Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Business email compromise (BEC) is a fraud pattern that tricks a person into sending money, sharing information, or giving up account access. AI-agent social engineering is a broader risk: attackers may use agents to automate parts of an influence campaign, or exploit an organization’s own agent by placing malicious instructions in content it reads. The terms overlap, but they describe different things—and call for different controls.
What the terms mean—and why they are not interchangeable
Business email compromise is a fraud pattern aimed at a person
BEC uses business communications and trust to persuade someone to take an action that benefits an attacker. A message may impersonate an executive, supplier, colleague, or other trusted contact, or come from a real account that has been compromised. Common goals include a fraudulent payment, disclosure of sensitive information, or credentials that can be used to access an account. Some campaigns direct recipients to credential-harvesting pages rather than asking for information directly.
The defining feature is the human decision: a person receives a seemingly credible request and acts on it. Email is a common route, but the persuasion can extend to other channels, including voice. AI can make a deceptive message more convincing without changing the underlying fraud pattern. An AI-written or AI-polished BEC message is still BEC; using AI does not by itself make the attack agentic.
Agentic describes a system’s capabilities and how it is used
An AI agent is software that can pursue a task using some combination of instructions, information sources, and connected tools. Depending on its design and permissions, it may retrieve information, interact with services, or take actions. “AI-agent social engineering” can refer to an attacker using an autonomous or partly autonomous agent to research targets and adapt outreach. It can also refer to an attacker manipulating an organization’s own agent through malicious content that the agent processes.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Those are different attack paths. In the first, the attacker’s software helps conduct the influence campaign. In the second, the organization’s software is the target: the agent is induced to treat untrusted content as an instruction and may then misuse its connected tools. Neither case requires an employee to approve a fraudulent payment, although a person can still be involved in either.
How the attack paths differ
| Dimension | Business email compromise | AI-agent-related social engineering or hijacking |
|---|---|---|
| Immediate target | A person receiving a business message, often through a trusted or compromised account. | Potentially a person approached by an attacker-side agent, or an organization’s agent that reads malicious content. |
| Main mechanism | Impersonation, compromised accounts, trusted relationships, urgency, and fraudulent requests. | Automation or adaptation across an attack lifecycle; alternatively, malicious instructions embedded in data an agent processes, combined with its connected tools and permissions. |
| Possible consequence | A person makes a fraudulent payment, shares sensitive information, or supplies credentials or session access. | A manipulated agent may access data or take an unauthorized action using its identity, integrations, and permissions. The impact depends on those privileges and on safeguards such as human approvals. |
| Primary control emphasis | Independent verification of sensitive requests, account protection, user awareness, and phishing-resistant MFA. | Least privilege, distinct agent identities, constrained tools, clear boundaries around untrusted inputs, approval gates, monitoring, audit logs, isolation, and a phased rollout. |
The distinction matters in practice. A security team investigating a suspicious payment request should look at who was persuaded, what identity was used, and how the request was verified. If an agent has access to email, files, or business systems, the team also needs to ask what content it processed, what instructions it followed, and which tools it could invoke. A single incident can involve both paths: an attacker could use AI to compose a convincing message and also exploit an agent that reads the reply or an attached file.
How an attacker might use agents—and what is established
Attacker-side automation can support influence campaigns
An attacker may use an agent to help research targets, create or maintain a persona, and adapt attempts across channels. This is a capability and risk, not evidence that autonomous agent-led social engineering is already more prevalent than BEC. The authoritative sources cited here do not establish a comparable real-world incidence rate for autonomous agent-led campaigns or a head-to-head prevalence comparison with BEC.
Free tools Windows power users keep installed
One-click scans. No signup required.
Canada’s Cyber Centre said in its National Cyber Threat Assessment 2025–2026 that “AI technologies are almost certainly lowering the barriers to entry and enhancing the quality, scale, and precision of malicious cyber threat activity.” That forecast concerns the next two years; it does not quantify how often attackers use autonomous agents for social engineering. The sensible conclusion is that AI may increase the reach or quality of malicious activity, while the scale and prevalence of agent-led social engineering remain unestablished by the cited material.
