Truace
Subscribe

Review finds generative AI fraud attacks exploit weak spots in zero-trust cyber defenses

Study title: The Erosion of Cybersecurity Zero-Trust Principles Through Generative AI: A Survey on the Challenges and Future Directions

In a peer-reviewed survey published October 15, 2025, researchers analyzed 10 recent Zero-Trust Architecture surveys and 136 primary studies from 2022-2024 and found most controls lacked real-world validation. They argue generative AI attacks exploit those gaps and propose a seven-stage Cyber Fraud Kill Chain that maps synthetic identities, context manipulation, and adversarial telemetry to NIST SP 800-207 components.

Read the study abstract

Generative artificial intelligence (AI) and persistent empirical gaps are reshaping the cyber threat landscape faster than Zero-Trust Architecture (ZTA) research can respond. We reviewed 10 recent ZTA surveys and 136 primary studies (2022–2024) and found that 98% provided only partial or no real-world validation, leaving several core controls largely untested. Our critique, therefore, proceeds on two axes: first, mainstream ZTA research is empirically under-powered and operationally unproven; second, generative-…

By the Truvace desk1 min read1 sourceEvidence: Moderate · 70/100 — Systematic review or meta-analysis · n = 146 · 1 independent sourcePeer-reviewedTRV-2026-0483· cite & verify
The Erosion of Cybersecurity Zero-Trust Principles Through Generative AI: A Survey on the Challenges and Future Directions
Expeditionary mobile operations center (EMOC) by Gonzalez, Jose. Public domain

In brief

The findings matter because they suggest current Zero-Trust principles of verify explicitly and assume breach are being undermined at scale, with compliance regimes unable to audit AI-mutable content. The authors contend incremental extensions are insufficient and call for a generative-AI-aware redesign, but the survey itself does not test countermeasures, leaving effectiveness and implementation feasibility unresolved.

Main points

  1. Review covered 10 recent ZTA surveys and 136 primary studies from 2022-2024.
  2. 98% of reviewed studies provided only partial or no real-world validation of core Zero-Trust controls.
  3. Authors propose Cyber Fraud Kill Chain with seven stages: target identification, preparation, engagement, deception, execution, monetization, and cover-up.
  4. CFKC maps generative techniques to NIST SP 800-207 components and cites synthetic identities and adversarial telemetry as erosion mechanisms.

The problem

Generative AI enables fraud attacks that erode Zero-Trust Architecture by using synthetic identities and context manipulation to increase false-negative rates, extend dwell time, bypass policies, and evade audit trails.

The rundown

The authors conducted a survey of 10 ZTA surveys and 136 primary studies published between 2022 and 2024, concluding mainstream ZTA research is empirically under-powered and operationally unproven.

To expose compounding risk, they introduced the Cyber Fraud Kill Chain, linking generative techniques to specific NIST SP 800-207 components and arguing that existing guidance offers no systematic countermeasures for AI-scaled attacks.

Sources

  1. Peer-reviewedJournal of Cybersecurity and Privacy2025-10-15

The debate