Accelerating cybersecurity risks require an AI Center of Excellence—and a stark reminder from Lady Whistledown.
This article provides current insights into the increasing risks of cybersecurity enabled by AI. It also stresses the importance of an AI Center of Excellence (COE) to ensure more effective governance and risk management. It follows at the end with a commentary by Lady Whistledown as a reminder of the imperative in all the lands.
Introduction
Artificial Intelligence (AI) has grown so rapidly that cybersecurity risks have reached record-high incident volumes in 2025. Already, global organizations face, on average, over 2,000 cyberattacks per week, which is a 72% increase compared to 2023. AI is now an integral part of the cyber criminal toolkits, allowing even low-skilled actors to launch advanced campaigns at a fraction of the traditional cost. Recent statistics highlight the severity of this surge:
-
149% increase in ransomware incidents, driven by AI-powered automation
-
$5.72 million average cost of an AI-powered breach, representing a 13% increase over traditional breaches
Vulnerability Statistics by Industry (2025)
Certain sectors face higher risks due to the value of their data or the critical nature of their operations.
The Key Threat Vectors
Phishing and Social Engineering – using Generative AI methods now eliminates some of the prior clumsy or poor grammar that could alert consumers that a message was not from a valid source. There has been over a 1,500% surge in phishing attacks attributed to generative AI tools. These tools use advanced text generation and obfuscation techniques. What is particularly concerning is how convincing these phishing emails have become—they now achieve a 60% higher click rate than traditionally crafted ones, and they will only improve over time. It is becoming increasingly more difficult to know what’s real or not
Deep Identity Fraud – this is an area that has surged well over 2000% over the past three years, with over 60% of organizations experiencing a deepfake incident. As attackers use voice and video cloning methods to impersonate executives, this leads to massive financial losses.
Automated Vulnerability Exploitation: AI has slashed the time between a vulnerability being disclosed and its exploitation. Exploits that once took days or weeks to develop can now appear within hours or minutes. 32% of organizations reported attacks specifically targeting their AI applications, such as prompt injection.
Cybersecurity AI – Case Example
Arup
Arup, a British multi-national engineering firm, suffered a massive financial loss of approximately $25M USD due to a sophisticated deepfake video scam in early 2024. The Incident: A finance worker at Arup’s Hong Kong branch was tricked into attending a video conference call, believing they were speaking with the company’s UK-based Chief Financial Officer (CFO) and other senior staff.
The Scam: Every other participant on the video call was an AI-generated deepfake (re-creations of real employees). The scammers used pre-recorded video and voice-cloning technology to make the participants look and sound authentic.
The Loss: Following instructions from the fake CFO, the employee transferred a total of HK$200 million ($25MUSD) across 15 transactions to five Hong Kong bank accounts.
The Discovery: The fraud was discovered about a week later, after the employee followed up with the real company management. Arup’s global chief information officer, Rob Greig, stated that the company’s operations were subject to a sharp increase in sophisticated attacks, including voice spoofing and deepfakes, noting that such attacks are rapidly increasing globally.
Other Examples
Deepfake Voice Cloning in Call Centers (2024–2025): Major banks have reported being overwhelmed by deepfake voice clone calls. Attackers use AI to clone a customer’s voice to bypass speaker-based authentication systems to initiate fraudulent transactions.
Ransomware at Marquis Software Solutions (August, 2025): A vendor of hundreds of banks exposed the personal data of over 672,000 customers in a ransomware attack that leveraged AI tools to identify system vulnerabilities.
AI Becomes the Defense
Organizations using security AI and automation identified breaches 108 days faster than those without it, saving an average of $1.9 million per incident. However, only 13% of organizations currently possess the advanced cyber capabilities needed to fully defend against modern, AI-driven threats.
The emergence of Artificial Intelligence (AI) has transformed the modern enterprise, offering unprecedented efficiencies and predictive capabilities.
To harness this power, many organizations have established a Center of Excellence (CoE)—a centralized team responsible for setting strategy, sharing best practices, and governing AI adoption.
However, as AI becomes deeply integrated into business operations, it introduces a new frontier of digital threats. To protect organizational integrity, a strong CoE must move beyond simple implementation and prioritize a rigorous cybersecurity governance framework that addresses the unique, evolving risks of the AI era.