An organization’s own agent can be manipulated through content
NIST describes agent hijacking as a problem that occurs when a system does not clearly separate trusted instructions from untrusted external data. Malicious instructions can be placed in ordinary task resources such as emails, files, and websites. If an agent reads that content and treats it as authority rather than material to analyze, it may act against the organization’s intent. NIST’s January 2025 explanation calls this “the latest incarnation of an age-old computer security problem” involving that missing separation.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
This is not simply a more persuasive email. The attacker may not need to convince an employee to click a link or approve a transfer. Instead, the attacker tries to influence software that has been granted access to information or tools. Whether that attempt succeeds—and how serious the consequences could be—depends on the agent’s design, identity, integrations, permissions, and approval requirements.
Why permissions determine an agent’s potential impact
An agent’s autonomy alone does not define the risk. Its authority matters: what it can read, change, send, approve, or trigger in other systems. The Australian-led joint guidance on careful adoption of agentic AI services uses a procurement scenario to illustrate the concern: excessive access and implicit trust could let a compromised integrated tool contribute to a contract modification or payment approval. This is an example of a possible failure path, not a measured frequency claim.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsFor a useful risk assessment, map an agent’s capabilities to its business role instead of asking only whether it is “autonomous.” Consider:
- Identity: Does it use a distinct, attributable identity, or share a human account or broad service credential?
- Data access: Can it read only the records needed for its task, or can it search across unrelated mailboxes, files, or systems?
- Action authority: Can it draft, recommend, or execute? Can it send external messages, change records, approve transactions, or alter contracts?
- Tool connections: Which APIs and integrations are available, and can the agent call them without a separate check?
- Human control: Which actions require approval, and can the agent be interrupted or its changes reversed?
These questions help distinguish a bounded assistant that summarizes selected material from an agent that can act across business systems. The same malicious instruction may have very different consequences in those two setups.
Controls for BEC and human-directed social engineering
Verify sensitive requests outside the message
For payment changes, unusual transfers, credential requests, or other sensitive actions, confirm through a second, independent channel. Do not rely on a reply to the same email thread or on contact details supplied in the suspicious request. If a request arrives by email, use a known phone number or another established contact method. The Canadian Cyber Centre specifically recommends independent confirmation for sensitive actions involving cloned voices.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Unexpected file shares deserve the same skepticism even when they appear to come from a familiar business contact. The Cyber Centre calls out apparently trusted SharePoint and Dropbox shares in BEC-related phishing. Confirm through another method that the sender intended to share the file before following its links or providing credentials.
Protect accounts with phishing-resistant MFA
Phishing-resistant multifactor authentication can reduce the risk that a stolen password or phished sign-in leads to account access. In its 2025 guidance, the Canadian Cyber Centre names FIDO2 security keys, passkeys, and Windows Hello for Business as options. Compatibility depends on the identity provider, device, and configuration, and the Cyber Centre notes that implementation and configuration have costs. A FIDO2 key can strengthen account protection, but it does not prevent an agent that already has access from following malicious instructions.
Account protection still needs sound identity hygiene: protect business accounts, limit who can approve payments or change supplier details, and investigate unusual sign-ins or changes. MFA is one layer, not a substitute for verifying an unusual request or controlling what a software agent can do.
Controls for agents that read content or use tools
Separate instructions from data
Treat email, websites, retrieved files, tool outputs, and stored memory as data with explicit trust levels. Content an agent is asked to summarize or analyze should not be able to override higher-priority system or organizational instructions. Design the instruction hierarchy and context handling so the agent can use untrusted information for the task without treating it as authority to change its goals or bypass safeguards.
This boundary must hold across the workflow, not just at the first prompt. Retrieved text, file contents, and tool results may all contain attacker-controlled material. The agent should not treat a message inside one of those sources as permission to disclose records, run a tool, or change a business process.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Give agents their own narrow identities and permissions
Assign each agent a distinct identity so actions can be attributed and access can be revoked without disabling a person’s account. Grant only the permissions required for its defined task, constrain which tools and API operations it can use, and prevent privilege creep as the system is updated or connected to new services. A summarization agent should not inherit broad transaction privileges just because it can technically connect to a finance platform.
