AI is rapidly changing the world around us and security is no exception. Staying safe in the age of AI has meant dealing with a reality that seems more like a sci-fi movie.
To help us deal with the increasingly complex security environment, Muslims in Tech asked one of its members, in this case Yaseen Ahmed from Gridware, to do a write up of simple steps we can take to protect ourselves in the age of AI.
Below is his article:
2026 was promised to us years ago as a year of progress and technological advancement. We were promised many things, but we were not promised the rise of deepfakes. We were not promised the ability to mass-send custom spam using an LLM. We were not prepared for the death of passwords and the acceleration of exploit development with these new advancements.
This article is not meant to be a debate about the progress and nature of new technologies that have been released, but rather it is a field guide to keep yourself and those important to you safe in this time of uncertainty. We will be covering individual security, measures you should take for your wider family, and actions you should take if you have the ability to take them in your place of work or in your business.
DISCLAIMER: This post was drafted in the end of July 2026. Things can and things will change over the coming years, months, and even weeks. In July alone we have seen one of the most hardened web frameworks ever created compromised using AI. Never take any security mechanism you have for granted, and always always always stay up to date if you care about your security posture.
How do I secure myself?
This is a question that many people in the cybersecurity industry get asked a lot. The answer to any “Can I secure xyz?” question is that you can never guarantee the security of anything. Every day there are new attack vectors and ways to bypass existing security controls, and every day there are ways to counter these new developments. Online security is constantly evolving, with the field changing dramatically almost every week.
While you can never guarantee security for anything, you can decide how much risk you are willing to accept.
What do you mean how much risk I’m willing to accept?
Let’s put it this way. If you wanted to be 100% immune from any and all online threats, you would burn and discard any and all internet-enabled devices you own and lock yourself in a Faraday cage. This, obviously, is quite an extreme way of living life, and probably would not be ideal or even sustainable in 2026.
The harsh reality of security is that you will always have a compromise between security and something else – which is usually convenience or ease of use. The internet and the online world was not designed with security in mind, so it is on you to decide how much you are willing to secure, and what you are willing to give up to secure it.
Are passwords enough for me to keep myself safe then?
In the early days of the internet, a username/password combination was enough to keep your online accounts somewhat safe – if you chose a good password. Nowadays, not only do you have to choose a sufficiently good password and one that is long (the official Australian government recommendation for passphrases is 15 characters), you also have to trust that…
- Your password is stored securely
- Your password is encrypted (called password hashing)
- … and that the encrypted password is slightly randomised
- That when it is encrypted, it can’t be decrypted easily if the website gets hacked
- … and also inaccessible to employees who might have bad intentions
- Among other issues…
Even using password managers that manage your unique passwords is no longer guaranteed to be safe, as several password managers have been breached in the past. Your security is never guaranteed by putting it in the hands of someone else.
The password is dead… long live the password?
This is not to say that passwords are bad, or that you should never use them. You just have to be incredibly mindful of what passwords you are using and whether or not they are considered safe.
If you want to secure yourself, make sure that a username and password combo is never all you need to access your account. Ideally, you will want two ways at least to prove who you are and be able to log in to some services, and even more if you are accessing sensitive applications (like your bank or your email). Some things that you can use include:
- Physical fingerprint scans
- Email verification codes… not SMS
- Physical passkeys (like Yubikeys)
The list is endless nowadays, but the important thing is to pick at least one of these that you can guarantee that nobody else can easily obtain.
Why should I be so worried about this? I never fall for scams!
…is what nobody should ever really be saying. Scams are no longer your long lost uncle offering you a pile of money. Scams and spam have become incredibly sophisticated, with AI able to conduct realistic phishing campaigns by generating convincing messages and backstory, and without the common spelling and grammar mistakes found in stereotypical spam messages.
It is also good to know that the majority of internet users now are bots, not human. Statistically, the person in the comments of that Instagram reel or that somewhat dodgy email is not a human, but probably some script or AI run to get you to do something. We will cover this topic more below.
The bottom line here is that humans are incredibly easy to fool. All it takes nowadays is being signed in to a website, clicking one link, and you’re completely compromised. You should never click any link that you don’t know exactly where it goes, and if you think you know… just check again just in case. It should go without saying that you shouldn’t interact with spammers or scammers, because then it will highlight to them that you are a person who engages with their content and you’ll be flooded with more spam and scams.
