#654
The Unhedged Variable

Some of the most quantitatively formidable firms in finance spent this week discovering the new softest part of their defenses, and it was not code-related. Hackers went after the information systems of Two Sigma, Citadel, and Point72, along with several private equity firms, and they did it not by breaking the cryptography but by picking up the phone, using AI to clone the exact voice, tone, and phrasing of colleagues those employees trusted and calling in to talk their way past the gate. Voice phishing, or vishing as the kids call it, works because a convincing human on the line can walk past a security stack that would repel any purely digital assault.

The irony is in which firms were chosen. These are shops that price every conceivable risk, that model tail events and correlation breakdowns for a living, and yet the attack routed around all of it through the one variable no risk model captures cleanly: a person under pressure deciding whether the caller is real.

The uncomfortable lesson is that AI has quietly rewritten the economics of the con, turning what once took a talented mimic and hours of effort into something scalable, cheap, and unnervingly convincing at the push of a button. Even the backstop is shaky, since insurers are now split over whether a cyber policy's social engineering clause pays out at all when the voice on the line was a clone rather than a hacked inbox. So the tally reads strangely: billions in compute, oceans of data, defenses most governments would envy, and the way in was a phone call and a good impression.