Apply the same principle to the actions available through each integration. Limiting access to a system is not enough if the agent can invoke every operation in it. Restrict the available calls and data to the task, and keep high-impact capabilities separate from routine retrieval or drafting.
Put human approval in the right place
Require a human checkpoint before high-impact or difficult-to-reverse actions, such as external payments, contract changes, or sensitive disclosures. The joint Australian-led guidance places responsibility for deciding when approval is needed on the system’s designers or operators, not on the agent itself. An approval process should show the reviewer what will happen and the relevant context, rather than ask for a blind confirmation of an agent’s recommendation.
Approval gates should match the consequence of the action. A low-risk internal summary may not need the same review as a change to payment instructions. If a task is reversible and narrowly scoped, automation may be appropriate; if it can expose sensitive data or create a financial or legal commitment, keep an accountable person in the decision path.
Monitor, log, and roll out in stages
Monitor agent operations, identity and privilege changes, tool calls, decisions, and actions. Keep audit logs that make it possible to reconstruct what the agent saw and did. Provide a way to interrupt the agent, isolate it from integrations, and roll back actions where feasible. Begin with bounded, lower-risk tasks, evaluate performance and controls continuously, and reduce autonomy or access when safeguards fail. This lets an organization learn what the agent does under real operating conditions before granting it broader authority.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
What the available numbers do—and do not—show
Statistics about phishing or BEC campaigns should not be read as measurements of agent-led attacks. In a 2025 analysis, the Canadian Cyber Centre examined more than 100 adversary-in-the-middle phishing campaigns targeting Microsoft Entra ID accounts between 2023 and early 2025. It also reported that BEC phishing campaigns made up 91% of the campaigns it analyzed and categorized between 2023 and mid-2025. The 91% figure describes that analyzed campaign set—not all phishing, all BEC worldwide, or autonomous agent activity.
The figures show why account protection and BEC defenses matter, but they do not establish that AI agents are driving those campaigns. The source material cited here provides no directly comparable incidence rate for autonomous agent-led social engineering. Keep the distinction clear when interpreting incident reports: an AI-enhanced message, an attacker operating an autonomous agent, and a hijacked enterprise agent are not the same event category.
A practical way to classify an incident
When reviewing a suspected event, classify the path before choosing a response. The following checks help identify whether the central problem is BEC, agent misuse, or both:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Identify the action at issue. Was a person asked to send money, disclose information, or provide credentials? Or did software access data or invoke a tool without an authorized reason?
- Trace the route to the action. Look for impersonation, a compromised business account, a deceptive link, malicious content in an email or file, or an agent’s interaction with a connected service.
- Establish whose identity and authority were used. For a human-directed fraud, examine the affected account and the approval process. For an agent event, inspect its identity, permissions, integrations, and tool-call history.
- Contain the relevant access. Secure affected human accounts and review transactions for BEC; for an agent, interrupt or isolate it and restrict potentially exposed credentials or integrations while the activity is investigated.
- Review the trust boundary and control failure. Determine whether the request bypassed independent verification, or whether untrusted content was allowed to override instructions or trigger excessive privileges.
An event can fit more than one description. For example, an attacker might use an AI system to personalize a message that convinces a finance employee to act. That is AI-assisted BEC. If the attacker instead embeds instructions in a document that causes the organization’s agent to disclose information through an integration, the key issue is agent hijacking. If a campaign uses both routes, address both the human decision and the agent’s permissions and logs.
Sources and scope
The comparison reflects multi-agency guidance on careful adoption of agentic AI services, Canadian guidance on social engineering and phishing-resistant MFA, NIST’s January 2025 technical explanation of agent hijacking, and the Canadian Cyber Centre’s 2025 campaign analysis and National Cyber Threat Assessment 2025–2026. These sources address different questions: technical mechanisms, defensive practices, observed campaign samples, and broader threat outlooks. They do not show that every agent deployment is vulnerable or that agent-led attacks are more common than BEC.
Quick Recap
- Australian-led joint guidance: Careful adoption of agentic AI services
- Canadian Centre for Cyber Security: Social engineering
- NIST: Strengthening AI Agent Hijacking Evaluations
- Canadian Centre for Cyber Security: Defending against adversary-in-the-middle threats with phishing-resistant MFA
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
