Bank of America's CEO, Brian Moynihan, said on the bank's third-quarter earnings call that it had added 1,000 consultants for Mythos remediation. They joined 3,000 of the bank's own specialists working on the flaws Anthropic's Claude Mythos found in its systems. The Bank of America Mythos headlines were about the AI. If you run security at a bank, a utility or a critical infrastructure company, you're probably already working out how many people it would take to fix what a model like that finds in your own systems.
In that story, I saw a lack of concern about human readiness. The more you lock the technological doors, the more the human risk door is attractive to criminals, because they're going to find the path of least resistance. So when you put 4,000 people to work on technical patches, the attackers start to think, maybe I should try their people to get access.
I have no view into Bank of America's internal security, and I'm not saying anything went wrong there. But the mobilization was public, and attackers read the news too. A company in patch mode is full of urgent security requests, unfamiliar new contractors and exhausted IT staff with admin access, which is exactly the environment social engineering thrives in.
What worries me is the imbalance a moment like this can create: thousands of people and serious money going into the code, while the human side gets the same annual training it always has. One eight-month randomized study followed more than 19,500 employees at one U.S. healthcare organization. It found no significant relationship between how recently people had finished their annual awareness training and whether they failed a phishing simulation.
Key Takeaways
- Massive vulnerability remediation projects involving thousands of IT contractors create noisy, high-urgency environments that social engineering attackers exploit to bypass technical defenses.
- Verizon's 2026 data for financial institutions attributes 22% of breaches to exploited software vulnerabilities, while human-targeted phishing and credential abuse combined account for 35%.
- A 101-person controlled study revealed that highly personalized AI-generated spear phishing emails achieve a 54% click-through rate compared to just 12% for generic phishing messages.
- During massive security remediations, threat actors specifically target accounts payable clerks and branch managers by impersonating executives to exploit the surge in legitimate contractor payments.
- Right-Hand Cybersecurity's pause-verify-act framework mitigates AI-cloned voice impersonations by requiring employees to disconnect and verify urgent financial requests using predefined department-level safe words.
- An eight-month randomized study of 19,500 healthcare employees found no significant relationship between the recency of annual cybersecurity awareness training and failure rates on phishing simulations.
- Security leaders must measure human cybersecurity risk by tracking actual employee behavioral violations against a department-level baseline rather than relying on theoretical phishing simulation scores.
How Does Patching Software Vulnerabilities Shift Cybersecurity Risk to Human Employees?
You plug one hole, so more water will come from another hole, and you've got to patch all the holes in it. The more you focus on your code flaws, the more getting in becomes a matter of gaining internal access. And if the systems are closed, that access comes through people. It comes through people who can hand an attacker an MFA authorization, and people who click on links that open up their terminals and endpoints. Attackers today are looking for credentials, right? And a fake MFA request only needs one person to approve it by mistake.
At financial firms, the other holes are already letting plenty of water through. Verizon's 2026 breach data for financial and insurance firms shows exploited vulnerabilities as the initial way in for 22% of breaches, phishing for 20% and credential abuse for 15%. A remediation program goes after that 22%, and your people's inboxes and logins stay as open as they were.
AI is helping the other side as well. It took away the efficiency loss that used to come with mass phishing, when one generic message went to a huge list and most of it was wasted. With stolen data, attackers can go from one-size-fits-all spam to one million uniquely personalized messages for 1,000,000 different targets. The message knows what you did and uses that against you, like 20% off the whey protein a consumer already bought, or 50% off the office toners a company buys. In a small controlled study of 101 people, generic phishing emails got a 12% click-through rate, while fully AI-generated spear phishing emails got 54%, the same as the ones humans wrote.
Tech works on parameters, and modern social engineering knows how to bypass parameters and fool people. People manipulation can be grammatically perfect, can have the right sender, and still create a severe data breach.
AI makes phishing dramatically more effective.
In a small controlled study of 101 people, generic phishing emails got a 12% click-through rate, while fully AI-generated spear phishing emails got 54%, the same as the ones humans wrote.
How Do Threat Actors Exploit Vulnerability Remediation Urgency for Social Engineering?
One of the pillars of effective social engineering is a sense of urgency. When there are big headlines about 4,000 people patching code, attackers exploit that urgency, and the urgency itself creates attack vectors.
