A phishing email used to give itself away with clumsy grammar and a generic greeting. That tell is mostly gone. In an October 2026 overview, ThreatLocker describes nine ways attackers now use AI, from personalized phishing written at scale to voice and video deepfakes of executives to “shadow AI” tools that employees install on their own. For a small office, most of them come back to a handful of controls.
Better phishing, same goal
The messages are better written. What they ask for has not changed: someone types a password into a fake sign-in page, approves a payment, or opens an attachment. ThreatLocker’s advice for AI-written phishing is to limit what a stolen login can reach. Restrict access to business applications, check that the device signing in is one you know, and keep each account’s permissions narrow.
Multi-factor authentication earns its keep here. A convincing email that captures a password still stops at the second step, and for Data Cube Systems clients who use Duo, that second step is a prompt on a phone the attacker does not have.
The phone call that sounds like your boss
Synthetic voice catches people off guard. A call that sounds exactly like the owner, asking the bookkeeper to wire money before a closing, is now cheap to produce.
No software setting fixes this one. The fix is a rule everyone knows: any request to move money, change bank details or share a login gets confirmed through a second channel, such as a call back to a number already on file. Write the rule down. Then tell the people who handle payments that they will never be in trouble for following it, even when the request really is from the boss.
Malware written faster
AI also helps attackers turn out new malware variants quickly, which hurts any tool that depends on recognizing known bad files. Deny-by-default execution sidesteps the problem. A program that has not been approved does not run, no matter how new it is.
That is how ThreatLocker works on the computers Data Cube Systems manages. Applications your company already uses, and the built-in applications ThreatLocker supports, are approved automatically. Anything new or unknown is held and sent to Data Cube Systems for review, and some approvals need sign-off from your own management. It is slower than clicking Install, and the delay is deliberate.
Shadow AI on office computers
The category that is easiest to miss is staff adopting AI tools without telling anyone. A browser plugin that summarizes email, or a desktop assistant that can read the files on a computer, may be sending client data somewhere nobody approved. For a law firm or a medical practice, that is a confidentiality problem before it is a security one.
Allowlisting covers the desktop side, because an unapproved AI application goes through the same review as any other new program. Browser plugins and AI websites need web controls and a short written policy on which tools staff may use, and with which data.
What to do this week
- Turn on multi-factor authentication for email and remote access anywhere it is not already on.
- Adopt a call-back rule for payment and bank-detail changes, and tell the people who handle money.
- Ask your team which AI tools they use for work. Most offices learn something from the answers.
When something gets through
No single control stops everything, so Data Cube Systems runs a second layer. SentinelOne watches each managed computer for attack behavior, with its own 24x7 security operations center behind it, and it can roll a computer back to its state before ransomware encrypted it. ThreatLocker’s 24x7 SOC watches the allowlisting side. Security awareness training covers what software cannot: the moment a person decides whether a message is real.