AI Can Build a Dossier on Your CEO in Ten Minutes. Most Companies Have No Answer for That.

Key points

• A security consultant built a detailed profile of a financial services CEO using AI tools in under ten minutes, drawing on career history, personal interests and negotiating tendencies from public sources.
• The 2023 MGM Resorts breach reportedly began when criminals found an executive on LinkedIn and used that public information to impersonate them in a call to IT support, obtaining login credentials within minutes.
• AI tools don't just find information: they connect it, producing a ready-to-use summary rather than a pile of raw search results.
• The Verizon Data Breach Investigations Report consistently finds that human manipulation is present in the majority of confirmed breaches each year.
• Executives whose family members overshare online are also exposed: attackers who can't pressure a CEO directly may target a spouse or child instead.

A security consultant sits down with a general-purpose AI chatbot, types a senior executive's name, and in under ten minutes receives a structured summary of that person's career, public opinions, charitable interests and professional relationships. Nothing in the output was secret. All of it came from press releases, conference talks and social media posts the executive had approved. Assembled into a single readable profile, it hands any motivated stranger a detailed map for manipulating that person.

That's the scenario described in a piece first reported by CSO Online, and it captures a shift in risk that most corporate security programmes haven't addressed.

How did this become a problem so quickly?

Traditional OSINT, meaning open-source intelligence gathering using only publicly available information, used to take days of careful, skilled work. Analysts would comb through search engines, company filings and archived news stories. The time cost was a genuine barrier. AI demolished it.

Synthesis is the real danger; speed is just the headline. A search engine hands you documents. An AI tool hands you conclusions: "this person cares about climate policy," "this person is close to these three board members," "this person's schedule is visible through their public speaking calendar." That's exactly the detail a criminal needs before calling a company's IT helpdesk and pretending to be the CEO.

The MGM Resorts incident from 2023 made the principle visible at scale. Criminals reportedly found an executive on LinkedIn, used the public profile to sound convincing on a call to IT support, and walked away with access credentials. We've followed the MGM case since 2 July 2026; the attack's first steps required nothing that isn't freely indexed today.

Attacks that once required a trained analyst now require only someone with a grievance and an internet connection. That changes who's doing the targeting, not just how.

Family members are a consistent blind spot. If an executive's spouse or child routinely posts about their location or daily routine, that information feeds the same profiles. Attackers who can't reach an executive directly will look for pressure points nearby.

Should security teams be running these queries on their own executives?

Yes, and not once a year. Treat what comes back the way you'd treat a software vulnerability: assess it, prioritise it, act on it. Assign a named person with a security mandate rather than a PR mandate, and put AI exposure on the organisation's formal risk register. This isn't a communications function; it needs budget authority and a reporting line that reaches the CISO.

Showing executives their own AI-generated profile in a live briefing works better than any abstract warning. The reaction is reliably the same: surprise, discomfort, immediate engagement. Our 14 July story on AI failures in incident response made a related point: security teams are consistently slower to update their procedures than the tools they're defending against.

If you're an executive or a family member of one, treat your public digital footprint as something with real consequences. Old conference biographies, posts about travel patterns and connection lists on professional networks all feed these profiles. Audit what's out there, remove what serves no business purpose, and be deliberate about what goes up in future.

The uncomfortable truth is that the executive who thinks their public profile is a communications asset hasn't yet seen what a determined person with a query box can do with it in the time it takes to drink a coffee.