Take a bank mobilized to patch vulnerabilities, with everybody scrambling. Attackers may reach employees with something like, "Hey, this is about the project to patch our vulnerabilities. Can you approve this request for me?" Or a cloned CFO voice: "We need more resources for the project. We need to hire more contractors, so I need you to authorize this transaction today." Or the old pretext, "I'm Joe from IT, can you please authorize this request on your multifactor authenticator?" These are the usual social engineering paths, and they're super common. In patch mode, each one borrows credibility from something real. The project exists, the company really is bringing in contractors, and IT really is sending people requests.
People are busy on a normal day, and they get busiest when something major happens. There are a lot of emails coming, a lot of Slack messages, a lot of calls, and even more in a situation like this. A fake request gets harder to spot because it's in the middle of a huge mountain of noise. If it looks legit, people don't stop and think for 30 minutes about whether it's real. They just go with the flow: "It's just another email in my inbox that I need to get rid of."
What gives a patch-project lure away is context: whether the request makes sense coming from that person, through that channel, at that moment. So I want employees trained for context and not just for markers. Teaching them to look for bad grammar or a weird sender domain is an outdated and dangerous practice, and a lure like that doesn't need either.
These are the social engineering attacks to expect during a vulnerability remediation push like Bank of America's Mythos project, each with a lure that borrows the project's credibility.
Figures compiled from publicly reported industry data; see linked sources for methodology.
Which Employee Roles Are Most Targeted by Social Engineering During Security Remediations?
In a smart attacker's first week inside that chaos, the first job is finding the most vulnerable entry points: who the weakest spots in the company are, and how to use them to gain access.
Accounts payable is one. People in AP are paying more invoices than they used to, because there are a lot of last-minute approvals, payments and contracts coming in for contractors, new employees and new vendors. Even a low-level accounts payable clerk with access to payments can be the entry point. A "make this $100,000 payment for me, it's urgent" from someone impersonating the CFO lands in a queue full of legitimate urgent payments and looks like the rest of them.
A branch manager is another. This person has access to funds and transfers and reads the news like everyone else, but isn't part of the structure dealing with the macro issues, like patching what Mythos detected. Then an email arrives from someone claiming to have power within the company, or from IT: "I need you to authorize this transfer because it relates to the security of your branch and the vulnerabilities we found during our research." They've read the news, so there's fear, and the message brings urgency. They want to do their job and avert risk, and with fear and urgency together, they may go with a gut reaction instead of stopping and thinking.
A breach can start on a branch. You just need an employee with some degree of access to escalate it. Middle to upper management, finance teams and executive personal assistants are highly susceptible too, because they hold the access keys to critical internal data. Attackers often go after them by impersonating IT with deepfake audio or fake QR codes, and an "I'm from IT" story is much easier to sell while IT is in the middle of a massive remediation. Because of that access, security awareness has to be company-wide and include management.
Why Are Internal Employees More Vulnerable to Social Engineering Than Temporary Contractors?
When a company adds a thousand outside contractors in a hurry, staff are easier for an attacker to fool than the contractors. Staff don't know who's coming in, who's real and who's not, and they don't know if a request is legitimate. Contractors may have limited access, local access only. And outside people tend to ask more questions when they get an instruction, because they're not part of the structure.
So during a surge, the people who need extra attention are the employees who already have access and are suddenly surrounded by unfamiliar faces, including the IT team with admin rights doing the remediation itself.
Why Does Security Software Fail to Prevent Human Social Engineering Vulnerabilities?
When people become the soft spot, the reflex is to buy something or tighten something. Buying more software will never fix a human vulnerability. It turns into a race towards zero, because leaders keep stacking software that gives them signals but doesn't give them solutions.
Tightening the filters is like reducing a highway's speed limit to 10 mph. You'll drastically reduce incidents, but the false positives will halt the business. In patch mode, the legitimate traffic looks a lot like the attack: urgent requests, new vendors, new contractors, security requests from IT. Clamp down on all of it and your SOC drowns in alerts while the remediation slows down, and the cloned CFO voice on the phone still gets through.
My advice to CISOs for high-pressure periods, like the end of the fiscal year, is to leave the filters alone and intensify the awareness training. Email security tools should be calibrated to a baseline plateau, and whatever gets past them is a job for employees' well-trained common sense. A patch push is a high-pressure period too. I'd map the training to it and aim it at the people the mobilization puts under pressure, like accounts payable and the branches, for as long as it lasts.
What Is the Pause-Verify-Act Cybersecurity Framework for Mitigating Social Engineering?
