Cease assuming the attention check scales. Kladianos’s prescription is to struggle fireplace with fireplace, pairing AI-based detection with human evaluate and steady training — a three-part mannequin he likens to scouting expertise, teaching instruments, and participant improvement. “You place all three collectively, and now you’re going to win video games.”
Make reporting simpler than clicking. This is among the easiest doubtlessly high-value adjustments on the record. “It shouldn’t be onerous for somebody to report,” Kladianos stated. “It needs to be simpler to report than to click on the phishing hyperlink.” Friction in your reporting workflow is a safety management you’ve quietly disabled.
Take away the disgrace. Morillo recognized the true purpose stories don’t arrive. “There’s all the time this sense of like, I did one thing incorrect, I’m embarrassed.” Her repair: make it protected to textual content her, name her, or stroll into her workplace and say, “I clicked on this, I entered my credentials, I’m sorry” — then reply with out punishment. “The response can be an enormous piece of that puzzle.” She additionally makes consciousness coaching private moderately than company: “I make it about that is what occurs at residence, that is what occurs together with your checking account, so it will probably resonate.”
Work the basics year-round as an alternative of constructing a guidelines. When requested what belongs on a preseason safety verify, Morillo pushed again on the premise. “Should you keep prepared, you don’t need to prepare,” she stated, citing steady assessments, penetration testing, MFA protection audits, patch cadence critiques, and safety coaching that’s mechanically triggered the second an account is created. “Simply because they’re fundamentals or fundamentals doesn’t imply they’re easy to do.”
Combine your instruments, even for those who can’t consolidate them. Morillo was blunt in regards to the actuality of tooling: there isn’t a single pane of glass; danger and GRC platforms not often combine cleanly; shadow IT and shadow AI create blind spots; and a platform can grow to be a single level of failure. Kladianos supplied this counterpoint: “Each system has to speak to one another. Should you’re having disparate programs right here and there, you may miss one thing.”
Share intelligence together with your rivals. One steadily missed follow is peer collaboration. The executives stated NFL golf equipment change indicators of compromise, vendor assessments and notes about safety instruments. “We’re aggressive on the sector, however we’re not aggressive behind the scenes,” Morillo stated. Kladianos supported this, explaining that if the Giants arrived at Levi’s Stadium with an incident, “we might 100% hop in and we might each work collectively on that risk” whereas the sport was underway.
Get management buy-in, or don’t hassle. “Should you don’t have management’s buy-in, you don’t have something; it would crumble,” Kladianos stated, crediting 49ers CEO Al Guido’s help. His recommendation for incomes it: translate technical danger into enterprise danger, set up a cross-functional cybersecurity governance committee, and cease framing safety as a expertise downside. “It’s not an IT downside, it’s a enterprise downside.”
The road that ought to observe IT leaders into their subsequent funds dialog is his description of the job: “Cybersecurity is sort of a referee — it’s finest while you don’t discover it.”
For IT leaders, the rapid takeaway is to determine which requests require secondary verification, check how simply staff can report suspicious messages and be sure that admitting a mistake triggers help moderately than punishment. AI could make impersonation cheaper and extra convincing, however established verification procedures and speedy reporting can nonetheless restrict the injury.
