Cybersecurity awareness has traditionally focused on what employees click, how they protect passwords and whether they can recognize a suspicious request. As AI becomes embedded in enterprise workflows, that remit is expanding to include autonomous agents, fraudulent job applicants and tools that employees adopt before security teams know they exist.
For National Cybersecurity Awareness Month, leaders across the industry are calling for organizations to connect awareness with stronger operational controls.
Their message: understanding the risks is only useful if organizations can verify identities, see how AI is being used and respond quickly when something goes wrong.
AI governance starts with visibility
For Arti Raman, CEO of Portal26, the growing disconnect between AI adoption and enterprise oversight is a central security challenge.
“Cybersecurity Awareness Month has always been about closing the gap between what security teams think is happening in their environment and what’s actually happening. Today, that gap is widest around AI. Employees are adopting AI tools faster than governance teams can track them, and every ungoverned prompt is a potential data exposure. Real AI security doesn’t start with another policy document — it starts with visibility. You can’t govern what you can’t see, and this month is a good reminder that ‘we have an AI policy’ and ‘we have AI security’ are two very different things.”
That need for visibility extends to the agents organizations deliberately deploy. Mike Wade, VP Customer Success at Gravwell, argues that AI literacy must become part of everyday cybersecurity awareness.
“Most people understand how AI works about as well as they understand how their refrigerator works (very little), and until recently, that was probably fine. But when you start deploying AI inside an enterprise and giving it access to sensitive data, security tools and operational workflows, that lack of understanding becomes a risk.
“For years, cybersecurity awareness has focused on people: what they click, how they handle credentials and how they interact with systems. As AI agents become active participants in security and IT operations, AI literacy must become part of the definition. That means deploying AI intentionally, with appropriate context, defined permissions, clear guardrails and visibility into what it’s actually doing.
“Environment-aware AI can be far more useful than a generic model because it understands the systems and data it’s working with, but that context must come with transparency and control. Security teams should be able to see what an agent can access, understand the tools and permissions it has, and follow the steps it takes. The future of AI in cybersecurity should give defenders greater context and visibility while keeping humans firmly in control of the boundaries.”
Faster discovery demands faster remediation
AI is also changing the pace at which defenders need to act. Zach Wasserman, co-founder of Fleet Device Management, points to the gap between vulnerability discovery and organizations’ ability to deploy fixes.
“Frontier AI models can now uncover vulnerabilities at enormous scale, yet our recent Road to AI in IT research found that 79% of organizations take more than a day to deploy critical security patches. That gap between discovery and remediation is only going to become more dangerous as AI capabilities accelerate.
“This Cybersecurity Awareness Month, organizations should consider if they can actually keep pace with this new reality. AI can help defenders understand endpoint state, prioritize remediation and ultimately respond faster, but speed without control creates its own risk. The goal should be an operating model where AI can move quickly while changes remain visible, reviewable and reversible. In the AI era, good cyber hygiene is knowing what needs fixing and having the infrastructure to safely fix it before an attacker gets there.”
The hiring process is part of the attack surface
The challenge of controlling access begins before an employee’s first day. Bojan Simic, CEO and co-founder of HYPR, warns that organizations can grant legitimate credentials to people whose identities have not been adequately verified.
“Attackers are increasingly targeting the hiring process itself, using AI, deepfakes and synthetic identities to convince organizations to give them legitimate access. HYPR’s recent research found that 42% of organizations don’t detect hiring fraud until after day one, and by the time fraudulent hires are uncovered, 98% have already received active corporate credentials and network access. Even more troubling, most are caught through human observation and reporting rather than security tooling. That begs the question: if organizations are relying on someone noticing that something feels wrong, how many fraudulent hires continue to slip through the cracks, potentially maintaining legitimate access and remaining on payroll for months or even years?
“This Cybersecurity Awareness Month (and well beyond), organizations should be thinking about the human identity behind every credential. Security, IT and HR need to treat hiring and onboarding as part of the attack surface, with clear ownership and identity verification before access is granted. Awareness still matters, but employees shouldn’t be the last line of defense against someone who should never have been inside the organization in the first place.”
Amit Shuster, VP Product at Vetric, sees a related challenge in the increasing difficulty of distinguishing legitimate activity from manufactured trust.
“Insider threats in the AI era aren’t just about malicious actors, they’re about how easily trust can be manufactured or misplaced. The line between external attack and insider risk is blurring fast, and understanding the intelligence behind the deepfake is now essential, because verification can’t rely on gut instinct anymore. Cyber Awareness Month should be a reminder that the organizations who fare best this year will be the ones treating verification and visibility as an ongoing discipline, not a once-a-year training exercise, because processes need to hold up even when something looks and sounds completely legitimate.”
Verify the people entrusted with security
Verification also matters when organizations choose the specialists responsible for protecting them. Laurent Halimi, CEO and founder of Cyberr and Heelr, says cybersecurity expertise itself deserves greater scrutiny.
“Cybersecurity Awareness Month is a reminder that security starts with people, but the industry has a trust problem hiding in plain sight. Organizations are being told to verify identities, validate access and scrutinize third parties, yet when it comes to finding the people they trust with their most sensitive systems and security challenges, credentials and expertise can still be surprisingly difficult to validate.
“As cyberthreats become more sophisticated, organizations spin up new products at extreme AI speeds and the demand for specialist expertise grows, we need to apply the same ‘trust but verify’ mindset to cyber talent and services that we apply everywhere else in security. Whether you’re hiring a professional or bringing in external support, knowing that the person on the other side has been properly verified should be the baseline. In an industry built on trust, we can’t afford to leave the people protecting us as an unchecked part of the security chain.”
Prepare for the incident before it happens
Even with stronger controls, organizations need to be ready for failures. Arvind Parthasarathi, CEO and founder of CYGNVS, argues that readiness requires coordination beyond the security team.
“AI is accelerating external threats while creating a new internal one: agents with access to sensitive information and business systems and the ability to act at extreme speed.
“Cyber and AI incidents are borderline inevitable for modern organizations. To keep up, they must shift from prevention to resilience. Boards want confidence in readiness: that when the inevitable incident occurs, the response will be controlled and successful, and that they can justify the decisions made afterward.
“The time to figure out how you will respond together is before the incident, not in the middle of it. Confidence comes from preparation: clear human command, trusted out-of-band communications, preserved evidence and playbooks that security, legal, communications and business teams have actually practiced together.”
The practical test for cybersecurity awareness is increasingly whether it changes how the organization operates: who receives access, what agents can do, how quickly teams can remediate vulnerabilities and whether the business can coordinate a response under pressure.
Join our LinkedIn group Information Security Community!