At Right-Hand Cybersecurity, we train employees on the pause-verify-act framework, specifically against the instinct to clear out the inbox when there's a mountain of noise. Pausing means you stop and check before you comply. And if it's unusual, that goes double.
Verifying means you get out of this cycle, you and the message, and go around that cycle. If an odd request comes in on a call, you hang up and contact the executive directly. The FBI warns that AI-cloned voices can sound nearly identical to real ones, and its advice is the same: find the person's number yourself and call to verify. We also advise department-level safe words, agreed in advance, so the real person can leave a watermark that says, it is me and I'm making this request.
The pause only holds if leaders protect it, by actively supporting the employee who questions an urgent request. That matters even more where national or regional customs treat pushing back on a boss as disrespectful, because clear permission from the company can override that custom. And if an employee pauses to confirm an urgent executive request, and the confirmation takes longer than a day with no one following up, it was never urgent, or it was never real.
Pause-Verify-Act
A stronger, more resilient workplace starts with you.
Follow this simple framework to help prevent social engineering attacks.
Stop and check before you comply.
Get out of this cycle and contact the executive directly.
Proceed safely or report.
How Should CISOs Measure Human Cybersecurity Risk Using SOC Behavioral Violation Data?
For me, the most critical metric for a security culture is the number of actual behavioral violations your SOC records. Training completion rates and phishing simulation scores are useless next to it. Set a baseline and a benchmark for every type of risky behavior, across every department. Then you know what normal looks like for accounts payable or your branches before the next mobilization, and you can see when it moves.
The approach I advocate has two heads. Simulated phishing builds the theoretical knowledge, and targeted lessons are triggered by real-life risky behaviors your security stack detects. That's training based on behavior, but also training based on performance, and the lesson goes to the person whose real action set it off. When the simulation scores and the SOC data tell different stories, real life always wins, and it always should.
At Right-Hand Cybersecurity, we've helped multiple customers build a proactive security culture, and the result was a measurable surge in employee-driven reporting of potential threats. I see that kind of surge as a sign of a healthy culture, even when it means more safe items get flagged by mistake.
If you're the CISO behind a push like Bank of America's, you'll be tracking the code side closely: flaws found, flaws fixed, contractors deployed. Put your people on that same report. Your accounts payable team, your branch managers and your executive assistants are part of that project's attack surface whether anyone assigned them to it or not. A thousand contractors can fix a lot of code in a quarter and then roll off. Your people are still there afterwards, and it's easier to program software than to change human behavior. So their risk has to be measured and managed as continuously as the code now is, department by department and against a baseline.
Frequently Asked Questions
How can security teams mitigate BEC risks when attackers exploit the urgency of large-scale remediations?
The urgency of a major vulnerability sweep makes executives prime targets for Business Email Compromise (BEC). With the FBI reporting $3.047 billion in BEC losses in 2025, CISOs must automate behavioral nudges precisely when anomalous financial requests hit inboxes, disrupting the attacker's momentum without adding to SOC alert fatigue.
What controls should CISOs implement for temporary contractors deployed during the Bank of America Mythos remediation?
When surging 1,000 contractors for rapid remediation, human risk management must pair with strict access controls. According to NIST guidelines, CISOs should automatically disable emergency accounts after a defined period and restrict privileged access to authorized roles, ensuring temporary identities aren't weaponized later for lateral movement.
How should organizations defend against MFA fatigue attacks when IT staff are overwhelmed by vulnerability patching?
When IT is overwhelmed by high-severity vulnerability patching, attackers exploit the chaos via MFA push-bombing. To support your human firewall, CISA advises implementing phishing-resistant MFA, or at minimum, enforcing number-matching to neutralize prompt-spamming tactics and reduce the incident response burden on your SOC.
Does AI-assisted phishing mean CISOs should abandon traditional email security filtering during critical system updates?
Filters aren't a silver bullet. Despite AI advancements, Verizon's 2026 data shows phishing's overall initial access share barely moved. Instead of over-tightening perimeter filters - causing false-positive gridlock during critical updates - CISOs should deploy real-time behavioral coaching that intervenes precisely when hyper-personalized, AI-driven lures inevitably bypass the stack.
How can enterprise SOC teams validate the ROI of their human risk management programs during intense threat cycles?
Abandon passive compliance metrics. Because the human element drives 65% of financial breaches, ROI is proven by tracking actual behavioral change. Measure the reduction in MTTD for user-reported threats and the sustained decrease in human-driven SOC alerts during chaotic remediation events. Real security relies on actionable data.
