The Four Horsemen: Part II

The Corporate Siege

The request arrives on a Tuesday morning. It comes from the CFO’s email address. The writing style matches. The tone is right measured, direct, slightly impatient in the way the CFO always is when quarterly pressures are building. The email references a deal that was discussed in last week’s leadership meeting, one that only a handful of people knew about. It asks the finance director to authorize a transfer, just this once outside the normal approval chain, because the window is closing and the counterparty won’t wait.

The finance director hesitates for exactly three seconds. Then she approves it. She will not learn until Thursday that the CFO never sent that email. That the deal reference was pulled from a leaked board memo. That the writing style was reconstructed from two years of internal communications exposed in a prior breach. That the money is already gone.

Part One of this series examined how AI-powered deception targets individuals. But the corporation is not simply a larger individual. It is a system. Layered, interdependent, and riddled with the kind of implicit trust that makes it efficient. That trust is also what makes it catastrophically vulnerable.

The Four Horsemen do not retire at the corporate gate. They enter the building.

Where Organizational Attacks Actually Stand Today

The image most people carry of a corporate data breach is outdated. It involves hooded figures, blinking terminals, and brute-force intrusion. Someone breaking down a digital door. That picture has not been accurate for years.

Modern breaches rarely break in. They walk in. They use legitimate credentials, trusted identities, and the ordinary rhythms of organizational life. AI has made this dramatically easier by removing the craft requirements that used to limit attackers. You no longer need to understand a company deeply to impersonate it convincingly. You need data. And data is everywhere.

Corporate environments generate an enormous amount of publicly accessible signal: job listings that reveal internal tools and infrastructure, LinkedIn profiles that map reporting structures. An attacker running machine learning against this material does not need a source inside the building. The building is already narrating itself.

The four horsemen enter the corporate story not as external threats but as systemic ones. And systemic threats are the hardest to see before they have already done their work.

The First Horseman: Deception

Business email compromise was already the most financially damaging category of cybercrime before generative AI existed. Now it is more convincing and cheaper to deploy. A model trained on an executive’s emails and public remarks can reproduce not just their phrasing but their priorities, their blind spots, their typical escalation patterns. The forgery is not generic. It is personal.

Vendor impersonation has become its own category. Attackers study supplier relationships, mirror legitimate invoicing patterns, and insert themselves into ongoing procurement conversations. Companies run on the reasonable assumption that a message from a trusted address, referencing the right context, asking for something plausible, is probably legitimate. AI has learned to manufacture all of that plausibility simultaneously.

The Second Horseman: Speed

The average time between initial compromise and detection is measured in weeks. The average time between initial access and data exfiltration is now measured in hours. That gap is where the real destruction happens.

AI accelerates every stage of the attack timeline. Reconnaissance runs automatically. Once inside, tools map networks, identify high-value targets, and locate credential stores faster than security teams can parse alerts. Exfiltration is staged to mimic normal traffic patterns. And crucially: modern attacks adapt. If an access attempt triggers a block, the system tries a different path. This feedback loop where the attacker adapts to defender in near-real time has no equivalent in older intrusion models. Speed removes the organizational advantage of size. When an attacker moves in minutes and the security team works in hours, headcount is not a meaningful defense.

The Third Horseman: Scale

The most devastating corporate breaches have not targeted the largest organizations directly. They have targeted smaller, less-defended nodes in their supply chain and used those as entry points into dozens of downstream companies simultaneously. A single compromised software update. A single trusted vendor with insufficient access controls. The scale is not in the number of attackers. It is in the number of victims a single compromise can reach.

Inside organizations, one set of stolen credentials rarely stays one set of stolen credentials. Lateral movement to discover and compromise additional systems is the core of enterprise intrusion. AI makes it faster and more targeted: which accounts have the most privilege, which systems hold the most valuable data, which paths through the network avoid detection. The breach that starts in a contractor’s laptop ends in the finance database. The chain is invisible until it is complete.

The Fourth Horseman: Silence

Organizations do not talk about breaches readily. There are legal constraints, reputational calculations, internal cultures where admitting compromise feels like admitting failure. The result is that the broader ecosystem learns slowly, if at all, about how attacks are actually developing.

AI-powered attacks are designed to exploit this. They produce actions that look voluntary. When a finance director approves a fraudulent transfer, the transaction record shows a standard approval from an authorized employee. The organizational reflex is to treat it as human error rather than systemic vulnerability. That reframing matters enormously. When incidents are categorized as individual mistakes, organizations invest in training. When categorized as systemic vulnerabilities which is what they are organizations redesign processes. Silence prevents the second response by making the first feel sufficient.

How Organizations Disrupt the Pattern

The most important shift is from perimeter thinking to assumption-of-compromise thinking. Not: how do we keep attackers out? But: when an attacker is already inside, what can they reach, and how quickly will we know?

Access controls must become granular. In most organizations, permissions accumulate over time and are never revoked. An attacker who compromises any account inherits its full history of access. Audit and prune regularly. Any request involving financial movement or credential sharing should require out-of-band confirmation verification through a channel separate from the original request. This cannot be optional. The finance director followed normal procedure. Normal procedure needs to change.

Culturally: stop treating employees as the problem. The near-miss, the almost-clicked link, the almost-approved transfer is the most valuable data point an organization has, and most organizations never collect it because reporting feels like confession. Create conditions where flagging something suspicious is celebrated, not embarrassing. And when incidents do occur, share what you can with peer organizations. Silence protects reputation in the short term and feeds the attacker ecosystem in the long term.

A Closing Note (on Both Parts)

Across two parts, the same four horsemen have appeared at two different scales. The tools that make AI-powered attacks effective against a person are the same tools that make them effective against a company. The response, at both levels, is design. Pauses built into processes. Verification built into workflows. Transparency built into culture.

The horsemen do not announce themselves. They arrive looking like normal operations. The only defense is a clear enough picture of what normal actually looks like and the will to ask questions when something departs from it.

Question one request today. Review one vendor relationship. Create one way for your team to report without penalty.

Before you scroll.
I’m collecting quick insights on African-inspired design, culture, and usability in tech. It takes under two minutes, and it feeds a larger African UX research series.