When Seeing Is No Longer Believing: How Cybersecurity Mindsets Can Mitigate the Potential Crisis of Eroding Online Trust

The rapid development of artificial intelligence (AI) is reshaping the overall landscape of online fraud and cybersecurity threats. Generative AI enables criminals to produce highly realistic videos, voice recordings, and virtual identities, while recommendation algorithms and social media activity analysis help scammers identify and target potential victims with increasing precision. At the same time, AI accelerates software vulnerability discovery and attack automation, drastically compressing the time available for organizations to detect and respond to cyber threats. Traditional defense methods that rely primarily on reactive patching and isolated security measures are becoming insufficient against increasingly complex threats. To gain deeper insight into these changes, Art Lin, Dept. of Cyber Security Deputy Director at the Taiwan Network Information Center (TWNIC), and Karl Hsieh, Chief Technology Officer of Cisco Taiwan, analyze the evolution of cyber offense and defense from various perspectives, including online fraud trends, corporate security governance, internet infrastructure protection, and international threat intelligence. The insights of both interviewees indicate that only by combining technical defenses, regulatory oversight, and cross-sector collaboration can a more resilient and trustworthy digital environment be built.

Online fraud is no longer merely about forged messages or sending suspicious emails; it has evolved into sophisticated schemes combining social platforms, messaging applications, and human vulnerabilities. Common examples include fraudulent investment ads and groups on social media, phishing websites impersonating government agencies or financial institutions, and scam scenarios on platforms like Threads that offer free second-hand items before demanding shipping fees or urging clicks on malicious links. Some websites imitate government cash subsidies, uniform invoice notifications, or well-known online services to trick the public into providing credit card details, account passwords, and other sensitive information. These tactics often exploit urgency, fear, or promotional offers, inducing victims to act before verifying information. Generative AI further enhances the sophistication and scalability of fraud, allowing perpetrators to impersonate celebrities, corporate executives, or acquaintances using deepfake videos and voice cloning, making fraudulent communications far more persuasive and harder to identify. In this environment, visual or auditory impressions alone can no longer serve as reliable indicators of authenticity. For any request involving money transfers, verification codes, credentials, or file downloads, individuals should independently verify through official websites or established contact channels.

AI is also transforming the cybersecurity risks faced by enterprises. Previously, attackers typically needed substantial time and technical expertise to identify software vulnerabilities, develop exploit programs, and gradually breach an organization's defense mechanisms. Today, AI tools can assist with vulnerability analysis, attack planning, and code generation, compressing preparation and execution timelines from weeks or months down to hours or even less. Enterprises must therefore accelerate vulnerability management, software patching, and incident response. Risks extend beyond technical weaknesses; social engineering attacks integrated with deepfake technology allow attackers to impersonate corporate executives or business partners, tricking employees into transferring funds or disclosing confidential information. Furthermore, agentic AI systems deployed within organizations pose new security risks if manipulated by malicious prompt instructions or granted excessive access to sensitive data and internal systems. According to a Cisco survey, over 70 percent of surveyed Taiwanese enterprises have experienced serious cybersecurity incidents, with more than one-third involving AI attacks. Enterprises also face challenges such as fragmented data across systems, insufficient collaboration between IT and cybersecurity teams, and difficulty translating technical threats into actionable information for senior management. These challenges demonstrate that cybersecurity defense must address both technical vulnerabilities and people's trust in familiar identities.

To reduce the public's risk of encountering phishing websites and scam links, TWNIC combines suspicious URL reporting with internet infrastructure defense mechanisms. Lin explains that if members of the public discover suspicious websites impersonating legitimate services or attempting to harvest credentials, they can submit reports through the Phishing Check reporting page. Once verified, reported URLs are handled according to domain ownership and case characteristics, or referred to international partners when necessary. Because scam websites frequently cross national borders and involve various domain registries, international cooperation is crucial to preventing the continued spread of malicious sites. TWNIC also collaborates with domestic Internet Service Providers (ISPs) and the Criminal Investigation Bureau to promote a defense mechanism based on DNS Response Policy Zones (DNS RPZ). Through this mechanism, verified threat intelligence is shared with participating entities to block connections to confirmed fraudulent websites at the domain resolution stage. Last year, TWNIC assisted in blocking over 70,000 illegal websites and prevented more than 100 million connection attempts. These achievements demonstrate that through intelligence sharing and automated infrastructure defenses, security boundaries extend beyond individual users. Nevertheless, the public should not judge authenticity solely on a website's appearance or brand imagery. Verifying suspicious sites through official channels and reporting them transforms individual observations into actionable threat intelligence.

In terms of enterprise defense, Hsieh emphasizes that traditional security mindsets centered on network perimeters—which treat internal corporate systems as inherently trustworthy—are no longer adequate. Enterprises should adopt a Zero Trust architecture that assumes no user, device, or application is inherently trustworthy. Instead, access permissions should be granted based on identity, device security posture, contextual usage, and risk assessment, accompanied by continuous, timely verification. Multi-Factor Authentication (MFA) is a vital foundation for identity security, but it must be complemented by the principle of least privilege, continuous monitoring, network segmentation, and anomalous behavior detection. For AI agents, enterprises must explicitly define permissions, data access constraints, and auditable operation logs to prevent them from accessing information beyond task requirements or executing unauthorized actions.

Effective defense also relies on integrating cybersecurity logs, alerts, and operational data across different systems. Hsieh points out that tools like Splunk assist in consolidating information, identifying anomalous activities, and enhancing overall visibility across IT and security operations. Through comprehensive data integration, technical teams and senior decision-makers gain a clearer understanding of emerging risks and accelerate response speeds. As AI accelerates attack processes, defenders must likewise leverage AI to improve threat analysis and incident response efficiency. However, using AI to defend against AI-driven threats does not mean handing over all decisions to automated systems. Human oversight, clear governance frameworks, and refined incident response procedures remain essential for reducing false positives, preventing the misuse of security tools, and ensuring that automated actions remain proportionate to actual risks.

Because cyberattacks are unconstrained by national borders, international threat intelligence exchange and public-private sector collaboration are equally crucial. Cisco analyzes global threat activity through Cisco Talos to help identify malicious campaigns and emerging risks; it also participates in Project Glasswing and NVIDIA-related open security AI initiatives to explore opportunities for advancing AI security, vulnerability risk management, and defensive technologies. From a public sector perspective, Lin notes that government plays an essential role in internet infrastructure defense, threat intelligence sharing, and organizational cybersecurity oversight. Within relevant regulatory frameworks and statutory authority, governing agencies may also conduct administrative inspections and oversight of e-commerce operators regarding personal data protection and cybersecurity measures. Such actions help encourage enterprises to incorporate risk management into routine operations rather than waiting until an incident occurs to act.

Overall, cybersecurity is no longer a topic that any individual, enterprise, or government can solve independently. As AI transforms fraudulent tactics and defensive capabilities, individuals must cultivate stronger verification habits, enterprises should reassess identity management, access control, and incident response mechanisms, while governments and international partners must deepen cooperation in threat intelligence exchange and internet infrastructure defense. Technology alone cannot eradicate online fraud, just as public awareness alone cannot safeguard complex enterprise systems. Building a resilient digital environment requires various protective measures to work in harmony, grounded in effective governance, shared responsibility, and continuous adaptation. By integrating individual vigilance, enterprise Zero Trust practices, infrastructure-level safeguards, and international collaboration, Taiwan can mitigate cybercrime impacts and further bolster the security, resilience, and trustworthiness of its digital ecosystem.