As technology rapidly evolves and more and more attack strategies emerge from the unethical use of AI, cybersecurity has become more than a technical challenge – it is a continuous race to outpace increasingly sophisticated threats, merging human resilience with the ability to adapt.
Ahead of his third consecutive appearance at DefCamp, we spoke with George Proorocu, Fraud & Cybersecurity Manager at ING, about the importance of public awareness and the urgent need for dynamic defense strategies as AI shifts the threat landscape.
George is a seasoned IT professional with 15+ years of experience, evolving from technical roles to leading engineering teams in security-critical sectors. Passionate about coaching and empowering others, he combines hands-on expertise with strategic leadership.
You are known for coaching and teaching, having reached a sensational number of 180k+ students enrolled in one of your cybersecurity for beginner courses. Because of that, you must have a lot of contact with the new minds that are entering the cybersecurity world. From your experience, what are the characteristics of the people who are the most equipped to thrive in this field?
From what I’ve seen, the people who thrive in cybersecurity are not necessarily the ones who know the most when they start. They are the ones who stay curious.
Technology changes too quickly for anyone to rely only on what they already know. The strongest people constantly ask questions, experiment, break things, understand why they broke, and then try again.
I also think persistence is hugely underrated. In cybersecurity, you can spend hours following a lead that goes nowhere, troubleshooting something obscure, or trying to understand how an attacker managed to do something that initially seems impossible. You need to enjoy that process rather than just the result.
And finally, the best people I’ve worked with tend to combine technical skills with an understanding of people and the business. Cybersecurity is ultimately about protecting organisations and humans, not just systems. Especially today, with AI, fraud and social engineering becoming so interconnected, that broader perspective matters more than ever.
In 2016, you were recognized in the Financial Times ‘100 Faces of Innovation’ for your early work in building Romania’s internet market infrastructure. Following your career transition into cybersecurity, how has your perspective on innovation changed?
Back then, I was travelling a lot and had the chance to see how innovation was approached in very different environments.
One thing that stayed with me was the contrast between Europe and the US. In France, for example, I often saw startups working in their own box, very protective of their ideas and sometimes afraid that sharing too much meant someone might steal them. In San Francisco, I saw almost the opposite: people discussed ideas openly, challenged each other and improved them together.
I even met a startup CEO who was driving Uber partly because he wanted to meet people, talk about what he was building and hear different perspectives. That mindset really stayed with me.
It made me realise that innovation is rarely just about having a great idea. It is also about the surrounding environment: openness, curiosity, collaboration and the willingness to expose your thinking to others.
Cybersecurity added another layer to that perspective. Today, I still believe strongly in openness and collaboration, but also in building with trust and resilience in mind. The question is no longer only “can we build it?”, but also “can we build it in a way that people can safely trust?”
How do you see financial fraud evolving from now on, compared to the pre-AI era, and what should companies do from now on to strengthen their defenses against attacks?
Before AI, financial fraud was often limited by the attacker’s time, language skills and ability to scale. AI removes many of those limitations.
Fraudsters can now create convincing phishing campaigns in seconds, clone voices, generate realistic video, automate conversations and build synthetic identities.
The biggest change is not that every attack is more sophisticated, but that sophisticated attacks can now be launched at much greater scale and much lower cost. We are also already seeing cybercrime and fraud converge. Initial access to a company can simply be sold to another criminal group that then carries out ransomware, data theft or financial fraud.
For companies, the response has to be practical: assume that emails, voices and even video can be faked. High-risk actions such as payment changes, credential resets or privileged access should always require a second verification channel. And cybersecurity and fraud teams need to work much more closely together.
ING frequently collaborates with national authorities (like DNSC in Romania) to issue security alerts on AI-driven text phishing. How critical is public education to a bank’s overall defense strategy?
Public education is critical, because banks can secure their own systems, but they cannot fully control what happens on a customer’s phone, email or social media.
AI is making phishing much more convincing. Bad grammar and obvious mistakes are disappearing, messages can be personalised at scale, and even the language barrier is becoming much less of a problem for criminals because AI can generate natural-looking content in almost any language.
That is why awareness has to be part of the defense. In Belgium, we work with authorities, other banks and the media to raise awareness about the scams currently circulating and help people understand what to look out for.
My colleagues at ING Bank Romania are also doing a lot in this area. One example is “Nesupus Fraudelor”, a financial education campaign launched together with the Romanian Institute for Active Ageing, focused on helping elderly people understand phishing, smishing, spoofing and other common fraud techniques. I think initiatives like this are very important because some groups are targeted more aggressively and need communication adapted to them.
But education cannot be the only line of defense. Banks still need strong fraud detection, transaction monitoring, authentication and rapid response. The best protection comes when technology, education and collaboration across the whole ecosystem work together.
This is your third consecutive year at DefCamp, continuing your series of breaking down the security risks that come with the rapid technology evolution. In this year’s presentation, you are taking it a step further than ‘Deep Fakes’, your previous talk, shifting to the subject of attackers creating fake identities and operating inside corporate walls – basically building a human from scratch in order to infiltrate companies. How are organizations responding to these completely unethical methods?
DefCamp is one of my favorite conferences, and I’m proud that such an important cybersecurity event takes place in my hometown, Bucharest. Coming back for the third consecutive year makes it even more special.
Organizations are still catching up, because this type of attack sits between cybersecurity, fraud, HR and identity management.
The traditional assumption was that if someone passed recruitment, appeared on video calls, had valid documents and received corporate credentials, then they were a real employee. That is becoming dangerous, especially for fully remote jobs.
We are already seeing attackers use stolen or synthetic identities, deepfakes and AI-assisted interviews to get hired and gain legitimate access. Once inside, they may sell that access to another criminal group for ransomware, fraud, data theft, abuse of bank accounts or servers, or simply stay quietly collecting information.
The response has to start during recruitment and onboarding. For fully remote roles, companies may need stronger ID verification and, in some cases, a physical touchpoint: visiting an office or, if that is not possible, meeting a trusted colleague nearby.
The bigger shift is that identity itself can now be attacked. It is no longer enough to protect the account; we also need to verify that the person behind it is real.
How important is collaboration with the infosec community for ING and how essential is the participation of banking corporations at events like DefCamp?
Collaboration with the infosec community is extremely important, especially in banking, because attackers do not operate within organizational boundaries.
Banks can learn a lot from researchers, ethical hackers, security vendors and other companies. Sharing information about new attack techniques, vulnerabilities and fraud patterns helps everyone react faster.
For ING, events like DefCamp are also a way to stay connected with the technical community, learn from what researchers are seeing in the field, and exchange perspectives beyond the banking sector.
And it is also about giving something back. Through talks like these, we can share what we are seeing in practice, raise awareness about new types of attacks and hopefully help others prepare before they face the same problems themselves.
I think large organizations should participate actively, not only as sponsors, because that exchange works both ways: the community challenges our assumptions, and we can contribute real-world experience from operating security at scale.
Such open-minded perspectives from George remind us that innovation, together with protection, come from combining ‘technology, education and collaboration across the whole ecosystem’.
The future of security is built together, and there is no better place to experience it than DefCamp 2026! George Proorocu will be taking the stage to deliver a must-watch presentation: “Synthetic Insiders: The New AI Risk to Your Org”.
Meet the interview author:
I am Maria Parapeanu, a second-year student enrolled at the University of Bucharest, Faculty of Mathematics and Informatics. Through the extensive volunteer work I’ve done in the past year, I discovered a strong passion for project management, human interaction, and helping others. I am now looking forward to learning how to merge these interpersonal skills with my technical background and interest in problem-solving.
