The Attacks Getting Through Your Filters (and How AI Is Scaling Social Engineering)

About this episode

The episode discusses how attackers are still bypassing advanced email security filters and the role of AI in scaling social engineering attacks.

Episode #10 Email security filters have never been better... and yet attackers are still getting through. In this episode, host Eliot is joined by Petri Kuivala (CISO advisor) and David Badanes (Human Risk Management advisor) to break down what actually makes it past modern defenses, based on analysis of 400,000 real attacks reported by users - not simulations, not theory. They unpack how generative AI didn’t invent new attack types, but dramatically scaled social engineering, why perfect grammar is now a warning sign, how MFA is being bypassed via session hijacking, and why humans remain one of the most effective detection layers when systems fall short. What you’ll learn in this episode: Why phishing emails still get through secure email gateways and which attacks filters miss most often How AI is scaling social engineering through volume, personalization, and speed (not magic) Why “better language” and polished branding can now be stronger phishing signals How attackers bypass MFA using attacker-in-the-middle tooling and stolen session tokens Why QR codes, voicemail (vishing), and non-email channels are becoming more effective Real-world examples of deepfake voice and…

People in this episode

Host: Eliot Baker

Guests: Petri Kuivala, David Badanes

Topics covered

• email security
• social engineering
• AI
• phishing
• MFA bypass

Keywords

• email filters
• attack analysis
• human detection layer

Mentioned in this episode

Products: generative AI, MFA, session hijacking tools

More episodes of All Things Human Risk Management

• Your Security Awareness Program Has Plateaued - What Happens Next? · March 12, 2026 · 1h 2m
• The Ethical Guide to Security Storytelling: Navigating Real Breaches with Care and Respect · February 2, 2026 · 34 min
• Does Security Awareness Training Even Work? Fixing the Flaws Behind “Training Fails” Headlines · November 16, 2025 · 38 min
• State of Phishing 2025: Why SVGs Spiked (and What Still Works) · October 30, 2025 · 46 min
• A CISO’s Playbook for Security Comms (with Jeffrey Brown) · October 14, 2025 · 53 min
• Virtual Kidnaps, Fake CFOs: Social Engineering Defense in the Age of AI · September 18, 2025 · 38 min