Managing Disinformation Risks in Cybersecurity

🚨 Disinformation: The Silent Killer of Trust in Your Organization 🚨 We often think cyber threats look like hackers in hoodies. But the real danger might be a cleverly crafted lie making its way into your boardroom, inbox, or social media feed. Disinformation isn't just fake news—it's a targeted attack on your organization's reputation, operations, and decision-making. 🔎 Imagine this: * A false report circulates about your company’s environmental practices, sparking protests. * A fake executive email alters your supply chain decisions, costing millions. * Phony reviews and online campaigns erode years of customer trust overnight. Sounds like a movie plot? It’s happening now. Here’s the kicker: most organizations aren’t ready. They invest in firewalls but forget the human and operational firebreaks needed to combat disinformation campaigns. So, how do you protect your organization? 1️⃣ Strengthen internal communication: Be the source your people trust. If your team doesn’t hear the truth from you, they’ll believe the noise. 2️⃣ Monitor your digital reputation: Use tools to track mentions of your brand, leaders, and products—false narratives are easier to counter when they’re caught early. 3️⃣ Train your people: Equip them with the skills to spot disinformation, phishing attempts, and manipulated content. 4️⃣ Partner with experts: Cybersecurity isn’t enough. PR, data analysis, and even AI tools can help combat the complex nature of disinformation attacks. 5️⃣ Build resilience: Have a plan for addressing false narratives publicly and decisively. Be fast, transparent, and authentic. Disinformation is the Trojan horse of the modern era. It enters unseen, and by the time you notice, the damage is done. Are you prepared to fight this invisible war to protect trust, integrity, and truth together. Drop your thoughts below! 👇 #CyberSecurity #Disinformation #Leadership #DigitalResilience #Trust

Definitely one of the more terrifying panels I've been on talking about disinformation and cognitive neurohacking with Jean-Marc Rickli and Gayle Markovitz. The World Economic Forum convened us as members of their Global Foresight Network to discuss this from a governmental, societal and company perspective. Some key takeaways? 1. The signal-to-noise crisis is an architecture problem, not a content problem. Don't focus on flagging bad content after the fact. The more durable intervention is designing trust architecture into systems from the start — continuous awareness, anticipatory action, radical transparency. 2. Agentic AI has changed the threat surface permanently. Disinformation used to require human effort at scale. Now it requires almost none. The implication for organizations isn't just better detection — it's system where human judgment is deliberately embedded into decision loops, not assumed to be there by default. The role of the human isn't diminishing; it's being redesigned. 3. Resilience against disinformation is an organizational capability, not a communications function. Companies that treat disinformation as a PR problem will always be reactive. The ones building real resilience are treating it as an operational risk that requires the same governance infrastructure as cybersecurity or supply chain integrity. It's a C-suite issue. #AI #FutureProof #Disinformation

THIS ISN’T JUST A SCAM. IT’S A PSYCHOLOGICAL CYBER ATTACK. 🚨 ALERT: SOCIAL ENGINEERING IS RIDING THE NEWS CYCLE AGAIN 🚨 This is not the first time current affairs have been weaponized to phish people. And it will not be the last. We saw it during COVID. Fake vaccine appointments. Bogus testing sites. Urgent health alerts designed to trigger fear and compliance. We see it during natural disasters. Fraud posing as relief agencies. Fake aid links. Exploitation of urgency and empathy. Now we are seeing it again. Recent scams impersonate government authorities and threaten deportation or legal action unless immediate payment or personal information is provided. Different storyline. Same playbook. With a massive snowstorm hitting large parts of the US, it is only a matter of time before weather-related scams follow. Fake emergency notices. Utility shutoff warnings. Storm assistance links. THE PATTERN IS ALWAYS THE SAME • Fear • Authority • Urgency • Immediate action This is no longer just a technical problem. It is a human risk problem. As cybersecurity leaders, we have prepared for ransomware, malware, credential theft, and supply chain attacks. Today’s threat actors are bypassing systems and going straight for people. WHAT LEADERS AND ORGANIZATIONS MUST DO ✔ Recognize that current events will always be exploited ✔ Train people to spot patterns, not just individual scams ✔ Incorporate real-world scenarios into targeted educational phishing and simulation campaigns When people recognize the pattern, fear loses its power. A REMINDER FOR EVERYONE Be vigilant. Practice basic cyber hygiene. Do not click unknown links. Do not respond to threats or fear tactics. Always pause and double-check. 🚨 IMPORTANT 🚨 DEPORTATION NOTICES AND GOVERNMENT ENFORCEMENT ACTIONS DO NOT COME VIA TEXT MESSAGE. EVER. 🙏 PLEASE SHARE THIS WITH ANYONE WHO MAY BENEFIT FROM THIS MESSAGE. AWARENESS SAVES PEOPLE. #Cybersecurity #RiskManagement #SocialEngineering #HumanRisk #SecurityAwareness #Leadership

