AI is changing what it means to make life difficult for cybercriminals. Tasks that once required significant time, resources and technical expertise can now be automated, allowing attackers to identify weaknesses and operate at greater speed and scale.
For businesses, this raises an important question. How difficult is difficult enough when the tools available to threat actors are becoming more sophisticated and the systems organisations need to protect are growing more complex?
The theme of this year’s Cybersecurity Awareness Month, ‘don’t make it easy for them’, is familiar advice. But putting it into practice requires businesses to look beyond individual threats and consider where gaps between their people, processes and technology might be leaving them exposed.
The challenge of putting AI policies into practice
Security policies establish the rules businesses expect employees and systems to follow. But as AI becomes more widely adopted, enforcing those rules is becoming complicated.
Spencer Young, SVP International at Delinea argues the challenge lies in how these policies are enforced, “It’s not that businesses don’t have AI policies in place. In fact, recent research found that 99.7% of IT and security leaders say their organisation has a formal AI data-access policy. The problem is enforcement.”
Enforcing policy is tricky when businesses are stuck between rushing to embed AI to stay competitive and taking a more cautious approach to deployment.
“Far too often, businesses are solving the tension between AI speed and security by legitimising risky access,” Young adds. “Just over half check AI access against policy in real time, fewer than one in five can detect a scope violation as it happens and 87% say an AI tool has exceeded its intended scope in the last year. Unfortunately, that risks doing exactly what Cybersecurity Awareness Month warns against: making it easy for cybercriminals.”
Robust AI governance is clearly essential. However, overly restrictive policies can create problems of their own, particularly when employees face lengthy approval processes for tools to help them work more effectively.
For Jacopo Santaiti, Cyber Security Manager at Soldo, “Employees need a straightforward route to approved tools. Businesses should set spending limits and permissions in advance, require human approval for higher-risk purchases and link expenses to traceable payments. That gives teams the flexibility to use AI while helping finance and security spot problems before they grow.”
Even the best policy will fail if employees don’t understand why it exists or feel equipped to follow it. Security therefore needs to become part of everyday work, rather than something revisited during an annual training exercise.
Why cybersecurity cannot operate in silos
Matthew Lloyd Davies, Principal Security Architect at Pluralsight, argues that organisations need to go beyond reminding employees not to click suspicious links.
He says, “A strong security culture means giving people the skills to recognise where everyday processes and behaviours could create an opening for attackers.” Lloyd Davies also emphasises the importance of shared responsibility, “Developers, IT teams, administrators and non-technical employees all have a role to play.”
That requires continuous learning rather than one-off training. Scenario-based exercises and simulations can help employees understand how to respond under pressure while giving security teams an opportunity to identify weaknesses before attackers find them. The aim, Lloyd Davies adds, is to build a workforce that is “security-minded and prepared to question how things could go wrong.”
The same collaborative principle applies beyond the boundaries of an individual business. Increasingly complex supply chains give attackers opportunities when companies fail to share information.
Haydn Brooks, CEO and co-founder of Risk Ledger, says the focus on AI should not distract businesses from the human qualities needed to secure those relationships.
He says, “Given how interconnected and complex modern supply chains have become, attackers maintain the upper hand when businesses continue to work in silos and fail to collaborate on what is ultimately a shared threat.”
Brooks concludes, “Collaboration, communication and empathy are all intrinsically human qualities and they all have a practical role here. Businesses sharing suppliers need to be aware of and address common risks together and their security teams need relationships that allow them to flag concerns early and coordinate responses across supply chains.”
Keeping sight of an expanding attack surface
Of course, people can only respond to the risks they can see. As AI becomes embedded across more applications, networks and devices, maintaining that visibility is becoming harder.
Evidence of the gap is already emerging. Frank Cotto, Field CTO, Infrastructure Management and Operations at Progress Software, points to government research showing that almost a third of UK businesses using, adopting or considering AI have no plans to introduce security practices to manage the associated risks.
“Businesses need visibility across networks, applications and devices so teams can identify unusual activity and respond quickly when something goes wrong,” Cotto adds. “But visibility alone is not enough. Security and operations teams need to work more closely together, sharing intelligence and context across the same infrastructure rather than operating in isolation.”
As AI becomes more distributed, Cotto argues, this joined-up approach will be critical to maintaining control. Building resilience into infrastructure from the outset is far easier than trying to regain that control after new tools and services have spread throughout the organisation.
Making resilience a practical priority
In an era where agentic AI is doing much of the leg work, awareness is no longer enough. Gavin Millard, Vice President of Intelligence at Tenable, suggests that organisations need a shift in focus.
“Resilience is the harder, but more relevant question. When something is exposed, how quickly do you know? How fast can you work out what’s actually reachable? How can you fix it at machine speed? Not whether it happens, because it will, it’s the impact and the response that matter when it does.”
Identifying the most vulnerable assets and fixing them fast is key to this approach. He adds, “Know what an attacker, or an agent, could reach. Fix that first. Then practice the bit behind the headlines that has driven the awareness – resilience and response.”
Taken together, the advice points to a combination of human awareness and practical security controls. Richard Woolfrey, VP UK and Ireland at Fortinet, says this is particularly important as AI and automation allow cybercriminals to operate faster and at greater scale. Fortinet’s 2026 Global Threat Landscape Report found a 25% year-on-year rise in global exploitation attempts.
“We need to make it harder for attacks to succeed,” Woolfrey says. “That starts with strengthening identity protection through measures such as multi-factor authentication, addressing vulnerabilities quickly and maintaining strong security controls.
“This also needs to extend beyond the tech stack and encompass a wider cultural shift across the organisation. Leaders must communicate that cybersecurity is a shared responsibility and ensure employees have the training and support they need to act as a first line of defence.”
Risk is inevitable, resilience is not
As AI gives attackers more ways to identify and exploit weaknesses, businesses cannot afford to rely on security measures that work well in isolation. Policies without enforcement, training without collaboration and visibility without the ability to respond all leave openings.
Closing these gaps will require businesses to think more carefully about how their defences work together, both internally and across their supply chains. No organisation can eliminate every risk, but those that can identify weaknesses early, share information effectively and act quickly will be better placed to make life difficult for attackers.
Join our LinkedIn group Information Security Community!
——————————————————-
Click Here For The Original Source.
