FIRST WORD
This week is Cybersecurity Career Week, a national effort to introduce more people to work in this field. It’s also a good excuse to thank whoever on your team flags a suspicious email first. Most businesses have one, and they rarely get credit.
It’s a good reminder that security mostly comes down to people: those protecting a business and those trying to fool it. This issue is about the second group and what happens when someone sounds exactly like someone you trust.
Chris Moore
Chief Vision Officer, Steelbrook Technology Group
A Familiar Voice Is No Longer Proof
Why it matters: A phone call or video meeting used to be how you double-checked an unusual request. AI tools can now copy a voice or a face well enough that the check itself can be faked.
The case to know: In January 2024, a finance employee at Arup, the global engineering firm, got an email from someone posing as the company’s CFO. The employee was suspicious until a video call with the “CFO” and several colleagues, each of them a deepfake. The employee then made 15 transfers totaling about $25 million.
What the FBI says: AI-generated voices can sound nearly identical to someone you know. The FBI advises verifying identity using a phone number you look up yourself, not one the caller gives you.
The catch: The video call was supposed to be the safety check. It’s what removed the doubt. Training people to “listen for the fake” doesn’t hold up. What works is a routine everyone follows, whether the request sounds right or not.
What we recommend:
Any request to move money or share logins gets a callback to a number already on file.
Agree on a code word for urgent requests from leadership. Set it in person, never by email.
Make it normal to say “I need to verify this,” even to the CEO.
The bottom line: Decide how you’ll verify before the call comes in, not during.
DO THIS WEEK: Check The Numbers You’d Call Back
A callback rule only works if you call the right number. Take 15 minutes this week:
Pull the phone numbers on file for your five biggest vendors and your bank.
Confirm each one against an invoice, contract, or the company’s website, not a recent email.
Update anything that’s out of date, and make sure your finance team knows where the list lives.
Fake AI Tools Are Spreading Malware (October 2026)
What’s happening: Security researchers at ANY.RUN tracked 1,258 malware analyses linked to fake AI tools between April and October 2026. The fakes most often posed as Claude and ChatGPT, using look-alike download pages and ads to steal logins and browser sessions.
The trap: Many of these pages tell you to copy and paste a command to “install” the tool. That one step is how the malware gets in.
The business takeaway: Decide which AI tools your team can use, route installs through IT, and make one rule clear: never paste a command from a website to install software.
Put Your Verification Rule In Writing
Forward this issue to whoever approves payments at your business, then take 10 minutes to agree on the rule together.
Decide:
Which requests always get a callback (payment changes, wire transfers, login requests)
Who makes the call, and which number they use
Your code word for urgent requests from leadership
Who it’s for: Owners and anyone who can approve a payment.
Button: Read the FBI’s Guidance
Want help setting this up for your team? Email [email protected] and we’ll walk you through it.
October 20, 1973: The Sydney Opera House Opens
Queen Elizabeth II formally opened the Sydney Opera House on this date, 14 years after construction began. Its curved roof was so hard to engineer that the structural engineers turned to early computers, machines big enough to fill whole rooms, in one of the first uses of computer analysis in building design.
The twist: That engineering firm was Arup, the same company in this week’s Lead. Being good with technology isn’t the same as being protected from people who misuse it.