💥 The Microsoft Digital Defense Report 2025 (July 2024–June 2025), 85 pages, paints a sharp picture of how cyber and information operations are now interwoven. What used to be two parallel worlds (technical breaches and narrative manipulation) are merging into 1 single threat space. The report confirms information manipulation has become a security problem. Identity theft, AI-generated content, and supply-chain infiltration now form a single continuum of hybrid threats. The solutions therefore also converge: identity resilience + AI awareness + trust architecture. Organisations must connect the dots between cybersecurity, communications, and credibility to withstand the next hybrid attacks. 🔍 The threats in numbers • 80 % of incidents aimed at data theft • tens of millions of identity-risk detections, 97 % of identity attacks still relied on passwords. • AI and automation are now mainstream in malicious operations : deepfakes, voice clones, synthetic media, auto-generated phishing at scale. ➡️These trends are reshaping influence operations. When stolen identities, fake profiles or synthetic videos are combined, information manipulation becomes an extension of the cyber threat. The same AI that writes malicious code can fabricate convincing propaganda. 🧠 The new face of information manipulation • AI-assisted disinformation is cheap, fast, multilingual: thousands of tailored narratives or fake visuals per hour. • Impersonation and account hijacking are replacing classic troll farms. Stolen corporate or governmental identities lend instant legitimacy to false messages. • Supply-chain manipulation increasingly involves communications ecosystems: hacked vendors, fake press releases, cloned websites or briefing documents. • Emotional manipulation (fear, outrage, tribal loyalty) is systematically exploited to amplify synthetic content through social platforms. The battlefield is not just servers, it’s public perception. 🛡️ The countermeasures 1. Protect identity, protect credibility. • Treat identity management as strategic infrastructure. • Deploy multi-factor authentication (MFA) and passkeys • Monitor for identity misuse: fake accounts, impersonation, abnormal access. 2. Integrate information integrity into cyber defence. • Include disinformation scenarios in cyber-incident response playbooks. • Pair Security Operations Center with StratCom teams. • Monitor for synthetic content or fake narratives that exploit ongoing technical incidents. 3. Educate and inoculate. • Train staff and publics to spot synthetic media and manipulated context. • Build quick-reaction capabilities to correct false or hijacked information early. #CyberSecurity #InfoOps #AI

“New research has revealed how AI-powered disinformation campaigns fabricating narratives around bank instability could pose a threat to the banking system. .. According to a study jointly authored by Say No to Disinfo and Fenimore Harper Communications, for every £10 spent on targeted digital ads, up to £1m in deposits could be withdrawn, highlighting the efficiency and cost-effectiveness of these operations in destabilising financial institutions.” ➡️ It is not just political elections that are a target to disinformation, banks (and the underlying economic system that depends on them) can be too. “Polling conducted among 500 UK residents revealed that 33.6% were extremely likely and 27.2% somewhat likely to move their money after seeing AI-generated financial misinformation. ➡️ the mechanisms behind these campaigns .. use AI to generate misleading headlines and fabricate narratives about bank instability. These messages are disseminated through doppelgänger websites that impersonate credible news sources, mass automated social media posts, and targeted advertisements. ➡️ The study found that financial institutions remain largely unprepared for AI-driven influence operations, as most focus their defences on cybersecurity threats rather than disinformation risks. .. urging banks to implement real-time social media monitoring, invest in disinformation specialists, and integrate threat intelligence with transaction tracking to detect early signs of a bank run.” https://lnkd.in/dvHpwHcA https://lnkd.in/dwcJBwDY #ai #genAi #cybercrime #regulation #risk #supervision Nafis Alam Prasanna Lohar Dr. Debashis Dutta