In general too, you really shouldn’t post too much publicly available content of yourself on the internet. Anything that can be found on your LinkedIn, Facebook, and Instagram accounts will almost certainly be used to create a very tailored and convincing scam to target you. Make sure that your public accounts are set to private if possible, and if you can, do not reveal:
- Locations any more precise than your city
- Pictures of you with younger children or your kids
- Names of people closest to you, such as family members
- Audio recordings of your voice and extremely high resolution photos of your face if possible (see the deepfakes section below)
Obviously this all depends on your risk appetite.
Why shouldn’t I have my voice recorded?
Deepfakes are getting increasingly more powerful, and can be used to easily clone faces and voices. Now, it takes three seconds of recorded voice to produce a deepfake of your voice with over 80% accuracy. Your face can also be easily deepfaked and cloned to produce a very convincing copy of yourself speaking to your family or being framed for a crime.
In general, if you don’t want someone online using something about you, do not post it online. This includes nowadays your voice and your face.
A quick note on privacy
This is not a privacy-focused guide, but many techniques to enhance your online privacy can be used to improve your online security.
While privacy is outside the scope of this article, there are great resources to check out, such as privacytools.io that can help reduce your online footprint, and reduce tracking across the internet.
All this is pretty scary stuff. How can I protect my family?
Having everyone in your family follow the same security procedures is a big way to reduce the risk of anyone being compromised.
Make sure you know who has access to your accounts if it is shared, and maybe consider only allowing yourself to access shared accounts if there is no reason to have them shared.
A big way to protect against deepfakes and voice cloning is to have a family “password”. Deepfake calls will usually put your loved one in a dangerous scenario (such as them being broken down on the side of the road or them being held hostage, and asking for money), so gather your family around and agree on a unique password or passphrase that you will use when someone calls asking for something.
It is good to teach your family members common scams going around and how to spot them. While the language and face of scams have changed, the basics (such as urgency and appeals to emotion) have not, so it is good to share experience and knowledge if you can.
What about AI?
AI usage and integration are increasing by the day. You can expect your kids and other family members to use it to solve their homework, plan for groceries, and organise birthday parties.
AI models are trained on everything you put into them. This includes any names, locations, and other personal details inputted into them. This can lead to a risk of sensitive information being outputted to other users when they prompt the AI in a certain way. As a rule of thumb, you should never put any sensitive information into AI unless you are running it locally or have a setting that can guarantee that models will not be trained on the data you feed it. You should also consider opting out of AI memory persisting between sessions and instead writing a custom prompt that summarises your use cases and how you want your AI to behave.
If you are working with agents, make sure there are guardrails around your agents, too. The more modern AI models have been known to cheat and jailbreak their way out of their environments, so you may be at risk of an AI compromising you if you give it too much access to your environment.
Following on from above, make sure your family knows basic AI hygiene, and that they know not to rely on it for much information, and to only use it to perform non-sensitive tasks and – again – to never put anything you wouldn’t want another user to see into the LLM.
That’s great, now how do I take all this with me to work?
Your workplace is much more likely to be targeted than you are. However, attackers are known to target individual employees in attempts to gain initial access to the organisation.
You shouldn’t neglect the practices above, nor should you rely solely on your company’s security procedures. The main principles of security discussed above still hold. Make sure your emails are all legit and come from a legit source, use strong passwords and MFA, and don’t put proprietary data into an AI.
Alongside all this, you really shouldn’t use your work email to sign up for anything that isn’t work related. If any company gets breached and your email is found in the leak, then an attacker is going to use it to either attack you directly or attack your company.
I’m worried about my workplace’s security, how can I improve it?
If you are in a position where you can make changes to your work environment, then you can push for certain changes to take place, like:
- Enforce MFA during signing in
- Enforce password/passphrase policy
- Implement guardrails into AI such as Copilot
- Make sure nothing is running on the open internet unless it has a good reason to be there
- Make sure all software is up to date
- Get an external penetration test or audit of the company’s security posture
Where to from here?
We are just scratching the surface on how we can keep ourselves safe in this day and age. The rabbit hole of online security is extremely wide and deep, and you can spend hours researching each individual topic mentioned above.
This post should hopefully have sparked your interest in this topic or at least given you a clearer picture of the threat landscape in mid-2026.
Obviously, feel free to reach out to me directly on LinkedIn if you want to discuss this topic further or if you spot something incorrect here, I would love to chat!
If you are more technical and like to read up on cyber, feel free to check out my blog for when I (rarely) post!
