Why human vigilance is now more critical than ever

As artificial intelligence (AI) transforms the cybersecurity landscape, organisations worldwide face a new and daunting reality. AI is not just creating novel threats but also amplifying existing ones at an unprecedented rate.

Cybercriminals now wield AI-powered tools to automate reconnaissance, craft highly convincing phishing campaigns and manipulate trust at speed. The result is an erosion of human defences: a vulnerability gap that technology alone cannot close.

Generative AI (GenAI) has revolutionised the creation of phishing emails, reducing the time required to produce near-flawless messages by more than 99%. Traditional indicators such as poor grammar and obvious errors are disappearing, making it harder for even trained employees to spot malicious communications.

Still the weak link

Despite advances in cybersecurity technologies, people remain the weakest link in any organisation's defence strategy. According to recent reports, 68% of cybersecurity incidents still involve human error. Meanwhile, AI-enhanced deception tactics continue to exploit human fallibility.

Deepfake technology offers a stark example. More than one in four deepfake audio samples go undetected by human listeners, while nearly half of viewers struggle to distinguish between authentic videos and manipulated ones.

These realities underscore the growing difficulty of defending against AI-driven social engineering. It's a challenge that cannot be solved through technology alone.

New approaches to human-centric defence

As AI-driven attacks evolve, companies must rethink how they prepare employees to defend against them. The days of relying on out-of-date training modules and checklists are over.

Instead, organisations need to foster a culture of vigilance supported by smarter, more adaptive processes.

Rather than teaching employees to look for outdated 'red flags' such as spelling errors, training should focus on identifying behavioural anomalies. For instance, an unexpected request for an urgent financial transfer or a sudden change in communication style should raise alarms.

Situational awareness must be at the core of security education. Staff should be trained to pause and verify, even under time pressure. Companies should establish clear procedures for validating sensitive requests, such as secondary approvals or in-person confirmation, and ensure these processes are well understood.

Changing organisational culture

Cultural factors within many organisations also exacerbate the risk of AI-driven attacks. Employees often hesitate to question authority figures, especially in hierarchical environments.

Cybercriminals exploit this dynamic through sophisticated impersonation attempts, whether by mimicking an executive's voice or sending convincing emails from seemingly legitimate accounts.

To counter this, firms must encourage a 'culture of verification' in which questioning suspicious instructions is not only accepted but expected. Developing a comprehensive risk register - a living document of potential business process vulnerabilities - can also help security teams pre-emptively identify weak points that attackers might exploit.

Embracing 'Human Zero Trust'

The concept of Zero Trust is well-established in technology circles, but applying the same mindset to human behaviour is just as important.

Every communication, whether email, text, video or voice, should be treated with an initial degree of scepticism. Verification, rather than assumption, must become the norm.

Creating an environment where employees feel supported in reporting suspicious activity is vital. Some companies are appointing 'security captains' who are designated individuals trained to advise colleagues and escalate concerns.

Whether in physical offices or remote settings, these trusted contacts can provide a critical line of defence.

Reducing the burden

One of the biggest challenges facing security teams is the overwhelming volume of fragmented data. Analysts frequently struggle to gain a clear picture of unfolding attacks, while adversaries move quickly to exploit any delays in response.

Solving this requires more than simply gathering more data. Organisations must focus on unifying their visibility, providing analysts with enriched, context-driven insights. By streamlining detection, investigation and response workflows, firms can eliminate blind spots and enable faster decision-making.

Key questions should drive the response process: What is happening? Who is involved? What should be done next? When security teams have immediate answers, they can outpace attackers rather than constantly playing catch-up.

Responding to an evolving threat landscape

AI has accelerated the evolution of phishing, fraud and automated attacks, giving adversaries nation-state-level capabilities at a fraction of the cost. Static defences are no longer sufficient. Instead, organisations must adopt flexible, intelligence-driven response strategies.

Automation has a vital role to play, but human expertise remains indispensable, particularly in detecting nuanced social engineering attempts. By combining AI-driven threat detection with human judgement, companies can better navigate the complexity of today's attacks.

The ultimate goal is to narrow the gap between detection and action. Real-time intelligence, automated workflows and seamless collaboration between human and machine will be key to staying ahead of adversaries.

In this new era, a proactive, security-first culture is essential. By investing in smarter training, fostering vigilance and enabling rapid, informed responses, businesses can close the human vulnerability gap and build resilience against the next wave of AI-powered threats.