Black Hat 2025: Executives Face New Category of Converged Narrative, Digital and Physical Threats

Cybersecurity leaders packed the Foundation Room at Mandalay Bay during Black Hat 2025 to hear an important warning: the threat actors targeting your organizations aren’t just stealing data anymore. They’re weaponizing information to target executives, employees, your brand, and your bottom line. Wasim Khaled, CEO of Blackbird.AI, detailed the rise of narrative attacks, alongside industry veterans Dave DeWalt, CEO of NightDragon, Chris Pierson, CEO of BlackCloak, and Stefanie Drysdale, Chief Strategy Officer of Prescient. Their message was clear. AI-powered narrative and digital attacks now move from social media to physical violence faster than traditional security teams can react. And most organizations remain blind to these threats until harm is done.

“A personal reflection… three years ago at my first Black Hat, our company and value proposition was barely visible in this industry. This year, we continue to scale with the help of our incredible friends and supporters like Alex Doll and Mark Hatfield of Ten Eleven Ventures, the entire NightDragon team and Robert Rodriguez of SINET. On the the last day of the event, it really hit me how far we’ve come when the Blackbird.AI brand was alongside Wiz, Darktrace and SentinelOne at Hakkasan’s invite-only Black Hat event with 1,000+ in attendance.

Blackbird.AI continues to innovate at the convergence of the world’s biggest problem – disinformation, the most disruptive market in technology – generative AI, and one of the fastest-growing enterprise sectors – cybersecurity. This is where a generation of winners will be built, and we intend to lead the pack in our space.” 

• Wasim Khaled, CEO Blackbird.AI

During a packed luncheon panel at Mandalay Bay’s Foundation Room, Blackbird.AI CEO Wasim Khaled joined NightDragon’s Dave DeWalt, BlackCloak’s Chris Pierson, and Prescient’s Stefanie Drysdale to dissect this new threat landscape. The discussion revealed how narrative and digital attacks have evolved from nuisance PR problems into sophisticated campaigns created by threat actors that can damage a brand or executive’s reputation, crater stock prices, trigger insider threats, and incite physical violence. The message was clear: CISOs need to add narrative intelligence and digital risk protection to protect their executives and enterprises exposed to attacks that their current tools can’t see coming.

LEARN: What Is Narrative Intelligence?

The Narrative Blind Spot 

“The fundamental blind spot is that influence itself has become a vector of attack,” Khaled explained to the audience of security leaders. Traditional cybersecurity focuses on protecting code, systems, and data. But threat actors have discovered something more vulnerable: human perception.

These aren’t new adversaries. The same nation-state actors, cybercriminal syndicates, and hacktivist groups CISOs already track have simply added narrative attacks to their arsenal. What changed is the economics. AI has made it as easy and cheap to launch a perception manipulation campaign as it is to deploy malware.

The results can be devastating. Khaled shared examples that made the room uncomfortable: FAA complaints timed to sabotage airline mergers for short-seller profit. Synthetic regulatory filings that force companies to walk back announcements they never made. Bot networks and AI-generated analyst reports are manipulating stock prices. Banking executives impersonated through deepfakes, making controversial statements they never uttered.

“Taken to its extreme, you get threat actors with guns settling scores based on what they read on the internet,” Khaled said. The reference to recent executive attacks wasn’t subtle. Neither was his point: narrative attacks are no longer just reputational risks. They’re existential threats that can turn physical.

“Narrative attacks driven by AI-fueled misinformation, cyber campaigns exploiting personal data far outside the corporate perimeter, and real-world surveillance and targeting of high-profile individuals are converging into a new category of risk, one that traditional cybersecurity tools and playbooks are ill-prepared to address.”

• Dave DeWalt, CEO NightDragon

The panel exposed a critical gap: most organizations treat narrative attacks as communications problems, not security threats. This misalignment leaves companies vulnerable.

“Mentions and sentiment is 15-year-old tech that will not help you in rapid decision making,” Khaled told the audience. While PR and Threat Intelligence teams count mentions, threat actors coordinate complex campaigns across multiple platforms using synthetic media, bot amplification, and AI-generated content.

Consider the April 2025 #TheBanksAreOutOfMoney campaign. Coordinated actors pushed the hashtag across social platforms while simultaneously circulating doctored Bloomberg-style dashboard screenshots suggesting major banks faced liquidity crises. The campaign wasn’t about stealing money or data. It was about stealing trust. And it worked, triggering genuine concerns about bank runs before financial institutions could respond.

These attacks bypass traditional defenses entirely. Firewalls don’t stop deepfakes. Endpoint detection can’t identify coordinated bot campaigns. Security information and event management systems lack visibility into perception manipulation occurring on social platforms.

The AI Acceleration Factor

Every security leader at Black Hat understands AI’s dual nature: powerful tool, dangerous weapon. The panel highlighted how generative AI has fundamentally changed the narrative attack landscape.

