CISOs aren't losing sleep over hypothetical AI doomsday scenarios or empty vendor buzzwords. The conversations that matter most focus on the delta between security optics and operational reality.
The real questions being asked are:
- “If one of our AI agents goes sideways, how far can it get before we notice?”
- CISOs are actively worried about autonomous or semi-autonomous AI agents that can issue API calls, move data, and chain actions faster than existing controls can detect. The core risk here is “blast radius before detection,” which is exactly how many are starting to frame AI-agent risk.
- “Could someone talk their way through our help desk or finance workflow today?”
- Social engineering against support and finance processes remains one of the most common and successful attack paths, especially when combined with deepfakes and convincing AI-generated pretexts. CISOs routinely frame this as “can an attacker traverse our people-and-process controls as easily as our technical ones?”
- “When an attacker finally lands, do we actually see them in time to matter?”
- Median “dwell time” and the fraction of breaches detected internally vs. by third parties are standard executive metrics, and reducing time-to-detection is a central CISO priority. This question captures that urgency in plain language.
These questions converge into five practical threat categories that Lares adversarial engineers encounter in real environments, not just on marketing slides. This post breaks down each threat with current data and clear next steps to help you prove your defenses instead of guessing
1. Agentic AI and Shadow Agent Risk
Agentic AI is not “just another chatbot,” It is a system that reads goals, decomposes them into tasks, calls APIs, and acts with increasing autonomy. This power creates a massive attack surface where any text or integration that an agent can reach becomes a potential exploit path.
Why CISOs Care
Recent reports and Lares engagements align on a few hard truths:
- Shadow AI: 70% of operations professionals are already using unapproved or “shadow” AI tools. (Smartsheet Research, 2026).
- Identity Bloat: Machine identities now outnumber human identities many times over, yet most security programs haven't caught up. (Microsoft, 2025).
- Prompt Injection: OWASP ranks prompt injection as the #1 threat, appearing in 73% of deployments. (OWASP, 2025).
- Persistent Exploits: Vulnerabilities like EchoLeak (CVE-2025-32711) and MCPoison (CVE-2025-54136) have shown how poisoned documents or configurations can reprogram agents to exfiltrate data or execute attacker commands without user interaction. (OWASP, 2025)
In practice, that means a poisoned document, repository, calendar invite, or plugin can silently reprogram an agent. Once memory is involved, a one‑time injection can become a persistent behavior change across sessions.
What CISOs Must Do
From a leadership perspective, four actions stand out:
- Inventory agents and privileges: treat agents as identities with owners, scopes, and lifecycles, not just features.
- Define trust boundaries: decide explicitly what agents can access and change autonomously versus what requires human approval.
- Implement kill switches and blast‑radius limits: design clear, testable ways to halt or constrain agents that behave unexpectedly.
- Monitor for behavior drift and memory poisoning: track how agents act over time and where their “beliefs” come from.
Mitigation
- Simulating prompt injection, memory poisoning, tool misuse, and cascading failures using realistic inputs such as emails, repos, calendar invites, and web content.
- Mapping how far an attacker‑influenced agent can move across your environment before controls trigger.
- Working with your teams to tighten scopes, approvals, and monitoring around the agents that matter most.
For a deeper breakdown of the OWASP Agentic Top 10 and the incidents behind each issue, see Lares Labs’ “OWASP Agentic AI Top 10: Threats in the Wild.”- Raúl Redondo
2. Social Engineering and Vishing at AI Scale
Social engineering remains the most reliable way into most organizations. AI has made it faster, more convincing, and easier to scale.
Why CISOs Care
- Vishing attacks increased by 442% in the second half of 2024, reflecting how attractive phone‑based fraud has become to attackers. (Crowdstrike, 2025).
- Just a few seconds of captured voice can be enough to generate a highly convincing clone with consumer‑grade tools.
- AI‑generated phishing content achieves significantly higher click and engagement rates than traditional, manually written phishing. (Interpol, 2025).
