Sarah Armstrong-Smith: Image-based AI is reshaping cyber risk for businesses and the public
From deepfakes to impersonation, image-based AI is introducing new cyber risks that are affecting individuals and organisations alike.
As artificial intelligence becomes more deeply embedded in everyday digital life, concerns around cybersecurity, image misuse and personal safety are growing. Tools that make it easier to generate and manipulate images are now widely accessible, raising new questions about impersonation, privacy and how quickly harm can spread online.
To understand how these risks are evolving, Champions Speakers Agency spoke exclusively with Sarah Armstrong-Smith, one of the UK’s most experienced cyber security experts.
A former Chief Security Advisor for Microsoft across Europe, the Middle East and Africa, Sarah Armstrong-Smith has advised governments, businesses and critical infrastructure organisations on cyber risk, crisis response and digital resilience. She is also a member of the UK Government Cyber Advisory Board.
In this report, Sarah Armstrong-Smith explains how image-based AI is reshaping the threat landscape, why individuals are exposing themselves in ways they may not realise, and where organisations continue to underestimate the cyber risks associated with rapid AI adoption.
1. Image-based AI tools are now widely available and easy to use. How has this shift changed the cyber threat landscape, particularly when it comes to impersonation, deepfakes and image misuse?
Sarah Armstrong-Smith: Image-based AI tools have lowered the barrier for impersonation, harassment and deepfake abuse. Individuals who never considered themselves potential targets now find their likeness manipulated or weaponised with minimal effort. The threat landscape has democratised in a way that feels deeply personal.
Once a system is exposed to the public, malicious actors will test its limits immediately by attempting to break existing safety rails and identify where some don’t even exist. The difference today is that image-based tools can cause reputational, emotional and even financial harm at scale, often before a victim is even aware.
For individuals, the key message is that cyber risk is no longer confined to passwords and phishing emails. Your face, voice and online presence have become part of your attack surface, whether you intended it or not.
2. Many people assume the biggest risks come from knowingly sharing personal data. In reality, what less obvious ways are individuals exposing themselves on AI-driven platforms without realising it?
Sarah Armstrong-Smith: Many users assume risk only arises when they upload personal data. AI platforms infer far more than people realise from behavioural patterns to emotional cues, location data, relationship dynamics and even identity traits. Every interaction becomes a data point, which can be cross-referenced across other platforms.
Images are particularly revealing, not just in terms of the actual person. Background objects, reflections, clothing logos, metadata and even shadows can disclose information unintentionally. AI systems can extract meaning from details humans overlook.
Today’s platforms operate at a far more sophisticated level, meaning users may be revealing more about themselves through casual engagement than they ever intended.
3. As organisations race to adopt generative AI, where are businesses most commonly underestimating the cyber and data security risks involved?
Sarah Armstrong-Smith: The biggest gap is the assumption that generative AI tools are ‘just productivity enhancers’ rather than huge data processing systems with security implications. Organisations often deploy them informally through pilots, shadow IT or experimentation, without considering data governance, model behaviour or regulatory obligations.
There is a tendency to underestimate how models retain, infer or reproduce sensitive information. Without strict controls, confidential data can leak into prompts, outputs or training pipelines.
AI models are already exposing large gaps and vulnerabilities in existing processes, but organisations are either not fully aware, or not incentivised enough to close them, due to the concerns of being left behind, or not being competitive enough in an open market.
Experimentation without guardrails can create unintended consequences. Organisations adopting generative AI today must treat it as a security capability, not a novelty.
This exclusive feature with Sarah Armstrong-Smith was conducted by Tabish Ali of the Champions Speakers Agency.