Does this sound familiar?
AI arrives, a policy is written, some guidance is shared and a piece of eLearning about the business risks of AI is cascaded alongside examples of convincing deepfakes. Then we wonder why people still make the wrong call.
AI is not a traditional ‘cyber awareness’ problem. It is becoming embedded in everyday work, helping people write, summarise, analyse, create and solve problems. Once a technology becomes part of how people work, simply telling people what not to do becomes less effective. The more important question is not ‘How do we educate people about AI risk?’ It’s ‘How do we help people make the right decision when AI becomes part of getting their job done?’
That is as much an employee experience question as it is a security question.
AI adoption is moving faster than many organisations’ ability to establish the behaviours and guardrails around it. The UK’s 2025/26 Cyber Security Breaches Survey found that 31% of businesses were using AI, adopting it or actively considering it. Of those businesses, only 24% reported having cyber security practices or processes in place to manage the risks associated with AI use.*
The World Economic Forum’s 2026 Global Cybersecurity Outlook also found that 94% of respondents expected AI to be the biggest driver of change in cybersecurity over the year ahead.** While that’s a measure of perception, it gives a clear barometer of where the pressure’s likely to increase.
AI isn’t one challenge, it’s two
When we talk about ‘AI risk’, there are two very different challenges to solve.
The first is what employees do with AI.
Imagine a normal working day and an employee’s feeling the pressure – they have a report they need to summarise, a presentation to finish and a spreadsheet they need to analyse. They’re under time pressure and discover there are AI tools that can help them do each job quickly.
The security risk doesn’t come from someone deliberately ignoring the rules. It comes from an employee need – ‘Can I use this tool to get this done?’ If answering that question requires an employee to remember the wording of an AI policy, in the moment they will likely make the decision that helps them get their work done.
The second problem is how attackers use AI. The World Economic Forum identifies advancing attacker capabilities and data leakage among the leading concerns associated with generative AI. Attackers can produce convincing emails, impersonate employees and leaders, and scale social engineering tactics at speed, and are likely able to do it even quicker tomorrow.
These problems are intertwined, but the answer to each is different. One asks employees to understand how they can use new technology safely and securely. The other asks them to question whether something they are seeing, hearing or being asked to do is real.
They both require a decision to be made, and that changes how we should think about AI security.
Employees don’t need more information; they need better guidance for making decisions
This means being far more practical about what we ask employees to do. They need clear answers to their everyday questions
– Which AI tools can I use?
– What information can I enter into them?
– How should I verify a request if I am unsure?
Those answers must be available at the point of decision, not buried in a policy on the intranet.
‘Don’t enter confidential information into AI tools’ sounds simple, until someone has a document in front of them and aren’t sure of its classification. ‘Always be vigilant about AI-generated phishing’ sounds rational, until a ‘senior leader’ sends an urgent voice note requesting something unusual.
In both cases, the issue may not be a lack of awareness – the gap is most likely between knowing the rule and knowing what to do in the moment.
The answer is not another warning, but clear behaviours: use approved tools, know what information to process, and pause when something seems unusual. These behaviours become embedded, regardless of the request, technology or channel involved.
This is where employee experience matters. It is not about making security training more engaging; it is about designing security around how people work. Employees are meeting deadlines, moving between systems, working remotely and responding to urgent requests. They use AI because it makes their jobs easier. If the secure option consistently feels harder, people will prioritise getting the job done.
The strongest security guidance isn’t the guidance containing the most information. It’s the guidance that helps people recognise the right choice when they are busy, under pressure and focused on completing a task.
AI security isn’t just security’s job
AI security can’t sit with the security team alone. It’s a true team effort, requiring different parts of the organisation to think about the employee experience alongside the risk:
– Security needs to define the risks and controls.
– Technology teams need to make secure tools available and usable.
– Managers need to reinforce expectations through everyday decisions.
– Learning teams need to give people opportunities to practise situations.
– Communications need to make the guidance visible, memorable and relevant.
This doesn’t mean turning employees into cyber experts, they can’t be. The ambition should be to make the right decision recognisable and easier to make.
We’ve spent years talking about security awareness, but awareness doesn’t automatically translate into behaviour. Any employee will know that phishing exists and still click a link. They’ll likely know sensitive information should be protected and still put something into an AI tool because it feels like the path of least resistance.
The opportunity is to move from telling people about risk to helping them make the right decisions, every day.
From employee awareness to behaviour
As the threat landscape evolves and becomes more complex, this is increasingly where we see our role at Blue Goose to support with information security challenges. Our 20 years’ experience across cyber security, employee behaviour change, learning, communications and adoption means we look at security from both sides – what does the organisation need people to do, and what does the employee need in order to do it?
For us, the question is not whether employees have completed their AI security training. It’s that they know what to do when the moment comes. That means starting with the decisions people need to make and when they need to be made, and then designing the right combination of guidance, learning and communications around them.
AI will continue to change. The tools, threats and policies will change too. With that, the approach to the employee experience needs to change too.
When AI truly becomes part of everyone’s job, security cannot live outside the employee experience.
It must be designed into the core of it.
Image: Franganillo
