The End of Urgency

Halfway through recording episode seven of When Nobody’s Watching, Anthony Enoh started describing the next generation of attack. An AI agent works out what you’re interested in and sends you something useful. A while later, something else. Then an event you might like, which turns out to be a real event. And months down the line… one link.

Picture what that would look like from your side. You speak at a conference in March and your talk goes up on the event’s website. A few weeks later someone emails to say they enjoyed it, and sends you a report on the same subject. It’s a good report. You say thanks. In May they mention a webinar you might like, and it’s a real webinar, run by a real company, and you go. Over the summer there’s the odd message about something you posted on LinkedIn. They remember what you said last time. They never ask you for anything.

Then one day in September there’s a link to the slides from that webinar. Or a shared document. Or a form to register for the next one. By then they’re a contact. Your inbox holds six months of evidence that they are exactly who they say they are, and nothing about that last email looks any different from the ones before it.

Now think about the advice we give people. Check for urgency. Be suspicious of deadlines. Watch out for “act now”, “within 24 hours”, “your account will be suspended”. Spelling mistakes from someone typing fast. Every single one of those is a sign that the person on the other end is in a hurry. And for twenty years that was a safe bet, because attackers WERE in a hurry. Their time cost money, so they had to get in, get the click and get out.

And now they don’t. A patient con artist could always run a long game like that, but only on a handful of people at a time, and they had to eat. An AI agent can run the same friendly, properly useful relationship with everyone in your finance team at once, remember every conversation, and keep it going for months for next to nothing. Once patience is cheap, the hurry goes away. And so do all the signs we trained people to spot.

Anthony said it better than me on the episode: “Our training isn’t designed for that. It’s been designed to focus on, look for these things here, urgency. What happens if the attackers don’t need urgency, ’cause they can build trust over time?”

So what DO you look for when the run-up looks completely normal?

James Linton, my other guest, had part of the answer earlier in the same conversation, without meaning to. When he looked back at the emails he’d sent pretending to be other people, he realised “I didn’t have to build trust. I just exploited existing trust.” Every time, the damage was done by the ask at the end.

And let’s face it, the ask hasn’t changed. However long the build-up, it still comes down to one of four things. Send money. Reply with information. Click a link. Download something. That list is the same whether the email arrived in a panic or after six months of perfectly pleasant chat.