The human factor in AI-driven cyber security: turning awareness into stronger defence

AI has changed cyber security. It can write convincing phishing emails, analyse targets in minutes, and help attackers scale their efforts in ways that were unimaginable just a few years ago.

But despite all that technological change, one thing remains consistent. Human decisions remain play a major role in an organisation’s defences.

As AI makes cyber attacks faster, cheaper, and more convincing, human judgement is a key differentiator. Organisations need to give people the training, processes, and support to spot potential attacks and respond appropriately. The best layer of defence is when people, processes, and technology work together.

AI has changed the game, but not the prize

For ethical hackers – cyber security professionals who are hired to hack into organisations to test their defences – and actual cyber criminals, the method hasn't changed as much as you would think.

Most of the time, a successful attack still needs someone to click a link, approve a payment, download a file, or reveal credentials. The difference is that AI has dramatically improved an attacker's ability to get to that point.

Poor spelling is no longer a reliable warning sign that a message isn’t legitimate. By drawing on information gathered from public sources or compromised communications, attackers can create messages that look authentic, reference real projects, and mimic colleagues with surprising accuracy. Research that once took hours can now take minutes. An attacker can quickly gather information about an organisation, identify likely targets, and send communications at scale.

While exposed services or vulnerabilities can be exploited without a victim responding, attacks that rely on social engineering – the exploitation of human behaviour –still depend on someone taking an action and AI makes it easier for cyber criminals to make those requests convincing.

Why humans remain the attack surface

When people think about cyber security vulnerabilities, they often think about software flaws, unsecured servers, or outdated systems. Ethical hackers often think differently.

A hurried employee, a helpful service desk, a new starter unfamiliar with internal processes, or a supplier with weak controls, can all inadvertently offer attackers a foothold.

Recent attacks continue to demonstrate that social engineering still plays a major role in security breaches. The technology does what it's supposed to do but people can be persuaded to circumvent it.

Training needs to evolve

One of the biggest challenges organisations face is that many employees are still being trained for yesterday's threats.

Traditional cyber awareness training often focuses on spotting suspicious spelling, unusual formatting, or obvious phishing attempts. Modern AI-powered attacks are not as easy to spot.

QA’s survey of 1,000 UK workers discovered that many organisations underestimate this challenge.

It found that 39% of workers had received no training on AI-powered cyber threats in the previous 12 months. Of those polled, 35% said they were not very confident or not at all confident they could recognise an AI-generated phishing email.

And while more sophisticated cyber attacks will no doubt continue to rise, the UK’s Cyber Security Breaches Survey 2025 found that 85% of businesses that identified a cyber security breach or attack had experienced phishing.

Keep training role-focused and grounded in real-life scenarios

Organisations need training that reflects today's threat landscape, particularly around AI-enabled impersonation, social engineering, and verification behaviours. Training should be tailored to realistic scenarios workers are likely to encounter in their jobs. Finance teams should receive periodic training on verifying bank-detail changes, service desks on following identity checks, and all employees on reporting suspicious requests.

Here’s a practical example: A finance employee receives an email appearing to come from a senior manager. It refers to a real supplier and asks for an urgent invoice payment to a new bank account. AI has helped the attacker produce a convincing message, with polished language and details gathered from public sources.

Rather than relying on how authentic the email looks, the employee should follow their organisation’s payment verification process. They should contact the supplier using a number already held in their records, rather than the one in the suspicious message, to verify that the bank details have changed, and if they find out anything out of order, they must report the email. If they’ve already acted, they should report it immediately so the security team can respond.

The lesson is simple: a convincing message should never replace an established verification process.

People are one of your best layers of defence

For all the discussion about AI agents, automation, and machine learning, the most important cyber security question remains simple:

What will your people do when a suspicious request arrives?

Organisations that invest in awareness, judgement, and practical security behaviours have something attackers still struggle to overcome: a workforce that knows when to stop, think, and verify.

Check out our resources and free course on Cyber Security training.

Cyber Security Awareness Month Oct 2026