Testing Times: How Financial Services Firms Can Counter the Social Engineering Threat

Written by Travis DeForge, Director of Cybersecurity at Abacus Group

Earlier this year, leading global venture capital and private equity investment firm, Insight Partners, fell victim to what it identified as a ‘sophisticated social engineering’ attack.  This ultimately resulted in a significant data breach, with compromised data believed to include fund details, information about the management company and its portfolios, and personal details of both current and former employees.

Insight Partners, a highly respected firm within the sector, falling victim to such an attack is a stark reminder of the threat all financial services organizations face. Social engineering attacks could happen to any business, and they continue to escalate. In the first quarter of 2024 alone, 90% of attacks involved some type of social engineering, according to Avast. And, thanks to the growing influence of AI, they are likely to intensify even further. 

In the financial services sector, where trust, reputation, and compliance are paramount, the stakes couldn’t be higher.

Countering the AI Threat

Modern attackers use AI to craft highly personalized, convincing messages, automate large-scale phishing campaigns, and even simulate human interactions in real-time utilizing deepfake technology. This evolution has made social engineering attacks more effective and challenging to detect, emphasizing the need for advanced security measures and continuous awareness training.

For instance, consider a scenario in which your CFO receives a voicemail from your CEO asking for urgent action, and it sounds exactly like them. That is not impossible today. With the rise of deepfake audio and video technologies, cybercriminals are able to convincingly impersonate senior leaders, trick employees into bypassing controls, and authorize transfers or data access. These tactics specifically exploit human behavior and error, such as the tendency to make mistakes, pressure, or respond instinctively to authority and urgency. 

In this environment, relying solely on traditional defenses isn’t enough. Our clients across the financial services sector have seen the strongest results by pairing a comprehensive review of their current security controls with advanced threat emulation techniques, like social engineering testing.

On one level, they need to ensure that they are implementing cybersecurity best practices across their operations. That means consistently monitoring key systems and accounts for suspicious activity and resetting passwords to block unauthorized access. It also means conducting regular security training to educate employees about cyber threats, and ensuring multi-factor authentication (MFA) is enabled across all systems.  

At the same time, firms need to conduct cybersecurity risk assessments to identify areas for improvement and decide where to invest in security measures. This should typically involve the identification of critical assets, thorough analysis of threats, and the development of a comprehensive mitigation plan.

Key Role of Testing

In addition to rolling out cybersecurity best practices as outlined above, firms would be prudent to start implementing social engineering testing on a regular basis. This is a fundamental, proactive cybersecurity measure in which professionals simulate real-world social engineering attacks to evaluate a firm’s vulnerability and strengthen its defenses.

It is an approach that goes beyond traditional awareness and seeks to leverage the most advanced adversarial tactics, like bypassing multi-factor authentication (MFA) and leveraging AI to conduct real-time deepfakes. When professionally executed, social engineering testing delves deeper than standard email phishing tests, challenging employees with the type of sophisticated attacks used by real-world cybercriminals. It is an approach that helps uncover weaknesses linked to human behavior. 

Incorporating social engineering into a firm’s risk assessment and management program garners several key benefits. First, employees will get to experience firsthand how sophisticated these techniques are, which not only increases end-user security awareness but also helps employees understand how to respond to these types of attacks.  

Second, firms will receive crucial insights into how best to develop and enforce cybersecurity policies that minimize the opportunity for human error, such as verification procedures and strict email protocols. Finally, organizations can use the findings, particularly information they may gather about gaps in detection, escalation, and response procedures, to improve their incident response plans and reduce the time it takes to contain and mitigate actual threats. 
 
The financial services sector has long been a top target for cybercriminals. As social engineering grows and evolves with AI and deepfake technologies, the threat is becoming more sophisticated, more personal, and harder to detect. 

Mirroring the tactics of the attackers themselves is one of the most effective ways to understand where human vulnerabilities lie and how to address them before they’re exploited. By prioritizing these measures, firms can strengthen their resilience, protect sensitive data, and maintain the trust that is so crucial to their success.

Want to know how your firm would stand up to a real-world attack? Contact us to get started.