The New Risk Landscape: AI-Specific Vulnerabilities
Traditional cybersecurity measures are often ill-equipped to handle the nuances of machine learning. Within a CoE framework, several critical risks must be addressed. Chief among these are adversarial attacks and data poisoning. In an adversarial attack, malicious actors feed subtly manipulated inputs to a model to trigger incorrect outputs—such as tricking a financial AI into approving a fraudulent loan. Data poisoning is even more insidious, occurring during the training phase when an attacker injects corrupted data to embed biased or harmful behaviors directly into the model’s logic.
Furthermore, the rise of Large Language Models (LLMs) has introduced risks like prompt injection, where users manipulate an AI’s instructions to bypass safety guardrails or leak sensitive data. Beyond external threats, “Shadow AI”—the unauthorized use of AI tools by employees—poses a massive risk for data leakage, as proprietary information may be inadvertently fed into public models, compromising intellectual property.
The Imperative for Stronger Cybersecurity Governance
In the context of a CoE, governance is the bridge between innovation and safety. Without a centralized authority to dictate security standards, AI adoption becomes fragmented and dangerous.
Strong governance ensures accountability, defining exactly who owns a model’s performance and security throughout its entire lifecycle. A robust governance strategy involves the adoption of specialized frameworks, such as the NIST AI Risk Management Framework or ISO/IEC 42001.
These standards help a CoE move from a reactive to a proactive stance. This includes implementing “Human-in-the-Loop” oversight to prevent automation bias—the tendency for humans to uncritically trust machine outputs—and conducting regular “Red Teaming” exercises.
By simulating sophisticated AI-driven attacks, a CoE can identify weaknesses in its models before they are exploited by real-world adversaries. One of the leading companies helping organizations to identify, evaluate, predict, and resolve cyber threats is Canadian cybersecurity software company, Protexxa. Its Protexx Defender product helps organizations to identify, evaluate, predict, and resolve cyber threats. With 90% of cyber breaches originating from human error, helping organizations to enhance personal cybersecurity literacy is crucial to reduce risks from phishing and deep fakes.
Being able to have automated remediation and response intelligence to not only identify the risks but fix them and have ongoing alert intelligence is now table stakes.
Conclusion
A Center of Excellence is only as strong as the security guardrails it enforces. As AI technologies continue to advance, the risks of model drift, data poisoning, and unauthorized access will only intensify.
By centralizing expertise, establishing clear accountability, and adhering to global security standards, a CoE can ensure that AI remains a tool for growth rather than a liability. Ultimately, the future of AI in the enterprise depends on the strength of the governance that surrounds it.
Guidance to our Readers:
-
Establish an AI CoE with a strong foundation in Cybersecurity and Risk. Refer to our AI CoE white paper or reach us to guide your organization’s future forward. (2026 Publication)
-
Read The AI Precipice: Balancing Innovation and Safety – co-authored by Cathy Cobey and Dr. Cindy Gordon, based on two years of international research – it offers deep insights on the governance and operating controls needed to manage risk.
-
Conduct an AI Cybersecurity Risk Assessment. With our AI and deep cybersecurity proven partners, we take on diverse AI CoE cybersecurity challenges. We partner with organizations, like Amazon, EY, Kyndryl, Protexxa, and SaskTel, to name a few, that can have the skills to keep you safe.
-
Let us help you become ISO/IEC 42001 certified, having your AI modelling life cycle methods validated is crucial for your customers to be confident in your AI competencies.
A Letter from Lady Whistledown to all her lands and a warning to take heed.
My Dearest Readers,
It seems the ton is not alone in its intrigue, deception, and carefully guarded secrets. Beyond the candlelit ballrooms and whispered scandals lies a far more perilous theatre—one in which unseen actors, emboldened by the rapid ascent of artificial intelligence, ply their trade with alarming sophistication.
Indeed, what was once the domain of opportunistic mischief has evolved into something far more calculated. Cyber threats and fraud, once crude in their execution, have acquired a certain… refinement. One might even say they have learned the very art of persuasion, mimicry, and scale—qualities that would impress even the most seasoned social climber.
