SECAI Core · phase 11 of 15
Impersonation
Social engineering attack where an attacker pretends to be someone they are not.
The Explain card
- Plain English
- Impersonation is a social engineering attack where the attacker pretends to be someone they are not: a colleague, an executive, a vendor, or a support agent, in order to gain trust and access.
- Example
- A finance clerk gets a video call from what looks and sounds like the CFO, generated with AI voice and face cloning, urgently approving a wire transfer to a new supplier.
- Why it matters
- Generative AI makes convincing impersonation cheap and scalable. Defenders need out-of-band verification for sensitive requests, because "it sounded like them" is no longer evidence.
- Hook
- The mask is now made of pixels.
Where it sits in the deck
Phase 11: Threat Landscape: Attack Vectors and Adversarial Techniques
With defences named, learn what they must defend against — the full catalogue of attack techniques targeting AI systems, their inputs, outputs, training pipelines, and supply chains.
