What to Do After an AI Attack: A Step-by-Step Cyber Incident Response Guide

Artificial Intelligence is changing how cyber attacks are carried out.

You may have seen news where AI was used to create convincing phishing emails and deepfake videos. In other cases of AI-powered cyber attacks, hackers have cloned voices to impersonate staff, automate reconnaissance, and tailor fraud at scale. These are just several examples.

In a nutshell, an AI-powered cyber attack is a type of attack in which artificial intelligence helps an attacker make malicious activity faster, more persuasive, more targeted or easier to scale.

The technology may be new, but the immediate priorities after an attack remain clear. The threat should be contained and people and their data must be protected. There is also a need to preserve evidence, investigate the impact, and restore services safely.

What happens if you get attacked by AI? Since it moves faster than a usual attack, the first hour matters. A fast, disciplined response can prevent a data breach or a wider operational outage.

Here’s a step-by-step guide on what to do after an AI-powered cyber attack.

How fast, serious and frequent are AI attacks?

AI attacks are often not wholly new categories of attack. Instead, AI makes established threats more effective.

Studies compiled by the World Economic Forum confirmed that AI had become an accessory to hackers and that almost all virtual attacks would now involve an element of AI.

If before, cyber attacks were carried out in a matter of days, AI can now expedite that process in a matter of hours or minutes.

Three factors make them especially concerning:

1. 1. Speed: Attackers can quickly create and adapt phishing messages, fake invoices, voice recordings and fraudulent communications.
2. 2. Scale: A single campaign can be varied for different departments, suppliers, executives or customers.
3. 3. Credibility: Better grammar, familiar tone of voice, public information and deepfake media can make malicious communications look more convincing.

The severity depends on what the attacker achieves. A blocked phishing email may have little impact. A convincing deepfake request that triggers a payment, exposes credentials or gives access to sensitive systems can cause financial loss, service disruption, regulatory consequences and long-term reputational damage.

How do you recognise a possible AI attack? 

It is rarely necessary to prove that AI was used before responding. Focus first on whether there are signs of fraud, compromise or unauthorised activity.

Common warning signs include:

• An urgent payment, password-reset or bank-detail-change request that appears to come from a senior colleague or supplier
• A voicemail, video call or audio message that sounds authentic but cannot be independently verified
• A highly personalised phishing email with unusual links, attachments or requests for confidential information
• Unusual sign-in activity, new devices, impossible travel alerts or repeated multi-factor authentication prompts
• Unexpected mailbox forwarding rules, new access permissions or altered supplier records
• Unexplained file encryption, ransom notes, suspicious processes or unusual outbound data transfers
• A sudden rise in similar scam messages targeting staff, customers or partners

Top Tip: Your first question shouldn’t be whether to ask if AI was used in this attack or not, but what to do about it. Your focus should now shift to containing the threat.
 

Step 1: Activate the incident response process

The first action is to activate the organisation’s cyber incident response procedure. Avoid trying to manage a serious incident informally through chat or disconnected individual actions.

Start by recording the date and time the incident was identified, who reported it and how it was discovered.

There should also be a record of affected accounts, devices, systems, services or suppliers.

Notify the incident-response lead, cybersecurity or IT team, and relevant senior decision-makers. If critical services, payments, personal data or public-facing systems may be affected, escalate early.

If communication channels are compromised, use one that isn’t. This helps the response team coordinate safely and maintain a reliable record of decisions.

Step 2: Contain the attack without destroying evidence

Containment is about stopping an attacker from doing more harm. However, responders should avoid wiping devices, deleting messages or resetting systems before key evidence has been preserved.

Depending on the incident, immediate containment may include:

• Disconnecting a suspected compromised device from the network
• Disabling compromised user, administrator or service accounts
• Revoking active sessions and resetting exposed passwords
• Rotating affected API keys, tokens and credentials
• Blocking malicious domains, sender addresses, IP addresses and file hashes
• Suspending suspicious payment instructions or changes to supplier bank details
• Disabling malicious mailbox rules, forwarding arrangements or risky integrations
• Restricting access to affected cloud storage, shared drives or sensitive data repositories
• Capturing screenshots, email headers, files, logs and timestamps
• For suspected deepfake fraud, independently verify every high-risk request. Use a known contact number, a pre-agreed verification phrase or an established approval workflow. Do not reply to the suspicious message or use contact details provided within it.
  
  

Step 3: Assess what happened and the potential impact

Once immediate harm is contained, determine the scope of the incident. The aim is to establish what happened, how access was gained, what may have been affected and whether the attacker still has a foothold.

For this step, a company’s IT or cybersecurity team is more suited to conduct this investigation. This is why it’s very important for IT teams to be constantly upskilling and updating their certifications for cybersecurity.