The award for scariest communication contribution of the week goes to Marcus Beard for his assessment that $150 of social media spend can cause $150 million damage to business. His contribution, along with the views of Edelman expert Nick Hope and Page Society member Bob Pearson are three timely contributions this week on the dangers and antidotes to disinformation. In a fascinating paper Marcus sets how Fenimore Harper Comms simulated an AI powered disinformation campaign with the goal of causing a bank run. He shows how the purchase of social media for $150, creation of doppelgänger websites, hostile MEMEs, untruths infecting AI and the consequence sharing of this information could cause a $150m run on a financial institution by undermining confidence, causing panic and getting people to switch their funds online. It all comes down to “influence operations exploiting cognitive biases”. They highlight the case of Silicon Valley Bank which they describe as the first “social media fuelled bank run” in 2023, losing $16bn in 10 days. At the same time PRWeek published excerpts from Nick Hope’s presentation to their Crisis Communications event – “countering disinformation in an era of weaponised culture” which argues that the widespread fear amongst the public of being discriminated against has created a powerful sense of grievance and a belief that “hostile activism is a viable means to drive change”. The third contribution from Bob Pearson, speaking at Dubai’s World Government Summit where he argued we have become too accepting of disinformation and we need to treat it “like pollution of the air and waterways”. He says that “the term data pollution helps people visualise the concern” and “governments have a responsibility to improve the cognitive security of their citizens”. Certainly, the antidote to disinformation is a mixture of government action, media vigilance, and public education. Marcus and Nick agree that disinformation usually contains a ‘grain of truth’, and this is what it makes credible, and people vulnerable. They also highlight the scale of fabricated content that is available through direct purchase and tools like Chat GPT. Both offer solutions. Hope calls for “preparation, training and technology to spot and respond to problems fast” and sets out four steps, to educate your team;  put in place early warning; build organisational resilience and quickly execute a response. Beard says it is “imperative to have a response plan in place ahead of a time” including recruiting an information threat analyst. This is all good advice and a timely reminder of the danger of weaponised digital disinformation. The GCS RESIST eight step toolkit remains a powerful tool to design a defence mechanism to disinformation, partly by identifying what is harmful disinformation that can damage reputation as opposed to harmless misinformed musings. Fundamentally all these approaches say one thing, which is if you fail to prepare you must prepare to fail.

FBI ISSUED A CRUCIAL ALERT regarding the surge of sophisticated AI-powered impersonation scams targeting individuals, including high-ranking U.S. officials and their associates. These attacks utilize deepfakes and spoofed phone numbers to perpetrate fraudulent activities like stealing credentials or initiating malicious actions such as wire transfers and malware installations. Key Risks: - AI-generated messages and replicated voices can now replicate individuals with remarkable accuracy. - Exploitation of trust renders traditional indicators (like typos, grammar errors, or unusual URLs) ineffective. - Voice and video deepfakes can mimic company executives or family members, coaxing financial or confidential information disclosures. Actionable Guidance: 1. Refrain from responding or clicking on links in unsolicited messages, emails, or calls—even if they seem to originate from familiar sources. 2. Verify independently. Use official contact channels for callbacks, not the provided number. 3. Educate teams and family members on the proliferation of deepfake scams; foster a mindset of healthy skepticism. 4. Strengthen your identity infrastructure. Implement least privilege measures, monitor for anomalies, and limit access to critical systems. 5. Instruct personnel to pause before complying with requests for credentials, payments, or urgent actions—regardless of how convincing they may seem. 6. Assess your organization's procedures for handling impersonation, credential compromise, and social engineering attacks. Bottom Line: AI is erasing the distinction between truth and deception in digital interactions. The FBI's advisory emphasizes the necessity for enhanced verification, unwavering vigilance, and investments in identity security. Treat identity protection as the new frontline in cybersecurity. https://lnkd.in/eKUUFcwF

