Why the old phishing training is obsolete after deepfake attacks

Resource constraints, not attacker sophistication, are the biggest cyber threat facing state and local governments, and AI is widening the gap by making low-skill attackers faster and more convincing. In our latest episode of the Future of Threat Intelligence podcast, Randy Rose, VP of Security Operations and Intelligence, Center for Internet Security, shared how community defense, essential controls, and human verification hold the line as phishing and deepfake threat intelligence evolve. **Topics discussed:** - Why resource constraints are the number one cybersecurity challenge for state and local governments - How AI makes low-skill attackers faster while ransomware and phishing stay the top threats - Mapping CIS Implementation Group 1 controls to top MITRE ATT&CK techniques to reduce risk - Why traditional phishing training is obsolete after AI-written phishing and deepfake attacks - How community defense turns one organization's attack into protection for thousands **Key Takeaways:** - Prioritize an essential set of controls, starting with CIS Implementation Group 1, to buy down the most risk against top threats like ransomware. - Map your controls to the top MITRE ATT&CK techniques so you know which defenses deliver the greatest impact. - Retire phishing training built on spotting typos and odd phrasing, and train people for general skepticism instead. - Build proactive verification, such as two-person integrity, before trusting an email, phone call, or video feed. - Inventory access alongside hardware and software, tracking who and what has access to what, including AI and agent tools. - Maintain and exercise an updated incident response plan, and know exactly who to call in each scenario. - Use AI for data translation, correlation, and enrichment at scale, and reserve creative thinking and context for people. **Listen to More Episodes:**  YouTube  •  Apple  •  Spotify  •  Website