KnowBe4 Study: Uncontrolled AI Agents and Deepfakes Pose a Threat to Businesses

KnowBe4, the leading provider of digital workforce security, has published its new research report, «From Agentic Risk to Human Wins: Building a Culture of Security in the Era of Agentic AI.» The findings reveal an alarming reality: autonomous AI tools are expanding companies’ attack surface faster than security teams can implement protective measures. The study is based on a global survey conducted by Vanson Bourne among 4,000 professionals, including 800 cybersecurity decision-makers and 3,200 employees from the Americas, EMEA, and APJ regions.

Shadow AI as an Uncontrolled Threat

The figures are clear: All German cybersecurity leaders report using AI. 78 percent already have AI agents in use that take independent action within corporate workflows—of these, 62 percent operate completely autonomously. At the same time, many organizations lack binding governance structures: 48 percent of companies report that their use of AI is neither approved nor regulated. This uncontrolled «shadow AI» effectively acts as an invisible layer of shadow employees who process sensitive corporate data without any oversight.

More than a third of employees also admit that—if the company’s official AI tools were too limited or too slow—they would actively seek out their own, unauthorized alternatives. 42 percent of cybersecurity decision-makers in Germany confirm that the unauthorized use of external software and unapproved AI applications has directly impacted or compromised their security posture in the past twelve months.

Deepfakes Overwhelm Human Defenses

Along with the spread of shadow AI, the attack vector has also changed fundamentally. Traditional phishing has long since given way to hyper-realistic, AI-powered manipulation. 87 percent of employees in Germany say that deepfake voices and videos are now so realistic that it has become harder to know who to trust. Even more alarming: 55 percent of employees openly admit that they could be deceived by a sophisticated deepfake scam in which the fraudster poses as an internal employee or manager.

«Cybersecurity has entered a volatile phase in which companies are trying to secure a hybrid workforce of humans and AI that is changing faster than security leaders can keep up with,» explains Dr. Martin Krämer, CISO Advisor at Knowbe4. «Attackers operate at machine speed and use tactics such as deepfakes to target employees, as well as prompt injections to hijack AI agents. Leaving nearly half of an organization’s AI usage uncontrolled is a massive invitation to attackers.»

Human Error Under Pressure

64 percent of employees in Germany admit that intense time pressure, cognitive overload, and everyday distractions in the workplace directly cause them to cut corners and make critical security errors—even when they are familiar with the applicable security protocols. German cybersecurity executives confirm the extent of this behavioral gap and point out that up to 52 percent of all security incidents last year were triggered by everyday operational errors—not by targeted exploit kits.

62 percent of German cybersecurity leaders cite a lack of awareness or unclear security policies as the biggest factor affecting their company’s cybersecurity over the past twelve months. 46 percent identify AI-powered attacks as one of the main factors contributing to future human-caused cybersecurity risks.

A Wide Gap from the Gold Standard

Despite growing awareness, only 20 percent of organizations have reached the maturity level defined by the so-called «gold standard»—defined as a fully aligned corporate culture capable of jointly managing human and agent-related risks. This gold standard requires that security awareness, behavior, and compliance be combined through strong leadership, clear responsibilities, and effective measurement.

From a global perspective, the study shows that only 19 percent of companies follow an integrated and culturally embedded approach. Those organizations that take this approach perform significantly better: 83 percent of them report that security training builds trust between the IT team and employees, 67 percent provide clear guidelines for reporting incidents, and 51 percent take a coaching-oriented approach to phishing simulations.

From Risk Management to Resilience

The report concludes that companies that view cybersecurity as part of their corporate culture are more resilient. We need systems that actively guide behavior rather than merely providing information, supportive cultures that encourage the reporting of errors, and a shift in focus from punishing mistakes to reinforcing positive actions. In addition, a «security-first» mindset must be extended to both AI agents and humans.

Employees and AI agents together form a single, interconnected line of defense. Companies that align their awareness, behavior, and corporate culture with a clear risk profile don’t just create risk management—they create «hardened targets.» The threats will not disappear, but they will face better-prepared organizations.

Source: www.knowbe4.com/de/

This article originally appeared on m-q.ch - https://www.m-q.ch/de/knowbe4-studie-unkontrollierte-ki-agenten-und-deepfakes-bedrohen-unternehmen/