Table of Contents
Stop Thinking “MFA.” Start Thinking “Phishing-Resistant MFA.”
Assume Every Reused Password Will Eventually Become Public
A Voice, Email, or Text Message Is No Longer Proof of Identity
Patch Faster—and Give People Less Access
Plan for the Day Someone Gets In
For years, cybersecurity advice sounded almost embarrassingly simple:
- Use a strong password.
- Turn on MFA.
- Don’t click suspicious links.
That advice is not wrong. It is just no longer enough!
Artificial intelligence is making cybercrime more convincing, more scalable, and more personal. Phishing emails can now be polished and context-aware. Fraudulent text messages can mimic legitimate business communications. Voice-cloning technology can make a scammer sound like a family member, executive, or trusted colleague.
At the same time, attackers are increasingly targeting something more valuable than your password: your trust.
The best defense is no longer a single security product. It is a set of habits and controls designed around one uncomfortable assumption: Eventually, something convincing will get through.
Here are five cybersecurity rules that matter more than ever.
1. Stop Thinking “MFA.” Start Thinking “Phishing-Resistant MFA.”
Multifactor authentication remains one of the most important security controls available. But the phrase “MFA enabled” can create a dangerous sense of security.
Not all MFA is equally strong.
SMS codes can be exposed through SIM-swapping, phishing, or telecommunications attacks. Authenticator-app codes eliminate some of those risks, but the six-digit code itself can still be stolen if a user enters it into a convincing phishing site.
NIST explicitly states that manually entered one-time-password authentication is not phishing-resistant. That distinction matters.
If an attacker creates a fake login page that proxies your credentials to the real service in real time, they may be able to capture your password, request your OTP, relay that code, and hijack the authenticated session.
That is why the security industry is increasingly moving toward passkeys and FIDO/WebAuthn security keys.
Instead of asking a human to recognize whether a website is legitimate, phishing-resistant authentication uses cryptography to make that determination.
For businesses, email, cloud administration, financial systems, source-code repositories, and privileged accounts should be the first places to make the transition.
MFA is good. Phishing-resistant MFA is the goal.
Table of Contents
2. Assume Every Reused Password Will Eventually Become Public
Password reuse turns someone else’s security failure into yours.
When credentials are stolen from one service, attackers can automatically test the same username and password against banking systems, email providers, corporate applications, and online retailers.
This is called credential stuffing, and it works because people reuse passwords.
The answer is not increasingly complicated passwords you somehow memorize.
It is a password manager.
NIST recommends password managers and now places greater emphasis on password length rather than arbitrary complexity requirements such as mandatory symbols and capitalization.
Its current guidance requires passwords used as a single authentication factor to be at least 15 characters and discourages routine password-expiration rules unless there is evidence of compromise.
In practical terms: Every important account should have a different password, and you should not need to remember most of them.
Table of Contents
3. A Voice, Email, or Text Message Is No Longer Proof of Identity
This may be the biggest mindset change required by AI. Someone sounds exactly like your CEO. That does not prove it is your CEO.
An email comes from a familiar address. That does not necessarily mean the person controlling the account is familiar.
A text message appears urgent and contains accurate personal information. That does not make it legitimate.
AI makes impersonation easier, but the underlying vulnerability is human: we naturally trust familiar people, language, and communication patterns. Cybercriminals exploit that instinct.
The FBI recommends independently verifying requests involving payments or changes to financial information using contact information you already know—not the phone number or link contained in the message. Businesses should go even further.
Changes to vendor banking information, wire transfers, payroll accounts, password resets, and privileged access should trigger a second verification step through an independent channel.
The rule should be simple: The more consequential the request, the less you should trust the communication that delivered it.
Table of Contents
4. Patch Faster—and Give People Less Access
Not every attacker needs AI. Sometimes all they need is an old vulnerability you never patched.
Software updates frequently contain security fixes for vulnerabilities that attackers already know how to exploit. CISA consistently recommends enabling automatic updates and patching systems promptly.
