AI-Powered Social Engineering: Emerging Attack Vectors, Vulnerabilities, and Multi-Layered Defense Strategies is a peer-reviewed 2026 cybersecurity study examining how generative AI, large language models, deepfakes, voice cloning, synthetic identities, autonomous agents, and AI-assisted attack infrastructure are transforming social engineering.

The authors analyze how artificial intelligence changes the economics and effectiveness of cyber deception by increasing three core capabilities: Realism, Personalization, and Automation. Their systematic literature review screened 720 records across IEEE Xplore, Scopus, and ScienceDirect and retained 37 peer-reviewed studies for qualitative synthesis.

A central contribution is the Unified Model of AI-Mediated Social Engineering (UM-AISE), which maps AI capabilities across reconnaissance, engagement, and exploitation. The model incorporates a Markov Decision Process to examine how automation can reduce attacker cost, personalization can increase expected gain, and realistic synthetic content can increase the probability that a victim treats an attacker as trusted.

The Peer Reviewed Report  also evaluates emerging defenses, including AI-assisted detection and attribution, phishing-resistant authentication, early-stage persuasion detection, out-of-band authentication, cyber-threat-intelligence provenance and anti-poisoning controls, human-in-the-loop review, and broader technical, educational, legal, and governance measures.

The Authors of the AI-Powered Social Engineering: Emerging Attack Vectors, Vulnerabilities, and Multi-Layered Defense Strategies Report conclude that AI-powered social engineering represents more than an incremental improvement in phishing. The convergence of realistic synthetic media, high-precision personalization, and scalable automation can alter attacker incentives and create increasingly adaptive, economically viable deception campaigns. The study emphasizes that durable defense requires technical controls, human judgment, trustworthy intelligence, auditability, and governance rather than awareness training alone.

About the Authors

Kely Gonzaga — ESTG, Instituto Politécnico de Viana do Castelo
Sérgio Serra — ESTG, Instituto Politécnico de Viana do Castelo
Marco Gomes — ESTG/CIICESI, Instituto Politécnico do Porto
Silvestre Malta — ESTG/ADiT-Lab, Instituto Politécnico de Viana do Castelo; Corresponding Author

Kely Gonzaga and Sérgio Serra are credited with conceptualization, methodology, and writing.  All four authors participated in review and editing

Repository Note: Cyber Law Library provides this open-access research article for cybersecurity research and reference. The original scholarly publication is Computers 2026, 15, 128, published by MDPI.