Attackers now routinely combine:
- Role‑specific, LLM‑written emails that match your internal tone.
- Voice clones of executives, partners, or even family members.
- OSINT from LinkedIn, GitHub, and public records to create pretexts that feel personal and timely.
Lares sees this in the field when help desks and finance teams follow policies in theory but still approve resets or payment changes when a “busy executive” applies the right mix of urgency and context over the phone.
Mitigation
- High‑fidelity phishing and vishing simulations that target real workflows such as password resets, payroll changes, and vendor banking updates.
- OSINT‑driven pretexts built from your organization’s public footprint, not generic boilerplate.
- Detailed feedback that turns findings into changes in both controls (callbacks, dual control, logging) and culture.
You can explore our perspective and methodology in:
- Social Engineering Services
- Social Profiling – OSINT for Red/Blue
- SE101: What Is Social Engineering?
3. Visibility and Response Under Real Intrusions
The market talks about XDR, MDR, and “AI‑powered SOCs.” The performance question for CISOs is simpler: when someone is in your environment, how fast do you actually see them, and how fast can you contain them?
Why CISOs Care
Recent reports and Lares engagements align on a few hard truths:
- A majority of security teams acknowledge visibility gaps across hybrid environments, especially in cloud and SaaS assets and identities.
- Average breakout times have fallen into the tens of minutes, shrinking the window in which detection and response can meaningfully change outcomes.
- XDR and MDR platforms can materially reduce mean time to detect, but only when visibility, detections, and playbooks are tuned to real attack paths.
Lares often finds:
- Critical assets and identities missing from inventories and logging.
- Identity abuse and SaaS pivoting that generate little or no signal in SIEM/XDR.
- Detections tuned for commodity malware while attacker activity plays out through valid credentials and admin tools.
In Purple Team engagements, identity, cloud, and SaaS lateral movement are frequently where attacks go quiet, even in organizations with strong endpoint coverage.
Mitigation
- Red Teaming to exercise end‑to‑end attack chains across endpoints, identity, cloud, and SaaS.
- Purple Teaming to replay those chains with your SOC, tuning detections and playbooks until they reliably trigger and drive the right actions.
- Delivery of evidence: real MTTD/MTTR for specific techniques and paths, not just theoretical SLAs.
For more detail, see:
- How Adversaries Actually Test Enterprise Environments
- From Low‑Value Identity to High‑Value Impact: A Realistic Attack Chain
- From Attack to Defense: How Lares Purple Teaming Exposes and Closes Security Gaps
4. OT and Critical Service Resiliency
Why CISOs Care
Recent reporting on critical infrastructure highlights:
- Taiwan’s National Security Bureau reported around 2.63 million daily intrusion attempts against government and critical infrastructure, an increase of more than 100% year‑over‑year. (Industrial Cyber, 2025)
- Ransomware campaigns against industrial operators have grown in volume and sophistication, with some analyses noting a 46% jump in a single quarter. (Honeywell, 2025)
In converged IT/OT environments, Lares frequently encounters:
- Vendor remote access paths with weak authentication and monitoring.
- Flat or poorly segmented networks where an IT foothold can reach OT zones more easily than diagrams suggest.
- Operational teams and security teams working from different assumptions about acceptable risk and change control.
Mitigation
- Mapping real IT‑to‑OT attack paths, including directory services, jump hosts, and remote access solutions.
- Running tightly scoped simulations to test segmentation, monitoring, and incident handling without disrupting production.
- Aligning exercises with frameworks such as IEC 62443 while grounding them in “what this would actually look like here.”
This gives CISOs and operators evidence of how cyber events might unfold and where resilience needs improvement, without putting critical services at risk.
5. Deepfake-Enabled Social Engineering: When Trust Itself Is the Target
Deepfakes and synthetic identities have moved to the center of fraud and influence operations. Trust itself is now a primary attack surface.
Why CISOs Care
Recent threat intelligence and fraud data show:
- Deepfake‑as‑a‑Service platforms and tooling exploded in popularity in 2025, driving a steep increase in synthetic media used in attacks.
