Security Culture Stalls as AI Raises the Stakes for Cyber Defense

Organizations are spending on security, yet many still struggle to make safe behavior part of everyday work. That gap matters because people remain a common route into company systems: the source cites studies finding that eight in ten cyberattacks begin with phishing and human error. KnowBe4’s 2024 report finds security culture scores stuck at low to moderate levels, even as incidents grow in frequency and impact.

The findings point to a practical weakness in many security programs. Tools and policies can reduce exposure, but they cannot do the whole job if employees don’t recognize threats, know how to respond, or feel responsible for protecting shared systems. Experts interviewed for the report argue that improvement depends on sustained education, clear communication and leadership that treats security as everyone’s work.

What the 2024 report says about security culture

KnowBe4 defines security culture as the ideas, customs and social behaviors that shape an organization’s security and help reduce human risk. Its report evaluates attitudes, behavior, cognition, communication, compliance, norms and responsibilities.

Europe, North America and Asia each scored 73 out of 100, leading the regions assessed. Africa, Oceania and South America followed closely, though the source doesn’t provide their exact scores. Smaller organizations performed better overall than larger ones, which the report attributes largely to the added complexity of big operations.

Industry results also varied. Insurance, financial services and banking ranked among the strongest, sectors that have faced cyberattacks for decades. Manufacturing, education and public institutions scored less well despite being frequent targets. The contrast suggests that exposure alone doesn’t guarantee a mature security culture; organizations need to turn experience and concern into consistent practices.

Why tools and annual training fall short

Joanna Huisman, KnowBe4’s senior vice president of strategic insights and research, cautions against treating security culture as a technology strategy. Attackers can work around conventional defenses and look for human weaknesses, often an easier route into an organization. If security is treated as the IT team’s responsibility, employee behavior may remain out of step with the organization’s policies.

Huisman also argues that annual, compliance-focused training doesn’t give people enough support to change how they work. A stronger program runs throughout the year and builds broad awareness, rather than asking employees to complete a periodic course and remember it when a suspicious message arrives. That takes sustained effort: leaders must make the goal clear, communicate expectations and keep the work visible.

Phil George, CEO of mentoring software company MentorcliQ, describes a shift away from assigning cybersecurity solely to chief information officers and IT teams. In his view, a safer organization depends on each person understanding their part in protecting it. A more open culture can make those responsibilities easier to discuss and reinforce across teams.

That shift has a practical payoff. When employees know how to report a phishing attempt, ask for help or follow a security procedure, they can act as part of the organization’s defense. But responsibility needs to come with guidance and support. Simply telling people to be careful doesn’t give them a reliable way to recognize or handle a threat.

Investment hasn’t removed the confidence gap

Fred Kwong, chief information security officer at DeVry University, says security culture is shaped by risk awareness, attack frequency, economic uncertainty and the expanding capabilities of AI systems such as ChatGPT. KnowBe4’s report also identifies AI as a technology likely to have a major effect on cybersecurity for organizations and individuals.

Kwong cites the 2023 Verizon Data Breach Investigations report, which found that 95% of breaches were financially motivated. He also points to Cisco’s Security Outcomes Report Volume 3: 96% of executives surveyed considered security resilience highly important, while two-thirds said their organizations had experienced major incidents that put business operations at risk. The same Cisco report associated a culture of security with a 46% increase in resilience.

These figures describe a disconnect between recognizing the value of security and feeling prepared to deliver it. Leaders can approve spending and still lack confidence that systems and processes protect employees, data and operations. More tools alone won’t resolve that problem if teams don’t know how to use them, or if everyday behavior doesn’t support the controls in place.

Threat tactics add pressure. IBM’s X-Force Threat Intelligence Index 2024 reported a 71% rise in fileless attacks, including incidents involving stolen credentials without malware, and a 266% increase in infostealers. Those figures underline why organizations need to account for stolen access and other attacks that may not trigger familiar defenses.

A repeatable cycle for changing behavior

Huisman recommends a seven-step process for changing security culture: choose two or three behaviors to improve; design a plan to influence those behaviors across the organization; secure leadership support; communicate the plan; put it into practice; measure the results; and decide what to do next. The cycle gives teams a way to move from broad intentions to specific changes they can assess.

Measurement is central. Without it, organizations can’t tell whether training changed behavior or whether staff are applying guidance at work. George suggests including cybersecurity practices in employee evaluations, arguing that doing so can encourage people to take an active role in protecting the business. Used thoughtfully, evaluations can make expectations visible and identify where further coaching is needed.

Training platforms can support this work when they provide regular awareness and compliance learning, real-time coaching, simulated social engineering using AI, and ways for employees to share information about suspicious messages. These features are useful as parts of an ongoing program; their presence alone doesn’t establish that a security culture has improved.

Six practices for an AI-shaped threat environment

Kwong’s recommendations focus on making security part of routine operations. First, leaders should set the tone and make clear that every employee has a role in reducing risk. Second, teams should build security checks into projects and processes, so the requirements stay visible through the work rather than appearing only at the end.

Third, establish consistent security habits. Reporting suspicious messages is one indicator of whether employees are putting training into practice. Fourth, run tabletop exercises that simulate cyber incidents. These drills can expose gaps in response plans, communication and staff knowledge before a real incident tests them.

Fifth, vary how security guidance reaches people. Repeating the same message through the same channel can lose its effect; using different formats can help keep the subject relevant across an organization. Sixth, recognize employees who report phishing, and provide supportive follow-up training to people who click a simulated or real deceptive message. The aim is to encourage reporting and learning, not to make employees reluctant to speak up.

AI makes those practices more pressing. George sees strong potential for automation in repetitive security tasks, particularly threat detection. Huisman warns that attackers can also use AI to find weak points, increase the number of targets they can pursue and create attacks that are more complex, stealthy and persistent. Security education will need to evolve alongside those capabilities.

Kwong cites a Gartner analysis that anticipated a rise in generative-AI-enabled attacks through 2025. It warned that organizations might lower thresholds for suspicious activity, producing more false alerts and increasing the need for human review. That forecast illustrates a deployment challenge: automated detection can help teams sort activity, but people still need to assess alerts and decide how to respond.

Prepare with AI tools and security fundamentals

Kwong recommends three areas of preparation. Organizations should consider adding AI and machine learning to their security stack, including user behavior analytics, automated incident response and AI-based malware detection. These tools can help teams identify patterns and respond faster, though the source doesn’t claim they will prevent every attack.

They should also maintain basic protections: require multi-factor authentication, provide regular training, encrypt data and apply patches promptly. Those measures address common weaknesses and can stop many attacks from succeeding. Finally, organizations should plan to reduce reliance on passwords alone as attackers’ tools become more capable.

The report’s central message is that security culture takes repeated work. Training needs to continue, leaders need to reinforce shared responsibility, and organizations need to measure whether expected behaviors are showing up in practice. AI will affect both attack methods and defensive tools, but dependable habits and core safeguards remain a necessary foundation.