AI-powered deepfakes and social engineering are now convincing enough to bypass your security systems, and most Australian businesses still have no policy governing how staff use AI tools with sensitive data.

I sat down with Dave Kenyon from Evolving Workforce, OAHI's podcast, to talk about the intersection of AI and cybersecurity, and what it actually means for leaders responsible for keeping their organisations safe. Here's what was on my mind.

A deepfake CEO scam works like this: a fraudster uses AI-generated video and audio to impersonate a company's CEO on a live Zoom or Teams call, then instructs an employee to redirect a payment to a new account. It is already happening to Australian businesses, and it succeeds because most meetings have no verification protocol for who is actually on the call.

What has actually changed with AI and cyber risk

The core risk hasn't changed. What has changed is scale. Two things are driving it.

1. The attack surface has multiplied. Every new app, browser extension or AI tool an employee signs up for is another entry point into the business.
2. Threat actors have automated sophistication. AI now lets attackers research a target, write a convincing message, and generate a fake voice or face at a scale that used to require a skilled human.

Why the attack surface keeps growing

Ten years ago, a business had a front door, a back door and a handful of windows: a few systems IT could see and monitor. Now every tool an employee adopts is another unmonitored door. Marketing picks up a new AI writing tool. Operations trials a free automation platform. Finance installs a browser extension to save ten minutes a day. Each one is a new entry point, and IT often doesn't know it exists.

Free tools carry the highest hidden risk. When a product is free, the business's data is the product. Company IP gets fed into tools with no visibility into where it's stored, who can access it, or how it might resurface later.

Ransomware vs data extortion: what's the difference

Ransomware locks a business out of its own systems and demands payment to restore access. Data extortion is the newer, more damaging version: attackers steal the data itself and threaten to release it unless they're paid, whether or not systems are ever locked.

Five or six years ago, ransomware was the standard threat: a virus, a countdown clock, a demand for Bitcoin. That threat hasn't disappeared, but sophisticated actors have moved to data extortion instead. Optus and Medibank are the clearest Australian examples. For a business that size, the damage was reputational as much as financial. For a mid-market employer, a breach of that scale is often not survivable.

The comparison I use with clients: if someone broke into your physical office with no security in place and walked out with everything, that could end the business. Losing control of your data carries the same consequences.

Why your people are the biggest cyber risk, not your firewall

Firewalls, anti-malware and anti-phishing tools all matter, but employees hold the keys and the alarm code, and they're the most exploitable part of any security posture. AI has made social engineering far more convincing.

How AI-powered social engineering actually works

It's no longer a poorly spelled phishing email. The pattern now typically looks like this:

1. A threat actor researches an organisation's staff on LinkedIn or Facebook.
2. They approach an employee posing as a colleague or friend: "Hey, I've locked myself out, can you send me your 2FA code?"
3. Because the approach looks personal and legitimate, the employee complies.

What a deepfake CEO attack looks like on a live call

Deepfake video calls are the sharper end of the same problem. A fraudster joins a Teams or Zoom call, using AI-generated video and voice to appear as the CEO, and instructs an employee to urgently change payment details or move money. It works because the employee genuinely believes it's their boss on the call.

This is a direct consequence of open meeting links with no identity verification. If your team's meetings don't require a PIN or a verification step for anyone joining, that's a same-day fix, not a next-quarter one.

The compliance risk in your payroll and HR data

The bigger risk here often isn't an external attacker. It's a well-meaning employee doing something that feels harmless at the time.

During the Lismore flood recovery, a worker processing a database of names, addresses, phone numbers and other personal details uploaded the entire file to a free version of ChatGPT to help organise it. That's a serious, unintentional breach.

Under Australia's Privacy Act 1988, that kind of loss of control over personal information is a notifiable data breach, plain and simple. New Zealand employers carry the same exposure under their own Privacy Act. A payroll spreadsheet pasted into a free AI tool to "clean it up" isn't a shortcut. It's a breach.

Why most businesses have an IT policy but no AI policy

Governance has not kept pace with adoption. Most businesses I talk to have a detailed IT usage policy and nothing at all governing AI.

A workable AI acceptable use policy doesn't need to be complicated. It can say, in plain terms:

• Staff may use the approved company AI platform freely for their role.
• Unapproved third-party AI tools are not permitted.
• No sensitive or personally identifiable information goes into any AI tool, approved or not, without a specific, sanctioned reason.

That clarity protects the business and removes the guesswork for employees.

Three things businesses handling this well have in common

1. One secured, sanctioned AI platform

Pick one AI platform, wall it off with proper permissions, and make it the only sanctioned option. It should sit inside the systems staff already use, including documents, spreadsheets and communications, rather than being a separate, unmanaged chat window. My current preference for most clients is Microsoft 365 Copilot, largely because it operates inside existing Microsoft permission structures rather than as a standalone tool outside them.

2. Continuous cyber awareness training

Treat cyber awareness training as continuous, not annual. Short monthly training videos and realistic simulated phishing tests, run by your own IT team, build the reflex that actually stops an attack. When someone clicks a test email, the follow-up conversation should be educational, not punitive. Everyone clicks something eventually. The goal is making the next real attempt less likely to land.

3. Verified identity on every sensitive call

Verify identity on every call that touches money, payroll or sensitive data. A PIN and a basic identity check on meeting links closes off the deepfake CEO scenario almost entirely.

Why this matters specifically for payroll and workforce data

Payroll and HR systems hold exactly the kind of data that makes both scenarios above expensive: names, bank details, addresses, tax file numbers, next of kin. Any platform handling that data needs access controls and audit trails built in, not bolted on after the fact. This is one of the reasons workforce platforms like OAHI's Time & Attendance and Pay Pulse are built around permissioned access rather than open data exports. The security question should be part of evaluating any payroll or workforce system, not an afterthought once something has already gone wrong.

What business leaders should do about it

Cybersecurity needs to sit with leadership as a live, evolving risk, not as a line item revisited at the annual IT budget review. The threat actors targeting Australian and New Zealand businesses today aren't individuals guessing passwords. They're organisations running AI-powered tools that can probe hundreds of attack vectors at once, faster than any human security team can respond.

None of the fundamentals here are complicated:

1. Secure one AI platform and wall it off.
2. Write the AI acceptable use policy.
3. Train people every month, not once a year.
4. Verify who is actually on the call before anyone moves money or data.

The businesses that build these habits now will be dealing with a materially smaller problem than the ones that wait for an incident to force the issue.

This conversation is from OAHI's Evolving Workforce podcast.

About James Vickery James Vickery is the CEO and Founder of Benchmark 365, a Sydney-based managed IT services company he founded in 2016 after more than a decade running his own MSP, iKnowIT. With over 20 years in business IT, security, cloud and infrastructure, James is known for giving leaders straight answers on complex technology challenges. He is also the author of Infinite Scale. Benchmark 365 works with businesses across Australia to design, secure and manage technology environments built for growth.

‍

To see how you can simplify your award interpretation, rostering and payroll compliance book a free session with OAHI here.

‍