For much of the past decade, cyber security has been framed as a balance between people and technology – training employees to spot threats while investing in tools to stop them. But as AI changes how attacks are created, targeted and carried out, is that balance still sustainable and where should organisations place their trust?
To mark Cyber Security Awareness Month, we spoke with eight industry experts to explore what a last line of defence should look like in the age of AI and how businesses can put it into practice.
Accelerating the vulnerability race
AI is fundamentally reshaping the cyber security landscape, changing both the scale and pace of the threat. A particularly concerning development is its ability to identify vulnerabilities and weaknesses at speed. In the hands of attackers, this can shorten the time between discovering a flaw and exploiting it. For businesses already managing long lists of vulnerabilities, that adds pressure to identify, prioritise and fix weaknesses before they are targeted.
Kara Sprague, CEO at HackerOne, witnesses this firsthand: “Security teams already know about far more problems than they can fix. We see this on the H1 Platform: critical vulnerabilities are being fixed more than 50% faster than a year ago, yet the backlog of unresolved critical findings grew 29-fold.
“Finding more won’t help much if the most consequential problems remain unresolved,” she warns. “What matters is how quickly we fix them.”
Mark Wilson, vCTO at Node4, emphasises: “The cyber gap is becoming a decision-speed gap.”
“Businesses won’t close that gap simply by buying more tools,” he explains. “They need to identify risk, decide what matters and act before an attacker exploits the opportunity.”
People vs technology
But AI’s role in cyber security extends beyond finding vulnerabilities. Attackers can also use it to make phishing attempts more convincing, increasing the chances that employees will trust a message or grant access.
That puts the human element back at the centre of the debate – not because employees are the weak link, but because attackers target people and the processes they rely on. Several high-profile cyber attacks in the UK have involved social engineering. The 2025 M&S attack caused months of disruption after attackers used such tactics to gain access through a third-party contractor. More recently, reports about the ASOS cyber incident say an attacker impersonated a trusted contact to obtain an employee’s login credentials and access third-party platforms.
Andy Ulrich, Chief Information Security Officer at Vonage, warns that “it is important to remember that fraud remains one of the most immediate cyber security threats facing individuals and organisations. The technology behind an attack may be advanced, but the tactic is often simple: convincing someone to trust a message, click on a link or share information.”
But why are these attacks so successful? Björn Wechsel, Team Lead Detection at Halon, explains how many organisations have traditionally focused on “staff training to help employees spot phishing emails. This is important as, for a long time, email recipients have been seen as the last line of cyber security defense and the most fallible. Training aims to help email recipients fight back by building a reflex response, so they spot the signs, pause, and question the email before clicking a link or acting on a request.”
However, he recognises that this may no longer be enough: “Threat actors understand reflex too and are using AI to boost the volume and realism of highly personalised phishing emails, making them harder to spot. At Halon, we regularly see threat actors target victims at the start and end of the day, often via emails that appear to come from senior executives. At those times, recipients can be less focused and more stressed, so the reflex isn’t to watch for phishing emails; it’s to do what your manager says, fast.
“That’s why we believe email providers should play a larger role in intercepting phishing messages and reducing the number that reach recipients,” Wechsel continues. “For platforms that send emails on behalf of customers, this means filtering harmful outgoing messages. For those receiving high volumes of email, it’s a case of filtering incoming threats.”
Neil Jenkins, Chief Product Officer at Fastmail, expands on why people shouldn’t be relied on as the last line of defence, noting that “security does not usually fail because the encryption is weak. It fails because people are busy: checking messages between meetings or responding quickly to what appears to be an urgent request.
“We should stop treating constant vigilance as a realistic security strategy,” he urges. “Technology must also limit the consequences when someone inevitably makes a mistake. That is particularly important because email is the skeleton key to our digital lives. Access to an inbox can allow an attacker to reset passwords and gradually take apart someone’s online identity. If credit card details are stolen, a bank may be able to reverse the transaction. Recovering from a compromised email account can be far more complicated.”
Building resilience before an attack
With new threats emerging all the time, keeping attackers out is only part of the challenge. Organisations also need to be prepared to withstand an incident and recover quickly if their defences are breached.
Rob Shaw, GD EMEA at Fluent Commerce, explains that “no continuity plan can guarantee that every process will keep running in the event of an attack, but the right preparation can give teams the information and flexibility needed to contain the disruption and begin recovering sooner.”
Darren Thomson, Field CTO at Commvault, argues that this requires organisations to take a joined-up approach to cyber security: “Security teams might detect an attack, identity teams might shut down compromised access and recovery teams might restore systems, but these processes need to work together. That’s the thinking behind Resilience Operations, or ResOps: bringing security, identity, and recovery into one continuous operating model. It creates an infinite loop of resilience. You understand where your critical data and identities are, continuously detect changes and threats, recover clean systems and identities when something goes wrong, and then feed what you’ve learnt straight back into your resilience strategy before testing it again.”
An organisation’s ability to withstand an attack and recover quickly also depends on having resilient infrastructure in place. Terry Storrar, Managing Director at Leaseweb UK, explains that “it is critical to have infrastructure in place that protects a business when something goes wrong. Whether this is a cyber attack on data, a compromised environment, an outage or provider issue, any single incident could plunge a business into crisis. The risk is heightened where applications, data and infrastructure are based mainly on a single platform or with one provider. This is a very compelling reason for organisations to review their infrastructures.
“Organisations should embrace the independence to use the right environments across a number of providers, all centred on their business needs,” he advises. “Ultimately, taking this approach helps to secure data, build resilience and protect the business against the repercussions of a security incident.”
Striking the balance
So, is the last line of defence a person or a piece of technology? With AI helping attackers find weaknesses faster and make phishing attempts more convincing, a balanced approach is more important than ever. Technology can spot suspicious activity and help contain it, while people bring judgement when something doesn’t look right. Relying on either alone can leave gaps attackers may exploit.
But even the best combination won’t stop every attack. Organisations need to be ready to keep operating and recover when one gets through. Resilience can make the difference between a contained incident and prolonged disruption, and determine how quickly a business gets back on its feet.
Join our LinkedIn group Information Security Community!
