The Digital Workforce: Why Traditional Security Training Is No Longer Enough

Traditional cybersecurity awareness training programs are based on standardized curriculum content and formats that are delivered sporadically—usually only once a year. Their goal is to raise cybersecurity awareness among a company’s human employees. The problem: All too often, they fail to achieve the desired effect.

Attackers are increasingly relying on AI to support their social engineering, phishing, and spear-phishing attacks. As a result, the pace and variety of these attacks are steadily increasing, making it nearly impossible to counter them effectively using static training models. Furthermore, companies are increasingly pairing their human employees with AI agents that lack the ability to reflect and understand risk—making them an attractive target for cybercriminals.

The EchoLeak example illustrates a new dimension of the threat

A clear example of the new threat landscape is the so-called «EchoLeak» zero-click indirect prompt injection attack. Attackers exploit the fact that Copilot processes background data from emails, chats, and documents—without the user having to take any active action. They send their victim an email or document containing hidden commands, such as invisible text, HTML comments, or metadata. As soon as Copilot performs its routine tasks—such as summarizing an email containing a hidden command—the AI reads these commands and executes them without the victim noticing.

This example illustrates that if companies want to effectively protect their digital workforce, it is no longer enough to simply impart knowledge. Training programs must actively contribute to sustainably improving the actual risk behavior of the entire digital workforce.

An Integrated Security Platform Instead of Isolated Measures

To effectively protect the digital workforce against such and similar attacks, more is needed than isolated, sporadic, and static training programs. What is needed is a unified security platform for the entire digital workforce that—just like the defenders—relies on AI agents. This platform must be capable of detecting all AI agents deployed on the corporate network, restricting their permissions, and monitoring, analyzing, and—if necessary—stopping their operations and activities in real time.

At the same time, it must capture, analyze, and categorize the risk behavior of each and every employee in the workplace in real time—and then provide training tailored to that individual’s specific weaknesses. In doing so, the platform must not treat human risk behavior and the risk susceptibility of AI agents as two separate issues. It must bring both together and analyze them jointly. Only an integrated risk score and an integrated risk intervention plan can identify where companies need to focus their attention and take action most urgently.

Runtime Governance as a Strategic Necessity

Since AI agents now play a significant role in shaping business processes and carry out work tasks alongside their human counterparts, companies must establish runtime governance as well as the corresponding tools and processes. These help protect both humans and AI agents from attempts at manipulation as they work together. Cybersecurity awareness training alone is no longer sufficient.

Only through such an integrated approach can a sustainable transformation be achieved: moving away from merely raising the security awareness of human employees toward actively reducing the risks faced by the entire digital workforce—people and AI agents alike.

Source: www.knowbe4.com

This article originally appeared on m-q.ch - https://www.m-q.ch/de/digitale-belegschaft-warum-klassische-sicherheitsschulungen-nicht-mehr-genuegen/