AI has changed cyber security. It can write convincing phishing emails, analyse targets in minutes, and help attackers scale their efforts in ways that were unimaginable just a few years ago.
But despite all that technological change, one thing remains consistent. Human decisions remain play a major role in an organisation’s defences.
QA, the UK’s leading AI technology and Cyber security training partner, have revealed that organisations need to give people training, processes, and support to spot potential attacks and respond appropriately. With the best layer of defence being when people, processes and technology work together.
AI has changed the game, but not the prize
Ali Kazmi, Principal Learning Technical Specialist comments: “For ethical hackers – cyber security professionals who are hired to hack into organisations to test their defences – and actual cyber criminals, the method hasn’t changed as much as you would think.
“Most of the time, a successful attack still needs someone to click a link, approve a payment, download a file, or reveal credentials. The difference is that AI has dramatically improved an attacker’s ability to get to that point.
“Poor spelling is no longer a reliable warning sign that a message isn’t legitimate. By drawing on information gathered from public sources or compromised communications, attackers can create messages that look authentic, reference real projects, and mimic colleagues with surprising accuracy. Research that once took hours can now take minutes. An attacker can quickly gather information about an organisation, identify likely targets, and send communications at scale.
“While exposed services or vulnerabilities can be exploited without a victim responding, attacks that rely on social engineering – the exploitation of human behaviour –still depend on someone taking an action and AI makes it easier for cyber criminals to make those requests convincing.”
Why humans remain the attack surface
“When people think about cyber security vulnerabilities, they often think about software flaws, unsecured servers, or outdated systems. Ethical hackers often think differently.
“A hurried employee, a helpful service desk, a new starter unfamiliar with internal processes, or a supplier with weak controls, can all inadvertently offer attackers a foothold.
“Recent attacks continue to demonstrate that social engineering still plays a major role in security breaches. The technology does what it’s supposed to do but people can be persuaded to circumvent it.”
Training needs to evolve
“One of the biggest challenges organisations face is that many employees are still being trained for yesterday’s threats. Traditional cyber awareness training often focuses on spotting suspicious spelling, unusual formatting, or obvious phishing attempts. Modern AI-powered attacks are not as easy to spot.”
A study conducted by QA, discovered that many organisations underestimate this challenge.
It found that 39% of workers had received no training on AI-powered cyber threats in the previous 12 months. Of those polled, 35% said they were not very confident or not at all confident they could recognise an AI-generated phishing email.
And while more sophisticated cyber-attacks will no doubt continue to rise, data reveals that 85% of businesses that identified a cyber security breach or attack had experience phishing1.
Keep training role-focused and grounded in real-life scenarios
Ali adds: “Organisations need training that reflects today’s threat landscape, particularly around AI-enabled impersonation, social engineering, and verification behaviours. Training should be tailored to realistic scenarios workers are likely to encounter in their jobs. Finance teams should receive periodic training on verifying bank-detail changes, service desks on following identity checks, and all employees on reporting suspicious requests.”
People are one of your best layers of defence
“For all the discussion about AI agents, automation, and machine learning, the most important cyber security question remains simple- What will your people do when a suspicious request arrives?
Organisations that invest in awareness, judgement, and practical security behaviours have something attackers still struggle to overcome: a workforce that knows when to stop, think, and verify.”
Be the first to comment