New survey reveals 39% of employees have received no training against AI-powered cyber threats
- A survey of 1,000 employees found that 39% have received no training on AI-powered cyber threats in the last 12 months.
- Only 25% have received dedicated training on AI-driven cyber risks.
- 35% lack confidence in spotting an AI-generated phishing email.
- 61% of non-management employees have received no AI threat training.
- Just 31% understand what their organisation's AI policy covers.
Artificial intelligence is making employees more productive, helping businesses automate routine tasks and unlocking new ways of working. But the same technology is also changing the cyber threat landscape.
New research reveals that 39% of employees have received no training on AI-powered cyber threats in the last 12 months, despite growing concern about the sophistication and scale of modern attacks.
The findings suggest many organisations may be leaving employees exposed to a new generation of cyber risks, where phishing emails, social engineering scams and fraudulent communications are increasingly enhanced by AI.
Dedicated AI cyber training remains the exception, not the rule
While AI-driven threats are becoming more common, only 25% of employees say they have received training specifically focused on these risks.
For many organisations, AI-related threats are still covered as part of broader cyber awareness programmes rather than addressed directly. As attackers leverage AI to create increasingly convincing messages, employees may not be receiving the specific knowledge needed to recognise the warning signs.
This growing skills gap is becoming more apparent as AI-generated phishing attempts become harder to distinguish from legitimate communications.
Confidence remains low when spotting AI-generated phishing attacks
The survey found that more than one-third of employees lack confidence in their ability to identify an AI-generated phishing email.
When asked how confident they would be in recognising an AI-created phishing message, 35% admitted they were either not very confident or not at all confident.
This should concern employers. Despite advancements in security technologies, employees remain one of the most important lines of defence against cyber attacks. If staff are unsure what AI-enabled threats look like, organisations could face increased exposure to security breaches, data loss and financial fraud.
A growing disconnect between leaders and frontline employees
One of the most striking findings from the research is the difference in confidence between senior leaders and the wider workforce.
Almost half (48%) of owners and partners believe they would be very confident in identifying an AI-generated phishing email. Among non-management employees, however, that figure drops to just 9%.
The training gap is equally significant.
Six in ten (61%) non-management employees report receiving no training on AI-driven cyber threats, suggesting that those most likely to encounter suspicious emails and messages in their day-to-day roles may be receiving the least support.
AI governance is still maturing
The survey also highlights broader challenges around organisational AI readiness.
Over one in five employees (22%) say their organisation has no AI policy in place. A further proportion are unsure whether one exists at all, meaning almost half of employees either lack an AI policy or are unaware of one.
Even where policies are established, understanding appears limited. Just 31% of respondents say their organisation has an AI policy and that they know what it covers.
Without clear AI governance, organisations risk creating uncertainty around the safe and responsible use of AI technologies.
|
Job level |
Very confident they'd spot an AI-written phishing email |
Had specific training on AI-driven threats |
Know what their AI policy covers |
|
Owner or partner |
48% |
48% |
59% |
|
Board director |
33% |
44% |
37% |
|
Senior manager |
31% |
29% |
40% |
|
Manager |
18% |
24% |
28% |
|
Non-management |
9% |
8% |
15% |
The need for stronger AI cyber awareness
The research paints a clear picture. AI is no longer an emerging technology. It is already reshaping both the way organisations work and the way cyber criminals operate. Yet training, awareness and governance are not always keeping pace.
With 39% of employees receiving no training on AI-powered cyber threats, and only a quarter receiving dedicated instruction on these risks, organisations have an opportunity to strengthen their human defences before the next generation of AI-enabled attacks becomes the norm.
As AI tools continue to evolve, building employee awareness may prove just as important as investing in new security technologies.
Get in touch with our experts to prepare your organisation against AI cyber security threats
A TLF survey of 1,000 workers conducted 24/09/2026
Related articles
Deidré Luzmore explains why effective AI governance starts with leadership, accountability, and clear organisational oversight.
AI governance can't wait for regulation. Leaders can't either
6 November 2026
Cyber Portfolio Director Richard Beck shares practical insights on AI governance, assurance, accountability, and the risks of autonomous AI agents.
Expert spotlight: Richard Beck on AI governance, assurance, and accountability
6 November 2026
As AI moves from experimentation to widespread adoption, many organisations are discovering that governance is struggling to keep pace. While attention often focuses on future regulations, today's challenge is ensuring employees, leaders, and processes are aligned around responsible AI use.
As AI adoption accelerates, governance lags behind
4 November 2026
An unauthorised AI collective, a real-world cyber intrusion, and the uncomfortable question of whether human oversight and AI governance can keep pace.
When AI agents started talking to each other
26 October 2026
AI is dramatically accelerating the discovery of security vulnerabilities, exposing years of hidden technical debt across widely used software. But as the pace of discovery increases, organisations face a growing challenge: not finding vulnerabilities, but fixing them quickly enough to stay ahead of attackers.
What happens when AI finds more vulnerabilities than we can fix?
22 October 2026
AI is transforming the path from search to purchase, with customers increasingly relying on AI tools to discover products and services. This article explores what marketers need to do now to stay visible, relevant, and competitive in the emerging era of agentic commerce.
The new rules of discovery: is your brand ready for the agentic commerce era?
19 October 2026
AI is shifting the role of software engineers from writing code to defining intent, evaluating outcomes, and making sound engineering decisions. As AI takes on more implementation work, human judgement, accountability, and architectural thinking become even more valuable.
The AI-Enabled Software Engineer: The evolution of the role, not its replacement.
15 October 2026
Effective ethical hacking relies on understanding systems before attempting to exploit them. This article explores why enumeration remains a core cyber security skill, how AI is changing the way ethical hackers work, and why human judgement remains essential for identifying genuine risks and improving organisational security.
Inside the mind of an ethical hacker
14 October 2026
AI is transforming cyber attacks, enabling criminals to create highly convincing phishing emails and scale social engineering efforts faster than ever before. This article explores why human judgement remains one of the strongest defences against cyber threats, and why organisations must update training and processes to prepare employees for an AI-driven threat landscape.
The human factor in AI-driven cyber security: turning awareness into stronger defence
8 October 2026
Daniel Ives explores how AI may be creating a new era of cloud computing, transforming the cloud from a software platform into an intelligence platform.
Cloud 3.0: why AI is creating a new era of cloud computing
2 October 2026
About the Author
Sam Store