“Organizations that find themselves potentially regulated by that law, should it pass, are starting to be proactive about managing cyber risk in their vendor relationships,” says Charleston.

The cybersecurity world, he says, is seeing a broadening of the “threat actor landscape.” In the last 18 months, syndicates of ransomware attackers have allowed outsiders to use their tools and branding to stage attacks, which is known as “ransomware as a service.” What this means for victims, says Charleston, is they do not always have the reliability and professionalism that accompanies an established cyber attacker whose conduct throughout the crime will at least be predictable.

When large language models, such as Chat GPT, emerged, there was significant concern that these technologies would be used to rewrite ransomware at a “breakneck pace,” he says. Generative AI is also a “very powerful tool for persuasion.” Charleston has seen a marked increase in the persuasiveness, syntax, grammar, and believability of phishing communications and in the language used during ransomware negotiations.

AI also has the potential to drastically innovate impersonation fraud, he says. It can be used to replicate the voice or image of a CEO or CFO, which can be used to approve massive payment diversions.

“That’s a doomsday scenario where AI can enable this type of fraud, but it’s the kind of impersonation fraud that you’ll hear AI security researchers discuss as a potential.”