- Many users cannot reliably distinguish cloned voices or synthetic video from real people, especially when combined with believable context.
- Synthetic identity and deepfake‑enabled schemes contribute significantly to rising fraud losses globally.
Attackers are combining:
- Realistic synthetic documents such as pay stubs and identity papers.
- “Live” video or audio calls where a cloned executive or partner requests time‑sensitive actions.
- Multi‑channel workflows that build trust by using email, chat, and calls together.
Lares sees multi‑channel scenarios as particularly effective in testing: realistic documents plus a convincing call can pressure staff into action unless structural safeguards are in place.
Mitigation
Rather than treating deepfakes as a standalone problem, Lares folds them into broader adversarial exercises:
- Identifying high‑impact workflows where impersonation would be catastrophic: wire transfers, vendor onboarding, executive approvals, regulatory filings.
- Designing multi‑channel simulations that could realistically occur in your environment, with synthetic media as one component.
- Measuring where verification steps fail and where process or tooling changes (callbacks, dual approvals, channel binding) reduce risk.
The goal is not to rely solely on detection tools, but to redesign processes so that no single channel or representation (voice, face, document) can authorize high‑impact changes by itself.
Bringing It All Together
These five threats do not exist in isolation; in real incidents, they chain into a single compromise. An agentic assistant misuses tools after goal hijack or prompt injection. A vishing or deepfake call then convinces staff to reset an account or approve a change, quietly extending attacker reach. Visibility gaps around identity and SaaS mean this sequence can unfold with little or no meaningful alerting. OT or finance workflows finally feel the impact through disrupted operations or fraudulent transactions, and by then, the damage is already done.
The job of security leadership is to break this chain at as many points as possible through design, controls, and culture.
Lares’ adversarial engineering model is built around how attackers think about that chain:
- Start at realistic footholds: a low‑value identity, a misconfigured integration, a believable phone call, a poorly governed agent.
- Move like an adversary: across AI agents, humans, endpoints, cloud, SaaS, and OT, following the same patterns threat actors use.
- Work with defenders: using Purple Team collaboration to turn findings into tuned detections, faster playbooks, and better processes.
If you want to understand how these five threats would actually play out in your environment, the next step is not another generic trend deck. It is an engagement that lets you watch your defenses perform against realistic attacks and gives you evidence you can take to leadership.
Ready to validate your defenses against 2026’s most critical threats?
- Start with an adversarial engineering engagement focused on one priority area (agentic AI, social engineering, visibility and response, OT, or deepfake‑enabled fraud) and expand as you build evidence of what works and what still needs work.
- Contact Lares on our website, email sales@lares.com, or explore more insights on the main blog and Lares Labs to see how our team approaches these problems in depth.
References
- Smartsheet Research. (2026). Shadow AI Risks. https://www.smartsheet.com/operational-excellence-report-2026
- Microsoft. (2025). Securing and Governing Autonomous Agents https://www.microsoft.com/en-us/security/blog/2025/08/26/securing-and-governing-the-rise-of-autonomous-agents/
- OWASP. (2025). Agentic AI Top 10. Retrieved from https://labs.lares.com/owasp-agentic-top-10/
- CrowdStrike. (2026). Cybersecurity 2026 Report. Retrieved from https://www.crowdstrike.com/en-us/resources/
- Interpol. (2025). Social Engineering Scams. Retrieved from https://www.interpol.int/en/Crimes/Financial-crime/Social-engineering-scams
- Industrial Cyber. (2025). Taiwan’s NSB Reports Cyber Attacks on Critical Infrastructure. Retrieved from https://industrialcyber.co
- Honeywell. (2025). Ransomware Attacks Targeting Industrial Operators Surge 46%. Retrieved from https://www.honeywell.com/us/en/press/2025/06/ransomware-attacks-targeting-industrial-operators-surge-46-percent-in-one-quarter-honeywell-report-finds