So, how ready is your cyber response team and are they up-to-date with certifications?

Firebrand Training's UK-wide survey of senior leaders across energy, financial services, retail, telecoms, professional services, and IT found that just over three-quarters or 77% believe AI is increasing cyber risk for their organisation, but only 27% are fully prepared for AI-powered cyber attacks.

Even before the attacks start, have a conversation with your team about their readiness. An investment in their upskilling will cost a lot less compared to the cost of being attacked and mismanaging an AI-powered incident.

Step 4: Escalate, report and bring in support

An incident may require input from more than IT. Early coordination reduces the chance of conflicting decisions, missed obligations or uncontrolled communication.

Involve the relevant functions as soon as practical. This may include customers, C-level executives, cyber insurers, a PR team, law enforcement, and the national cyber authority. 

Step 5: Communicate clearly and prevent further harm

AI-enabled attacks often rely on confusion and urgency. Clear communication can reduce the risk of a second wave of fraud, especially when attackers impersonate leaders, suppliers or support teams.

Give staff clear, practical instructions regarding temporary restrictions on systems or files, and even giving away information to external people.

In cases where customers are involved (such as data breaches) being transparent with them is also crucial at this point. You may discuss the impact of the attack, possible breaches, and steps they must do to further protect themselves. Of course, you must also communicate the steps the company is taking to prevent another attack.

Top Tip: You may also establish a committee who will become a single source of truth is essential. It helps prevent inaccurate internal rumours, inconsistent customer messaging and the unintentional spread of attacker-controlled content.

Step 6: Eradicate the threat and restore services safely

Recovery should begin only when the organisation is confident that the attacker’s access route has been removed.

Rushing services back online without addressing the root cause can result in reinfection or repeated compromise.

The recovery process should be led by a competent cybersecurity team and may involve:

• Removing malware, unauthorised accounts, malicious mailbox rules and persistence mechanisms
• Patching exploited vulnerabilities and correcting insecure configurations
• Rebuilding affected devices or servers from trusted sources
• Restoring clean, tested backups
• Reviewing access rights and privileged accounts before re-enabling systems
• Reconnecting services in a controlled order, based on business criticality
• Monitoring restored environments closely for renewed suspicious activity

The UK’s National Cyber Security Centre highlights secure deployment and secure operation as essential stages, including incident-management processes, logging, monitoring, update management and information sharing.

Step 7: Learn from the attack and strengthen defences

A post-incident review should focus on improvement, not blame. Every incident reveals something about technology, processes, suppliers, decision-making or staff support.

Review things such as how the attack entered the organisation and which controls succeeded and which failed.

Also take note whether staff had the information and authority needed to act quicky or whether escalation paths and contact lists worked. Do the supplier, payment-verification or approval processes need strengthening?

You must also do review on your AI policies and acceptable use guidance. Perhaps do an AI audit or simulations to better prepare your team for another attack.

Top Tip: If you don’t have one yet, you must also create an “AI Response Book” which includes all the steps that every member of the team should take after an attack, how to address the stakeholders, media, customers, and more. 

A 60-Minute AI Attack Response Checklist

In the first hour after a suspected AI-enabled cyber attack:

• Escalate the incident to the security or incident-response lead
• Start an incident log with timings, facts and actions taken
• Preserve key evidence, including messages, headers, logs and screenshots
• Isolate affected devices or systems where appropriate
• Disable compromised accounts and revoke active sessions
• Suspend suspicious payments, supplier changes and mailbox rules
• Identify whether critical services, personal data or sensitive information may be affected
• Move incident coordination to a secure communication channel
• Notify relevant IT, security, leadership, legal, privacy and finance stakeholders
• Begin technical investigation and monitoring for further suspicious activity

Step 8: Make training a critical part of recovery

Technology controls matter, but trained people are often the first line of defence. An employee who recognises an impersonation attempt can prevent a major incident.

Organisations need more than an annual awareness module. They need role-relevant capability. For example, managers also need to understand escalation, decision-making and verification procedures. Security teams need current technical skills in detection, incident response, identity security, cloud security, threat intelligence and AI-related threats.

This is where Firebrand can support organisations seeking to strengthen their cyber resilience. Firebrand works with organisations to build training around real workforce requirements. Its approach combines intensive instruction, hands-on labs, and structured review to help learners apply skills in roles.

Firebrand offers technology learning across cyber security, AI and machine learning, cloud, data, networking, software and project management, including globally recognised certifications. 

Its solutions are designed to help organisations build certified, capable technical workforces, with delivery available through residential, online and in-person learning options.

Speak to a Firebrand expert