The old security model was fairly straightforward: protect the servers, secure the endpoints, and build a wall around the network.
It’s still necessary, but solely relying only on that is a losing strategy in a landscape changing this quickly.
As hyper-connectivity and AI proliferate, so are modern threats. They are making their way into the daily comms channels where the most sensitive information lives, like workspace tools, messages, calls and videoconferences all now targets.
This autumn, Gartner research confirmed this growing threat surface, with 41% of CISOs reporting audio-based deepfake social engineering incidents in the last 12 months, and 36% reporting similar attacks during video calls. Overall, 62% of organizations experienced deepfake attacks targeted at employees or processes.
Rethinking your enterprise security strategy
IT systems have been priority number one for enterprise security since the early days of computing. But whereas in the past organizations would run operations through internal servers, these days it’s primarily through communication channels. This new reality demands a reset in strategy. We need to start by treating comms systems with the same weight as critical infrastructure.
Since the widespread adoption of smartphones 15 years ago and the most recent integration of the Internet of Things (IoT), hyperconnectivity has been one of the defining characteristics of modern life. Nowadays, we are in an “always-on” state, which has transformed how we work and interact with the world around us.
Communication is now continuous, instant and spread out across various channels. This has made it very difficult for security teams to maintain total visibility. This has introduced unprecedented vulnerabilities that can no longer be contained by protecting systems alone.
How modern attacks target people
Verizon’s latest findings show that the human element (any breach involving human action or interaction, rather than purely technical system exploits) now accounts for 62% of all enterprise security breaches. Modern attackers are actively exploiting trust over tech: in phishing simulations, mobile-centric vectors like voice and text messaging saw a 40% higher click-through rate than traditional email.
As AI improves, these tactics are becoming even more dangerous. Attacks are now automated, hyper-targeted, and convincingly credible across every communication channel, including instant messaging, voice calls, and videoconferencing.
You just have to look at what happened to Fideuram earlier this year when fraudsters executed an historic €95 million (£79m) heist against the Italian private bank. By combining AI voice clones with deceptive WhatsApp messages impersonating both a lawyer and the company’s CEO, the attackers tricked executives into authorizing the massive fraudulent transfers.
It proves that modern-day attackers can successfully manipulate trust, sway decision-making, and walk away with millions.
Measuring the financial fallout
A single lapse in security can deal a devastating blow to an organization’s profitability. The global average cost of a data breach reached $4.99m this year, a 12% increase over last year and a record high.
According to IBM’s Cost of a Data Breach Report, AI-driven cyberattacks increased by 56% year-over-year, led by deepfake impersonation (45% of AI attacks) and AI-enabled malware. These incidents account for roughly one in four malicious breaches, add an average of $1 million to the cost of a breach (bringing the average AI-enabled breach cost to $6 million), and are heavily led by deepfake impersonations and AI-enabled malware.
When sensitive data and confidential information is exposed an organization is also stripped of its digital sovereignty as they lose complete control over their IP and regulatory compliance. For smaller businesses, the fallout can be existential. Many may never recover from the weight of regulatory fines, operational downtime, and destroyed reputations.
When sensitive data and confidential information is exposed, an organization is also stripped of its digital sovereignty as they lose complete control over their IP and regulatory compliance.
It is therefore paramount that businesses consider their messaging, videoconferencing, and calls as critical infrastructures, in the same way they do for servers and databases. If they don’t they leave themselves vulnerable to bad actors and competitive spies.
Securing your comms channels
Safeguarding communication channels is now a strategic imperative which necessitates a three-pronged approach.
Firstly, businesses should unify their tools, in doing so reducing fragmentation. This limits entry points. Secondly, they should integrate security into their solutions from the get go. And thirdly they should master data flows and hosting to maintain control and guarantee governance.
Many companies still rely on very basic protections which do not suffice in an attack landscape in which convincing deepfakes are prevalent.
But these steps will put comms on par with infrastructure or data as a strategic asset. Prioritizing this level of security represents a high-return strategic investment, safeguarding operational continuity and organizational autonomy.
The bottom line is this: Modern operations run on communication, so conversational channels are now the primary attack vector. Business resilience is largely won or lost here.
By securing full control over your communications and data – and eliminating external dependencies – businesses can establish a defense that is just as crucial as technical security itself.
____________
About the Author
As CPSO, Vincent Lomba leads all cybersecurity projects and activities to ensure that products and solutions both developed and supported by Alcatel-Lucent Enterprise meet the highest applicable standards. He is responsible for helping the company to adopt all necessary best practices, from changing operational models to ensuring cybersecurity requirements are met in each and every part of the organization, while also aiding CxOs in their decisions. Vincent conducts internal and external ISO 27001 audits, and lead the global project to drive the organization towards Cyber Resilience Act compliance. In 2025, he has been appointed by the EU’s cyber security agency, as member of the Advisory Group of ENISA.
He has more than 30 years of experience in the worldwide IT, network and telecommunications technologies and markets. In his past experiences, Vincent has driven new solution creation and launching as Product Line Manager. He has overseen the Communication Division business development worldwide team, in charge of supporting sales and business partners, and develop tailored solutions for highly demanding geographies. He has collaborated with many IT & communication industry leaders worldwide.
Vincent holds a Master of Engineering in Computer Science & Digital Signal Processing. He completed initial education by a full Information Security curricula and owns various cybersecurity certifications.
Join our LinkedIn group Information Security Community!
——————————————————-
Click Here For The Original Source.
