The article describes a sophisticated insider threat from North Korean actors who infiltrate organizations by posing as employees and rely heavily on generative AI tools to perform their jobs, communicate naturally, and evade detection. Their operational signature is an abnormal, pervasive, and immediate dependency on a wide array of AI tools from their first day, using highly specific prompts to mimic human conversation. The recommended mitigation is to implement user behavior analytics focused on AI usage patterns to identify and eradicate these AI-dependent insiders.
AI vs. AI: They're Already Inside 🎙️ Zakery Stufflebeam, Director of IT Security, Spartan Cyber Consulting LLC 📍 Presented at SANS AI Cybersecurity Summit 2026 The problem is the DPRK IT scam is filling applications and hindering IT teams. With AI on the uprising in the scam we used the AI methods against them to track them and remove them from the environment. This removed over 10 insiders that had access to sensitive information before they were able to identify and exfiltrate. This saved the company millions in possible losses. Explore upcoming SANS Summits to continue learning from leading voices in cybersecurity: https://go.sans.org/summits