Constangy Clips Ep. 21 - Four Ways AI Is Transforming Cyber Risk

AI is changing the cyber risk landscape by making familiar attacks easier to launch, more convincing, and more scalable, while also creating new vulnerabilities inside the tools organizations rely on. Employers that adopt AI without governance, verification procedures, and an updated incident response plan may be exposed to risks they haven’t yet planned for.

In this episode of Constangy Clips, AI practice group co-chair and Cyber Team member Amanda Novak shares practical tips to help employers understand how AI is reshaping cyber risk and what steps they can take now to strengthen their defenses.

How Is AI Changing Cyberattacks?

Threat actors can use AI to automate reconnaissance, craft highly tailored phishing messages, and impersonate trusted parties using synthetic voice or video. Amanda explains why deepfake-enabled fraud, such as a fake call from an executive or vendor requesting a payment, may no longer require a breach of the company’s email or network. Employers should train employees to recognize synthetic media and independently verify payment instructions and changes to bank account information.

What Risks Come from Using AI Internally?

AI systems can themselves be targets of attack, and employees’ unauthorized use of AI tools, often called “shadow AI,” can expose personal or proprietary information. Amanda discusses why employers should know which AI tools are in use, who approved them, and what data they can access, and why using AI in consequential decisions without appropriate safeguards can create discrimination, privacy, and regulatory risk.

What Should an AI Governance Program Include?

Amanda reviews the building blocks of a formal AI governance program, including an inventory of approved AI systems and vendors, clear ownership, permitted and prohibited uses, data handling requirements, vendor diligence, human oversight, and monitoring. She also explains why employers should plan for the possibility that a key AI vendor experiences an outage or compromise.

How Should an Incident Response Plan Account for AI?

An incident response plan should include clear roles, reporting procedures, and steps for containing and responding to an incident. Amanda explains why employers should update their plans to address AI-specific scenarios, including deepfake fraud, internal misuse, attacks on AI models or data, and outages affecting critical AI workflows, and why tabletop exercises are a good way to test those plans.

Key Takeaways for Employers

• Train employees to recognize AI-enabled phishing and synthetic media, including deepfake voice and video.
• Independently verify payment instructions and any changes to bank account information.
• Maintain an inventory of approved AI systems, vendors, integrations, and use cases.
• Establish a formal AI governance program with clear ownership, permitted and prohibited uses, and human oversight.
• Address “shadow AI” by setting clear rules for employees’ use of AI tools and the data they may enter.
• Update incident response plans to include AI-related scenarios and run tabletop exercises to test them.
• Keep cybersecurity fundamentals in place, including phishing-resistant multi-factor authentication and limits on privileged access.

Related Resources

• AI & Cyber Risk Blog: Agentic AI models may give cyber criminals new tools for cyber attacks
• AI Regulations Blog: AI Regulation in Flux: U.S. and global shift toward “lighter touch”
• AI Regulations Blog: AI Regulation in Flux: What businesses should do
• Constangy Cyber Team
• Constangy Artificial Intelligence Practice Group
• More Constangy Clips Episodes

About Constangy Clips

Constangy Clips is a video series featuring practical guidance for employers on labor and employment law developments, workplace compliance issues, cybersecurity concerns, and HR best practices.

About Amanda Novak

Amanda Novak is Senior Counsel at Constangy and co-chair of the firm’s Artificial Intelligence practice group. She is a member of Constangy’s Cyber Team. She advises clients on data privacy, cybersecurity, and AI governance and compliance, and has helped organizations respond to hundreds of data privacy and security incidents. Amanda is a Certified Information Privacy Professional (CIPP/US and CIPP/E), an Artificial Intelligence Governance Professional (AIGP), and a Fellow of Information Privacy (FIP) through the IAPP.