AI Threats Raise the Stakes for Cybersecurity’s People and Processes

The dangers posed by AI are making the job of keeping systems secure more challenging than ever. There was a time when a fake email was easy to spot: bad spelling, a strange sender or an odd request would raise suspicion. But those days are behind us. Today, AI can craft messages that look like routine business messages and arrive at just the right moment. AI lets bad actors impersonate people their targets know. Indeed, AI threats are blurring the line between real and fake.

For the people who protect networks, AI changes how they work. Spotting a threat remains vital, but the actions that follow are just as important. Does a person know whom to inform? Can the security team quickly assess how severe the issue is? Are the right people empowered to make decisions?

These questions are not new. AI has simply intensified their urgency.

Training Needs to Be More Than a Reminder

Many companies provide training to keep people safe online. Employees are told not to click suspicious links, share passwords or open unexpected attachments. These basics remain important, but AI shows they are no longer sufficient.

An AI-crafted message may show no signs of deception. A phone call can sound like it is from someone they know. A request can fit seamlessly into a conversation. Employees must grasp that familiarity or realism does not guarantee safety.

That is why training should not be viewed as a one-time event. It must become a dialogue that uses examples and scenarios people can relate to. Employees should be encouraged to question requests, verify instructions through another channel and report anything that feels off.

Training must also consider job roles. The dangers faced by someone who handles money differ from those faced by someone who manages the network. The people who protect systems need opportunities to practise checking alerts and responding to new attack methods.

The goal is not to make employees distrust every message they receive, but to help them recognise when something deserves a closer look.

When Something Goes Wrong, Clarity Matters

Even well-trained people can make mistakes. They might click a link that steals login details or miss a warning sign on a system. What matters is how quickly the company reacts.

In many cases, time is lost not because people are unwilling to act but because they do not know what to do next. An employee might not know which team to report to. A security professional might need permission before acting. Different teams may disagree on how severe the issue is.

Clear steps can prevent these delays. People should know where to report a problem and what information to provide. The security team should have rules for assessing the severity of a situation, bringing in experts and involving others when necessary.

Rules should also cover decisions that affect the business, such as disabling an account or taking a system offline. These choices cannot always wait for a lengthy approval process.

A plan is useful only if people can follow it in stressful moments. If the steps are hard to grasp on an ordinary day, they will be even harder to follow during a crisis.

Everyone Needs to Know What They Are Responsible For

Cyber problems do not stay within one team. A compromised account may involve security, IT, application owners and executives. Depending on the issue, legal, compliance and communications teams might also need to participate.

Without clear roles, critical tasks can be forgotten. Two people might each assume the other is handling the issue, or a major decision might never be made because no one knows who is authorised to make it.

Companies must assign responsibility before a problem occurs. Who monitors the situation? Who can revoke access? Who decides if a system must be shut down? Who keeps leadership informed? The answers must be clear.

Leadership must also play a role. The people managing the problem should have the authority, tools and support they need. After a problem ends, the focus should shift to learning from the incident, identifying areas for improvement and avoiding blame.

A Plan Is Only as Good as Its Last Test

Most companies have written plans for responding to incidents. The true test is whether those plans hold up under pressure.

Exercises and simulations show how well the plans work. In my experience, a simulated ransomware attack, a stolen account or a spoofed call from a boss can reveal problems that never show up on paper. Teams might find outdated phone numbers, unclear escalation rules or confusion about who should take the lead.

These tests should involve the people expected to act, not just the security team. Leaders must know what they are supposed to do, and technical teams must practise containing and recovering from incidents. I believe each test should lead to concrete changes, with named owners and deadlines for fixing any issues found.

Testing should also continue as systems, people and threats change. A plan that worked a year ago may not match today’s reality.

Preparation Is Ultimately About People

AI will keep changing how attacks happen. No company can stop every attack, and no single tool can replace the need for people to think and decide.

What companies can do is make sure their people are ready to spot a problem, speak up when they are worried and act because they know what to do.

That preparation comes from training, clear steps to follow, defined roles and plans that are tested, not just written.

When a problem happens, how the company reacts depends less on how fast an alert appears on a screen than on whether people know what the alert means, who needs to act and what has to be done. As AI makes attacks harder to detect, getting these basics right becomes more important than ever.

Views expressed are the author’s own and not those of his organisation. While Digital Creed editors have edited for clarity, they did not independently verified the claims in this opinion piece.