A city CISO runs a tabletop where staff examine AI-generated phishing that appears personalized from public professional bios. What should analysts recognize?
Select an answer to reveal the explanation.
Short Explanation
If LinkedIn says you love trail running, an AI lure might casually mention that too. Public crumbs are not a secret handshake that proves the mayor emailed you. Verify weird asks out of band anyway.
Full Explanation
In a city CISO tabletop where staff examine AI-generated phishing that appears personalized from public professional bios, analysts should recognize that AI can weave publicly available bio details into personalized lures, so staff must still verify unusual requests out of band. Public crumbs—job titles, conference talks, hobbies, or LinkedIn summaries—are enough for generative models to produce a message that feels individually tailored without any insider breach. Personalization therefore is not proof of legitimacy, MFA completion, or an internal leak by itself. Claiming personalization tokens prove the sender completed MFA so the message is safe confuses content flavor with authentication state. Asserting public bio details cannot be used by AI, so personalization always indicates an insider leak, misattributes open-source enrichment to insider threat and will generate false incident narratives. Saying only private HR files enable personalization while open-source bio text is irrelevant underestimates OSINT-driven AI phishing risk. Exam caveat: GOAA personalization items teach that public-data AI lures still demand out-of-band verification for unusual asks. Operational check: coach staff that familiar personal details in mail are non-probative; verify money movement, credential, and access requests through known official channels.