A phishing email written in fluent English. A convincing request for access. A ransom demand shaped around the recipient’s concerns. AI-enhanced cyber attacks can use more persuasive communications to increase the pressure on the people expected to recognise an attack and respond to it.
That pressure can continue after a breach, as attackers contact customers, brief journalists or challenge company statements. While IT teams contain the incident and restore services, communications staff and leadership need to provide reliable updates with incomplete information. Continuity plans need to prepare these teams to work together.
How AI is improving attacker communications
S-RM’s Cyber Incident Insights Report 2026, with contributions from FGS Global, draws on more than 800 incidents its team responded to during 2025. Its Closer to home? section describes more deliberate attacker communications, clearer deadlines and better-constructed arguments.
The report suggests that large language models have likely improved established ransomware groups’ communication and negotiation capabilities. It also highlights attacks involving social engineering, helpdesk manipulation and identity recovery abuse, where fluent English and cultural familiarity gave attackers an advantage.
AI can help criminals reduce language barriers and tailor messages to their targets. Poor grammar and awkward wording are therefore unreliable indicators of a malicious request.
The report’s ThreatGPT section provides context. Fully autonomous attacks were not driving financially motivated incidents at scale in the activity described. Attackers were using AI to accelerate research, content generation and code development.
The NCSC’s assessment of AI and cyber threats similarly identifies AI’s role in improving existing techniques, including social engineering.
How AI-enhanced cyber attacks can disrupt services
An attacker may persuade someone to disclose credentials, approve an authentication request or change account access. A compromised account could then support impersonation, data theft or attempts to gain further access.
Containing the incident can interrupt normal work. Accounts may need disabling and systems isolating, leaving staff without email, shared files or business applications.
Continuity plans should establish which work can continue during these restrictions and how employees will receive instructions. Identity checks must also hold up under pressure. Teams need approved verification procedures, escalation routes and authority to refuse requests when checks fail, even when the sender sounds familiar or claims urgency.
Your public response may become part of the attack
FGS Global describes threat actors briefing journalists about stolen data and scrutinising company statements. Attackers may challenge claims about the incident or contact employees and customers to increase pressure.
An unsupported recovery deadline can leave customers planning around an unavailable service. A premature statement about affected data may need correcting as investigators uncover further evidence.
Communications planning should establish how verified information reaches decision-makers, who approves updates and who speaks for the business. It should include an alternative coordination channel if normal tools are unavailable or compromised.
Updates should distinguish confirmed findings from questions still under investigation.
Rehearse recovery decisions
A successful backup job does not establish how quickly a service can return. Recovery also depends on trusted access, application dependencies, available staff, and checks that restored systems are safe to use.
Exercises should test these dependencies alongside technical restores. Useful questions include:
– Which services must return first?
– How will recovery staff work if administrator accounts are compromised?
– Who checks restored data and approves its use?
– How will staff and customers receive updates?
A rehearsal may reveal inaccessible contact lists, missing credentials or approvals dependent on one person. These gaps are easier to address before an incident.
Preparing with CiContinuity
CiContinuity brings over 20 years of experience and has supported more than 2,500 recovery operations. We combine backup, disaster recovery, security consultancy and business continuity planning to help customers prepare for disruption and restore services.
Our partnerships with Veeam and HPE support backup and recovery through our UK sovereign CiCloud environment. Alongside this technology, we help customers strengthen identity controls, plan communications and define incident response responsibilities.
Recovery rehearsals test how these arrangements work under pressure, including when normal systems cannot be trusted.
Contact CiContinuity to plan your recovery before you need it.