But organizations should pair patching with another principle: least privilege.
An employee who only needs access to three systems should not have access to thirty. A developer who does not need production database access should not have it. An employee should not remain a local administrator simply because “that’s how the laptop was configured.”
This matters because breaches are rarely binary.
The important question is not simply: Did an attacker get into an account?
It is: What could that account reach once they got in?
Restricting privileges can turn a serious breach into a contained incident.
Table of Contents
5. Plan for the Day Someone Gets In
Cybersecurity programs often spend enormous effort trying to prevent breaches. They spend far less time thinking about what happens five minutes after one succeeds. That is a mistake.
Ransomware, stolen credentials, fraudulent wire transfers, compromised email accounts, and malicious insiders all become dramatically more damaging when organizations have no response plan. Backups are part of that plan.
Both CISA and the FTC recommend regularly backing up critical information and ensuring backups cannot easily be reached from the primary network. But recovery involves more than data.
Companies should already know:
- Who disables compromised accounts?
- Who contacts the bank after suspected payment fraud?
- Who investigates suspicious activity?
- Who communicates with customers?
- Who has authority to shut down affected systems?
- What happens if the person responsible is unavailable?
The worst time to answer those questions is during an active incident. Individuals need the same mindset.
Know how to recover your email account. Protect your recovery credentials. Keep backups of irreplaceable data. Know how to remotely disable a lost device. Contact financial institutions immediately when fraud is suspected. Resilience is cybersecurity too.
Table of Contents
The New Security Model: Verify More, Trust Less
AI is not making cybersecurity impossible. It is exposing a weakness that has always existed.
Too many of our security systems depend on humans correctly determining whether something looks legitimate.
That model is becoming increasingly fragile.
The future of security will rely less on asking people to recognize scams and more on building systems where a convincing scam still cannot do much damage.
- That means phishing-resistant authentication.
- Unique credentials.
- Independent verification.
- Least privilege.
- Fast patching.
- Backups.
- And practiced incident response.
The goal is not to make yourself impossible to attack. That is unrealistic.
The goal is to make a successful attack difficult to execute, difficult to expand, and easier to recover from.
In the AI era, that may be the difference between receiving a convincing scam—and becoming its next victim.
Table of Contents
Primary Sources
- National Institute of Standards and Technology (NIST) — SP 800-63B-4: Digital Identity Guidelines — Authentication and Authenticator Management. Current federal guidance on passwords, authentication, OTPs, and phishing resistance.
- NIST — How Do I Create a Good Password? Guidance on password length, password managers, passkeys, and MFA.
- Cybersecurity and Infrastructure Security Agency (CISA) — Implementing Phishing-Resistant MFA. Guidance on FIDO/WebAuthn, SMS MFA, and phishing-resistant authentication.
- CISA — Secure Our World. Recommendations covering MFA, phishing, software updates, and password security.
- Federal Bureau of Investigation (FBI) — Business Email Compromise. Guidance on verifying payment requests and responding quickly to financial fraud.
- Federal Trade Commission (FTC) — Cybersecurity for Small Business. Guidance on backups, authentication, phishing, system security, and incident preparedness.
Table of Contents
Frequently Asked Questions
1. Why is traditional MFA no longer enough in the AI era?
Not all MFA methods are phishing-resistant. SMS codes and authenticator-app OTPs can still be stolen through convincing phishing attacks. Passkeys and FIDO/WebAuthn security keys provide stronger, phishing-resistant authentication.
2. How can businesses protect themselves from AI-powered impersonation scams?
Businesses should independently verify high-risk requests, such as payment changes, wire transfers, payroll updates, password resets, and privileged-access requests, using a separate trusted communication channel.
3. What should organizations do if a cyberattack gets through?
Organizations should prepare an incident-response plan, maintain secure backups, restrict user privileges, and clearly define who is responsible for disabling compromised accounts, investigating incidents, contacting banks or customers, and shutting down affected systems.