“These actors are deploying AI-based synthetic media, bot networks, and AI-generated content as easily as they launch malware or phishing campaigns,” Khaled explained. The barriers to entry have collapsed. A single actor can now generate thousands of unique, contextually relevant posts, create convincing deepfake videos, and orchestrate bot networks that appear entirely human.

The sophistication keeps increasing. Recent campaigns have featured AI-generated “leaked” internal memos so convincing that they triggered SEC investigations. Deepfake videos of executives making inflammatory statements spread faster than fact-checkers can respond. Synthetic analyst reports move markets before anyone realizes they’re fake.

The velocity matters as much as the volume. “An AI-based deepfake video or coordinated rumor can now move markets or trigger physical threats faster than most organizations can react,” Khaled noted. By the time security teams identify an attack, the damage is done.

When Narrative Attacks Become Real-World Threats

The convergence of digital and physical threats dominated the panel discussion. DeWalt opened by noting 2025 had already witnessed multiple violent attacks on executives, including the tragedy of the UnitedHealthcare CEO and an assault on a Blackstone executive in New York City.

These weren’t random acts of violence. Investigation revealed extensive digital reconnaissance preceding each attack. Threat actors used narrative campaigns to identify targets, inflame tensions, and justify violence. Social media became both the intelligence gathering platform and the radicalization engine.

“When an executive is targeted, the company is the target,” Khaled emphasized. “The brand, the stock, the strategy all become collateral. We have seen the value of companies take a hit by as much as 25% when these attacks occur.”

The panel stressed that executive protection can no longer separate digital and physical security. Threat actors don’t think in silos. They blend cyber reconnaissance with physical surveillance, use narrative attacks to enable social engineering, and leverage digital intelligence for real-world targeting.

Why CISOs Must Own This Risk

The question of ownership sparked debate: who should manage narrative and digital risk? Marketing? Communications? Legal? The panel reached a clear conclusion: the CISO.

“The inbounds we get from CISOs make it clear that CISOs now own this,” Khaled said. A year ago, most security leaders didn’t see narrative attacks as their problem. That’s changed dramatically.

The logic is straightforward. CISOs already track the threat actors launching these campaigns. They have the intelligence infrastructure, the incident response frameworks, and the board’s attention on security matters. Most importantly, they understand risk in ways communications teams don’t.

“If these threat actors are already under the CISO’s purview, then so should their narrative-based tactics,” Khaled argued. “It’s not just a comms or brand issue. The CISO is the only role with the mission, authority, and cross-functional visibility to confront this head-on.”

Building Narrative Intelligence Capabilities

The panel outlined practical steps for organizations ready to address narrative, digital and physical risk. The foundation is the ability to detect, analyze, and respond to perception manipulation campaigns and digital attacks before they cause harm.

Khaled described how Blackbird.AI customers use narrative intelligence: “They gain an understanding of the harmful narrative attacks targeting their executives and organization, who is behind it, what networks they are scaling across, is it bot-influenced, and what threat actors and nation states are spreading it.”

Armed with this intelligence, security teams can make informed decisions. Sometimes the correct response is a public counter-narrative. Other times, it’s better to stay quiet while implementing protective measures. The key is having actionable intelligence to guide those decisions.

WATCH: Webinar – Narrative Kill Chain: Mapping The Next Cyberattack Vector

THE WAY FORWARD – Narrative Attack Tips For Security Leaders

The Black Hat panel concluded with three essential actions every security leader should implement within the next 12 months:

• Treat narrative and digital intelligence as core to executive and enterprise protection. Stop thinking of perception manipulation as a PR problem. Recognize it as a security threat requiring the same rigor applied to other attack vectors. Build or acquire narrative and digital intelligence capabilities that provide real-time visibility into coordinated campaigns, threat actor attribution, and risk trajectories.

• Establish a fusion model connecting threat intelligence, communications, and executive protection. Break down the silos that threat actors exploit. Create operational units that integrate digital, narrative, and physical security into unified workflows. Develop playbooks, run simulations, and ensure every stakeholder understands their role to reduce the risk of attacks.

• Shift from incident response to always-on monitoring. Narrative and digital attacks develop over time, often for days, weeks, or months before causing harm. Continuous monitoring provides the early warning needed to disrupt campaigns before they achieve critical mass. The threat actors haven’t changed, but their tools have. That makes this a cybersecurity problem and a security leader’s responsibility.

The cyber actors targeting your executives haven’t changed, but their weapons have. They’ve added AI-powered narrative and digital attacks to their arsenal, enabling campaigns to shift rapidly from social media to stock manipulation to physical violence, outpacing traditional security responses. The panel’s prescription was clear: make narrative and digital intelligence a core security function, build fusion centers that connect digital and physical protection teams, and deploy always-on monitoring that catches threats while they’re still developing. This isn’t a future risk. It’s happening now. And the CISOs who recognize narrative attacks as their responsibility will be the ones whose executives and enterprises will be better protected in this new threat landscape intact.

• To learn more about how Blackbird.AI can help you in these situations, book a demo.