Closing The Human Vulnerability Gap In Cybersecurity

Stephen Moore is VP and Chief Security Strategist at Exabeam and host of The New CISO podcast.

AI is reshaping cybersecurity, not just by introducing new threats but by amplifying old ones. Adversaries are using AI to automate reconnaissance, craft near-flawless phishing attempts and manipulate trust at scale. Generative AI (GenAI), for example, has reduced the time required to craft convincing phishing emails by 99.5%.

This technology enhances pretexting and initial access, outpacing traditional defenses and eliminating key phishing “tells” like misspellings and poor grammar. As a result, human detection is less effective, and even low-tier criminals can launch sophisticated attacks. Combating this requires more than better technology—it demands stronger security training and heightened human awareness.

Humans are still the primary attack vector

The majority (68%) of all cybersecurity incidents involve some element of human error. Attackers exploit this reality, knowing that people, not just systems, are the easiest entry point into an organization. Reports show that humans are unable to detect over a quarter of deepfake audio and up to 50% of people can’t distinguish authentic videos from deepfakes.

We can’t train our way out of this problem using traditional security awareness programs. Attackers are innovating, and we need to do the same. Organizations must adopt an AI-aware security mindset—one that assumes deception will happen and prepares employees to detect, question and validate requests before acting.

Strengthening human defenses against AI threats

As AI-driven threats evolve, businesses must rethink how they prepare employees to recognize and respond to attacks. Cybercriminals no longer rely on obvious scams; they exploit workplace norms, procedural gaps and human psychology. Addressing these vulnerabilities requires a shift in training, culture and mindset.

Reevaluate employee training

AI and automation have created an erosion of truth, which has allowed the adversary to fool the user at a greater rate. Instead of relying on old red flags like misspellings or poor grammar, employees should be trained to identify behavioral anomalies, such as unexpected requests for urgent financial transactions or unusual communication patterns.

Situational awareness should also be central to security education. Employees must be encouraged to pause and verify before acting, even in high-pressure scenarios. Organizations should implement clear validation processes, such as requiring secondary confirmation for sensitive requests, and ensure employees know how to use them effectively.

Address cultural weaknesses

Organizational culture can inadvertently create security gaps. In many workplaces, employees hesitate to question instructions from leadership, making them more susceptible to scams that impersonate executives. Attackers exploit this tendency, using AI-enhanced phishing and deepfake technologies to mimic authority figures and pressure employees into taking actions they wouldn’t normally consider.

Companies must foster a culture of verification, ensuring employees feel comfortable questioning instructions—especially for financial transactions or credential-sharing requests. Security teams should also maintain a risk register—a documented list of business process weaknesses that attackers could exploit, such as approving transactions over text or email. By identifying and addressing these vulnerabilities, organizations can minimize risk exposure.

Adopt a ‘human zero trust’ mindset

While zero trust is often applied to technology, it’s equally important for human behavior. A “human zero trust” mindset teaches employees to approach all communications with skepticism, whether it’s an email, text or voice request. Verifying the authenticity of requests before acting should become second nature, much like a cybersecurity system verifies every interaction within a network.

This mindset extends to creating structured support systems, such as having designated security contacts or support lines employees can use to validate suspicious requests. Organizations can assign “security captains” in the workplace—individuals trained to provide a second set of eyes on questionable activities, whether in person or a remote environment.

Reduce the burden of defense

Many security teams struggle with fragmented data, making it difficult to detect, investigate and respond to threats efficiently. This lack of a unified view creates a “burden of defense”—an asymmetric challenge where attackers move faster than defenders can piece together the full context of an attack.

Unified visibility is not about collecting more data; it’s about consolidating and enriching the data defenders already have. For example, instead of sifting through thousands of alerts, analysts should be provided with context-rich insights that answer critical questions:

• What is happening? Is this a genuine threat or a false positive?

• Who is involved? What is the user’s role, department and risk history?

• What should be done next? What actions are recommended to contain the threat?

By aligning detection, investigation and response workflows under a unified philosophy, organizations can eliminate blind spots, improve decision-making and accelerate threat containment—without forcing analysts to switch between tools or work through incomplete data.

Recognize and respond to attack methods

AI has accelerated phishing, deepfake-enabled fraud and automated attack methods, allowing adversaries to operate with speed and precision previously only seen in nation-state operations. Organizations can no longer rely on static defenses; their response frameworks must evolve as dynamically as the threats themselves. To stay ahead, organizations should:

• Automate where necessary, but keep humans in the loop. AI and automation are essential for scaling threat detection, but humans still play a critical role in identifying fraud, social engineering and insider threats that automated systems might miss.

• Adopt an intelligence-driven response strategy. Not all alerts are equal. Organizations must prioritize and scope threats using automated grouping and weighting.

• Reduce the gap between detection and action. Attackers move fast, but organizations can counter this by ensuring security teams have access to real-time threat intelligence and automated remediation workflows.

Threat detection, investigation and response (TDIR) is not a human-solvable problem at scale but a balanced approach that integrates automation with human expertise.

Security in the Age of AI

A proactive, security-first approach and AI-alert mindset empower organizations to stay one step ahead of increasingly sophisticated cyber threats. Through targeted training, contextual threat intelligence and agile response measures, businesses can empower their teams to close the human vulnerability gap and build resilience against evolving attacks. Reinforcing human defenses alongside technological advancements lays the foundation for a culture of vigilance that safeguards both assets and reputations.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?