ISC2 Security Congress 2026: Can You Trust What You See and Hear?

In the opening keynote session at ISC2 Security Congress 2026 in Denver, Colorado, Dr. Jessica Barker and Freakyclown discussed how criminals don’t need to hack technology if they can hack the people using it — and how AI is making that easier, faster and more convincing than ever to do. 

Artificial Intelligence (AI) was the core theme of the opening keynote at Congress, as Dr. Jessica Barker MBE and Freakyclown begun three days of insightful and challenging discussions for the attendees in Denver and virtually. Their joint session looked at how we can rethink cybersecurity when AI can fake reality.

Freakyclown specializes in ethical hacking and social engineering, and particularly assessing (and beating) the physical security of banks; Barker has a background in sociology and specializes in how psychology, human behavior and organizational culture relate to cybersecurity.

Fear Is What We Should Fear the Most

After a light-hearted introduction, the first topic of conversation was one of the key elements of social engineering attacks: fear.

Barker noted that fear is a natural part of the way humans work. “Fear is something that is hardwired into us as human beings,” she said. “We have evolved to be scared of new things,” she added, particularly with new technologies, giving the example of the terror-laden headlines in the press when trains were first introduced. Barker noted that fear is sometime misplaced and that with new technologies such as AI it is fine for there to be fear, but it needs to be handled appropriately, proportionately and clearly. If we over-communicate the fear aspect of AI, people will simply not listen to those offering warnings and guidance.

Four Pillars of AI Threat

Barker listed four key areas of threat around AI: the fact that AI can now imitate the people that we trust; that it can influence the decisions that we make; that it is being increasingly trusted with our information; and that it is being trusted more and more to act on our behalf.

Freakyclown took up the narrative, noting that having known the key bad actors in cyber for many years (nation state attackers, hacktivists, insider threats and the like), AI has firmly been added to the list. He pointed out that AI can be frightening to organizations, which can make it easy for a security team simply to refuse to allow it at all. The problem is that: “Everyone will find a way to use AI, whether or not you want them to or not,. What that means is they'll go off and they'll install things that they're not supposed to,” he said. “It's better if you integrate it and then you secure it rather than just saying no,” he added, citing some recent Microsoft survey that found that over a million browser extensions were hiding code that was stealing data. And referencing agentic AI, Freakyclown gave the example of OpenAI’s tools hacking Hugging Face because the tools decided this was the best way to find the optimal answer to the problem they had been set.

Barker then looked at how cybercriminals are using AI to “power up” their capabilities in social engineering. She noted that looking in emails we receive for poor spelling or grammar, along with hovering over links to verify them, is no longer relevant because AI is able to produce materials with perfect grammar and convincing links. On the other hand, though, Barker noted that although the mechanisms for socially engineering victims have developed thanks to technology, the underlying principles have always remained the same. Exploiting trust was the first example, followed by taking advantage of how human beings process information – specifically where we process emotionally rather than rationally and succumb to techniques such as artificially inducing urgency and emulating authority.

Freakyclown demonstrated the longevity of social engineering techniques with an example from the Second World War, where British forces had deployed inflatable tanks to mislead enemy reconnaissance teams as to the true location of real forces; Barker countered with a more modern example in which a scammer with a silicone mask conned the equivalent of $90 million from victims by masquerading as a French government minister.

The Source of The Data

A live demonstration followed, to address the question: where are the criminals getting their information from?

“if you are attacking someone,” said Freakyclown, “you do what's known as open source intelligence on that person,” in that: “if I come and target your company. I'm probably targeting maybe 10 individuals in that company.” Noting that the scripts he was using were vibe-coded, he set the program running to find information about a specific person (who, it should be noted, had given permission for this to be done). The scan finished after a minute or so, at which point the results were given to another AI engine to establish how to attack that individual, which in another couple of minutes was able to carry out tasks such as registering a fake domain and then generating the phishing email to send to the victim. Work that previously took 40 hours, he said, was now a three-minute task.

FC then turned to deepfakes, noting that if the recipient of a fake email decided to call the sender to verify their identity, this could well result in them speaking with another deepfake. He demonstrated how straightforward it is to create a deepfake by inviting ISC2 CEO Scott Beale to the stage and having his moving image transformed into William, the Prince of Wales (though a slightly chubby version) live and in near-real time (the video delay was about a quarter of a second), kicked off with a single mouse click. Barker noted that where a few years ago creating a deepfake would require large numbers of images and sound files, this is no longer the case – and the results are far more convincing. So, she said, “we need to prepare people for uncertainty”.

Overcoming Uncertainty

Barker’s point here was that we cannot remove uncertainty – hence the need to prepare people for it, and to “build the culture, processes and behaviors that help people navigate it.” She noted that we need to ask people to “tune into their critical thinking skills,” to explain to them how to identify emotional manipulation, and to “step back, recognize maybe they're being manipulated and then feel comfortable and safe reporting.” We need, she said, to be “making those safe actions easy and building the kind of cultures where we encourage people to pause and question.” Barker addressed the earlier point that if we ban AI completely, people will still find a way: “They will find a workaround unless they really understand why it's relevant to them not to”.

Meaningful Actions

Barker summed up with five short take-away points. First, to bear in mind that seeing is not always believing, which is a result of the second point: scams are getting more convincing. Third, that we must think before sharing information with AI: once information has been transmitted, it is completely impossible to recall it or somehow to erase it from the AI engine. Fourth, that AI agents can do more than answer questions. And fifth, that you don’t have to be certain to report something – it is far better than holding back and missing a real attack. Barker pointed out that everyone is fallible given the right circumstances – specifically that “the right phish at the wrong time can catch anyone”.

Before finishing, Barker revisited a concept she had explored right at the beginning of the session as a way of demonstrating how the human brain works. She had played the audience a short stream of sound which had begun as human speech but which had been run through a filter and sounded like a stream of robot-like gibberish, challenging the audience to figure out what was being said … which nobody could do. At the end of the presentation, she replayed the same sound stream, and the audience could clearly hear that it was in fact saying: “the right phish at the wrong time can catch anyone” – simply because they had just heard that expression and the mind dealt with the robotic sounds in a different context and with knowledge it had not previously had.

Barker concluded the session by noting that “one of the biggest challenges that we face in cybersecurity is that the more knowledge we gain and the more experience we have about cybersecurity, the more we have to remind ourselves of what people don't know and how we can translate messages to really reach them”.

Learn more about ISC2 Security Congress 2026 Sessions

Virtual Congress attendees can watch an on-demand replay of this keynote as part of their existing access. On-demand access packages for Congress sessions will be available post-event.