You see, dear reader, artificial intelligence has bestowed remarkable gifts upon society. Yet, as with any powerful instrument, it has also armed those with less honourable intentions. Fraudsters now craft messages indistinguishable from trusted correspondents. Cyber adversaries anticipate defenses before they are even raised. Entire schemes unfold at a speed and precision that would leave even the most astute observer breathless.
And herein lies the great concern for our esteemed leaders.
For many organizations, the adoption of AI has outpaced the establishment of proper governance. They rush to embrace innovation, yet fail to ensure that the necessary safeguards, controls, and watchful eyes are in place. It is rather akin to hosting a grand ball while neglecting to secure the doors—one should not be surprised when uninvited guests arrive.
Lady Whistledown has observed that the most prudent of leaders are beginning to recognize this imbalance. They understand that managing AI risk is not merely a technical matter, but a question of discipline, structure, and accountability.
And so, a new institution is quietly gaining favour among the wisest houses: the Center of Excellence.
Now, do not be misled by the modesty of its name. A properly designed Center of Excellence is no mere committee convened for appearances. It is, in truth, the governing body that ensures order amidst complexity—a place where standards are defined, risks are monitored, and decisions are guided by both insight and integrity.
Within such a structure, one finds the essential ingredients of modern leadership:
-
A clear articulation of policies, so that all may understand what is permitted and what is not.
-
A disciplined approach to data governance, ensuring that the very lifeblood of AI remains secure and uncorrupted,
-
A vigilant system of controls and metrics, capable of detecting anomalies before they blossom into scandal.
-
And perhaps most importantly, a culture of accountability, where responsibility is neither diffused nor denied.
For without such measures, organizations leave themselves exposed—not only to financial loss, but to reputational ruin, which, as we well know, is far more difficult to recover from.
It is whispered in certain circles that many leaders still underestimate the scale of these risks. They believe that cybersecurity is the concern of technologists alone or that fraud can be contained through legacy controls. How quaint.
The reality, dear reader, is far more sobering. In an age of AI, threats are not static—they learn, adapt, and evolve. To defend against them requires an equally adaptive approach, one that is coordinated, governed, and relentlessly measured.
A Center of Excellence provides precisely this capability. It transforms fragmented efforts into a cohesive strategy. It ensures that innovation does not outpace control. And it offers leadership the clarity they so desperately require in moments of uncertainty.
One might say it is the difference between reacting to scandal and preventing it altogether.
And so, to those who preside over their organizations with ambition and foresight, Lady Whistledown offers this gentle counsel:
Do not be seduced by the brilliance of AI without respecting its shadows. Do not pursue innovation without instituting governance. And above all, do not assume that what you cannot see cannot harm you.
For in this new era, the most formidable threats are not those that announce themselves loudly, but those that operate quietly, intelligently, and without invitation.
Those who establish strong governance, robust controls, and a well-appointed Center of Excellence will not merely survive this shifting landscape—they will command it.
And in a world where reputation is everything, that, dear reader, is the only outcome worth securing.
Yours most watchfully, Lady Whistledown
Bibliography
BDO Canada. (2024). Responsible AI Guide: A Comprehensive Road Map to an AI Governance Framework. Retrieved from bdo.ca
International Organization for Standardization. (2023). ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system. Geneva, Switzerland.
National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). U.S. Department of Commerce. Retrieved from nist.gov
Owens, J., & Walker, A. (2023). The Role of the AI Center of Excellence in Modern Cybersecurity. Journal of Business and Technology Research.
World Economic Forum. (2024). Global Cybersecurity Outlook 2024: The Impact of AI on the Cyber Landscape. Geneva, Switzerland.
Note:
Some of this research was also supported by OpenAI, Gemini, and Google Scholar. The Lady Whistledown letter was created via a long prompt in ChatGPT (OpenAI) based on the research created, so human and machine interaction was used to produce richer content. Other research was gathered from reading numerous articles and research reports to identify relevant statistics of value to write this article.
#AI #AICenterofExcellence #AICoE #AIGovernance #AIRiskManagement #AISafety #AISecurity #Amazon #Cybersecurity #DeepFake #ISO42001 #Kyndryl #LadyWhistledown #LLM #NIST #Phishing #Protexxa #RansomAttack #ResponsibleAI #SaskTel #TrustedAI #VoiceCloning