Countering Cognitive Warfare: Why Businesses Must Care A recent paper, Countering Cognitive Warfare in the Digital Age, by Shane Morris et al., highlights how state-sponsored disinformation campaigns—like those orchestrated by #Russia’s GRU on #TikTok—are evolving into sophisticated cognitive warfare operations. These campaigns use #AI-powered bots and advanced language models to spread tailored #disinformation at scale, targeting public trust in democratic institutions and geopolitical stability. For businesses, this is not just a national security issue but a direct risk to operations and reputation. Disinformation can: ➡️ Undermine Consumer Trust: False narratives can damage brand credibility, influence customer sentiment, and fuel misinformation about products, services, or industries. ➡️ Make social engineering campaigns more effective: the case of the finance worker paying 25 million after a deepfake video call impersonating their CFO exemplifies this risk. ➡️ Threaten Workforce Resilience: Employees, like consumers, are susceptible to disinformation, potentially affecting internal culture and decision-making. The authors advocate for public-private collaboration, including real-time threat monitoring tools and radical transparency. For companies, this means investing in misinformation detection, training teams to spot manipulative content, and participating in industry-wide threat intelligence sharing. In an era where social platforms double as media powerhouses, protecting the information ecosystem is not just a public good—it’s a business imperative. #Cybersecurity #Disinformation #BusinessResilience #DigitalRisk https://lnkd.in/eWqtRFkD

"From the very top of Mount Sinai, I bring you these ten . . . cybersecurity regulations." In IT/cybersecurity, the "single source of truth" (SSoT) refers to the authoritative data source, representing the official record of an organization. The broader concept of the SSoT, however, can be helpful in fighting misinformation and disinformation: 1. OBTAIN THE ORIGINAL SOURCE DOCUMENT: Much of the news we hear can be tracked down to a SSoT--an original source document. The original source document can be a judicial opinion, text of a regulation, government or corporate press release, a scientific study, or an audio/video file. 2. FIND IT ON AN OFFICIAL SOURCE: The challenge these days is that with deep fakes, it is hard to know whether you have the SSoT or a fake. Thus, obtain a copy of the SSoT on an official source. For example, judicial opinions can be found on the court website or ECF Pacer. Legislation and proposed legislation can be found on Congress' website. Press releases are available on the issuing agency or organization's website. Scientific studies are usually available (for a fee) on the publishing journal's website or the sponsoring university's website. If you cannot find the SSoT on an official website, consider finding it through a "reliable" news source--one that independently and credibly fact checks its sources, and let's its audience know when it has not done that (e.g., WSJ, NYT, etc.). 3. READ IT YOURSELF: Once you obtain the SSoT, read it yourself, rather than relying on someone's characterization of the document or an AI summary of it. AI regularly hallucinates and mischaracterizes documents and humans often have their own spin or interpretation. See https://lnkd.in/eypgWCnd. 4. CONTEXT MATTERS: Just because you have read the SSoT doesn't mean it is accurate. First, consider what sources the SSoT cites. Are their sources cited at all? Are those sources reliable? Can you review the cited sources themselves? Also, consider who authored the SSoT. Is the author credible? Does the author have a reputation for accuracy and reliability? Consider Googling the name of the document to see whether there is controversy over its authenticity. 5. WHAT IS NOT SAID: When you are reviewing the SSoT, remember that what is NOT said in the SSoT is just as important than what is said. It is not uncommon for people (and perhaps as a result, AI) to make their own inferences and inject their own opinions into their discussion of a topic, when that inference or opinion is not a part of the original SSoT at all, and may be fair or unfair under the circumstances. Deep fakes are a significant problem but the truth is out there. We all bear the responsibility to find it.