As artificial intelligence gives cyber criminals increasingly sophisticated tools, your employees could be your organisation’s greatest vulnerability – or its strongest defence.
“You’re the weakest link. Goodbye.”
For millions of television viewers, Anne Robinson’s and more recently Romesh Ranganathan’s, familiar dismissal was the unmistakable conclusion to a round of The Weakest Link. In cyber security, however, identifying the weakest link is rarely so straightforward, and the consequences of getting it wrong can be considerably more serious.
The image many people still have of a cyber-attack is a criminal in a darkened room, working through layers of sophisticated security to penetrate an organisation’s defences. That certainly happens. But increasingly, attackers are finding a much easier route: persuading someone on the inside to open the door for them.
And artificial intelligence is making that deception more convincing, more scalable and potentially much harder to recognise.
The human entry point
The UK’s National Cyber Security Centre (NCSC) has issued a stark warning. Its State of the Cyber Nation report, published on 3 November 2026, says it is highly likely that AI-powered malware will be used in a ransomware attack against UK critical national infrastructure by 2028.
The report also warns that hostile actors are likely to use AI to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation. Importantly, the NCSC is not suggesting that AI has invented an entirely new category of cyber-attack. Rather, it is making existing techniques faster, more effective and easier to deploy at scale.
That distinction matters. Technology may be changing rapidly, but many successful attacks still begin with familiar human behaviours: trusting a convincing message, responding to an urgent request, opening an attachment or believing that an opportunity is genuine.
Phishing emails are no longer necessarily riddled with spelling mistakes or awkward phrasing. AI can help criminals produce fluent, personalised messages, imitate business relationships and create convincing scenarios. Fake recruiters, supplier requests, executive instructions and password-reset messages can all be used to establish trust before the real attack begins.
The target is not necessarily careless or inexperienced. They may simply be doing what most of us do every working day: responding to a request that appears entirely legitimate.
When a job offer becomes the attack
A recent incident involving cryptocurrency exchange Binance illustrates just how effective this approach can be.
On 3 November, Reuters reported details of a multi-stage operation that culminated in the theft of approximately $6.3 billion in cryptocurrency on 29 October. According to Binance, the campaign began months earlier. In June, an employee downloaded a tampered coding tool disguised as an AI application. Although the company detected the compromise and replaced the device, the attackers had already learned about the employee’s role and the wider wallet development team.
In September, a second software engineer seeking a new job was approached through what appeared to be a legitimate recruitment process. After a virtual interview with someone posing as the chief executive of a fictitious company, the engineer was persuaded to download a coding assignment onto their computer. The repository contained malicious code.
The attackers subsequently used compromised devices, credentials and an internal AI tool to reach systems connected to Binance’s cryptocurrency wallets. The FBI attributed the operation to a North Korean hacking group, an attribution rejected by North Korea.
There is a temptation to focus on the technical complexity of the final attack, and that complexity was considerable. But the human element is what should give every business pause.
This was not simply a criminal trying to break through a billion-dollar security operation. It was a carefully constructed recruitment approach, exploiting a perfectly understandable ambition: the prospect of a better job.
The employee was not necessarily looking for trouble. They were looking for an opportunity. The attackers understood that – and used it.
It can happen closer to home
This is not just a risk for global technology companies or financial institutions. An associate of vXtream recently received what appeared to be an attractive senior executive recruitment opportunity.
The role was credible, the approach was tailored to their professional background and the initial correspondence looked entirely plausible. It was only after independently checking the recruiter’s identity, and being directed towards a questionable third-party CV-writing service, that the warning signs became apparent.
There was no obvious giveaway, no clumsy spelling or implausible promise. It was a carefully constructed approach that played on something entirely human: the prospect of a new career opportunity.
The lesson is clear. These scams do not always arrive looking like cyber-attacks. Sometimes they arrive looking like the next step in your career.
When cyber-attacks become physical
The consequences of cyber compromise are not confined to stolen data, disrupted websites or financial losses.
Recent attacks on supermarket refrigeration systems across Europe provide a particularly tangible example. In November, retailers in countries including Ireland, Belgium, Sweden, Finland, the Netherlands and Luxembourg reported incidents affecting refrigerators and freezers. In some stores, temperatures reportedly rose as high as 50°C, leaving food spoiled and shelves empty.
The incidents followed similar attacks in France during October, which affected hundreds of supermarkets and caused substantial food losses.
These events underline the growing connection between information technology and operational technology, the systems that control physical equipment, buildings, production lines and essential services. A compromised device or poorly secured remote connection can have consequences well beyond the IT department.
A supermarket refrigerator might seem an unlikely target. But when its controls are connected to a wider network, it becomes part of the organisation’s attack surface. The same principle applies to industrial systems, energy infrastructure, transport networks and other essential services.
Cyber security is no longer just about protecting information. It is also about keeping real-world operations running.
Your people are part of the defence
So, are employees the weakest link? That is perhaps the wrong question.
People can be a vulnerability, but they can also be one of an organisation’s most valuable lines of defence. The difference often comes down to whether they have the knowledge, confidence and support to recognise suspicious behaviour and know what to do next.
Security awareness cannot be treated as an annual compliance exercise. It needs to be part of everyday working practice, supported by relevant and ongoing training.
Employees should understand how to verify unusual requests, check identities through a separate trusted channel, treat unexpected attachments and downloads with caution, and report anything that feels wrong. Recruitment teams need to be alert to suspicious approaches and unfamiliar software. Finance teams should independently verify changes to supplier payment details. Managers should understand that an urgent request, even one apparently coming from the top, is not a reason to bypass established procedures.
Crucially, people must feel able to report a mistake or concern quickly, without fear of blame. Early reporting can make the difference between a contained incident and a serious breach.
But training alone is not enough. It must sit alongside the fundamentals: properly configured systems, multi-factor authentication, timely patching, endpoint protection, network monitoring, access controls and appropriate separation between corporate IT and operational technology.
The NCSC’s warning is also a reminder that organisations cannot afford to rely on outdated infrastructure or a false sense of security. AI may help defenders identify threats and respond more quickly, but it can also help attackers find and exploit weaknesses that have been left unattended.
Security is everyone’s responsibility
The next major cyber incident may not begin with an extraordinary technical breakthrough. It could start with an email, a phone call, a supplier request or an apparently attractive job offer.
That is why effective cyber security needs to be considered as a combination of technology, people and preparation. Investment in infrastructure matters. So does the ability to recognise when someone is trying to manipulate the people who use it.
At vXtream, we believe organisations need to take a practical, joined-up approach to protecting their systems, their data and the services their customers depend on. That means secure infrastructure, proactive protection and informed people – supported by a clear understanding of the risks.
You may never know who the weakest link is until someone tries to exploit it. The objective is to make sure that, when they do, your organisation is ready.
Let’s talk about your security.
Image of Romesh Ranganathan, host of the BBC series The Weakest Link. Image copyright BBC