The EU AI Act’s transparency requirements are now in force, bringing AI governance firmly into focus for organizations.

At the same time, a growing number of high-profile AI security incidents involving organizations such as OpenAI’s Hugging Face incident and Meta’s AI model hacking third parties, show just how quickly AI risks are evolving. This creates a dual pressure for security leaders as they work to strengthen AI governance and employee AI literacy.  

Shadow AI is still putting employee behavior under the spotlight. Our research found that 40% of CISOs fear employees are sharing sensitive information with generative AI platforms, while 68% identify employees as their organization's biggest cybersecurity risk.  

Yet the way organizations approach security awareness hasn’t changed at the same pace. For years, cybersecurity awareness has followed a predictable formula: employees complete an annual training course or a phishing simulation every few months, managers track completion rates and report them to leadership, and once the numbers look positive, the program is considered successful. 

But cyber threats, technology and employee behavior have moved on. Today’s attackers are using AI to create highly convincing messages, deepfakes and social engineering attacks designed to manipulate people, while employees are using AI tools to work faster and solve problems in ways that security teams may not always be able to see or control. 

This means security awareness can no longer just be about completing training and proving that employees clicked the right or wrong link. Organizations need to understand how their people are behaving, and provide them with the knowledge to make safer decisions and continually adapt their approach as the threat landscape changes. 

The EU AI Act adds another layer to this challenge. As AI becomes more embedded in everyday work, organizations need to ensure their approach to human risk keeps pace with their AI governance responsibilities. That means moving beyond traditional security awareness and towards a continuous approach that builds AI security awareness, reduces risky behavior, and helps employees become part of the organization’s defense. 

Building a More Responsive Approach

Moving towards a continuous approach means making better use of the information organizations already have about how employees work. Most companies already have the data to build a strong security culture – but it’s just not being used effectively. 

Collaboration platforms, identity systems and productivity tools all reveal patterns in how employees work: where they’re using automation, where sensitive information is being shared, and where risks are likely to arise. 

This creates an opportunity to make security awareness more relevant and responsive. Rather than relying solely on training delivered at intervals, organizations can use these signals to provide guidance when it’s most relevant. A training module completed six months ago may not reflect the threats, tools or behaviors employees are encountering today. The same applies to AI. While many organizations are introducing AI usage policies, guidelines alone cannot change human behavior.  

If an employee attempts to upload a piece of confidential customer data into a public facing AI engine, or acts on an AI-generated recommendation without verifying it, organizations must be prepared to provide guidance or apply safeguards before the information or decision leaves the business. These are small interventions, but they introduce friction precisely where mistakes are most costly. 

If awareness is becoming more responsive, organizations also need to rethink how they measure whether it’s working. 

Completion Rates Are Not Risk Metrics

Security awareness programs that rely on metrics like course completion rates, phishing click percentages or company-wide quiz scores don’t give you an accurate picture of how your employees behave under pressure. Anyone can complete a training module on a quiet afternoon, but real decisions happen when inboxes are overflowing, deadlines are looming, and the request in front of you looks like something your manager would send.

Attackers know this. AI can generate emails that perfectly mimic a company’s tone and style in seconds. The missing link is connecting real exposure data with immediate intervention. If an employee’s password shows up in a breach dataset, or someone clicks a suspicious link, guidance should appear right then and there, not months later in a report. Risk signals need to lead to meaningful action rather than just appearing as reporting metrics. 

Not Every Employee Carries the Same Risk

Another major weakness in traditional awareness programs is that they treat everyone the same, but risk isn’t evenly distributed across an organization. Training that ignores these differences is too generic to defend against today’s sophisticated threats. 

Modern human risk programs take a more targeted approach. Using behavioral analytics, companies can identify employees or teams with higher risk exposure and adapt guidance accordingly. Someone repeatedly interacting with suspicious emails may require more targeted coaching, and teams that regularly handle sensitive data might need tailored scenario-based training to know how to do so carefully.  

This approach gives CISOs actionable insights on how to reduce human risk, and ties directly into NIS2 and DORA compliance requirements. 

Technology Still Matters, But the Frontline Has Moved

Technology is still essential in defending against cyber-attacks, but attackers increasingly bypass advanced security tools by exploiting human behavior. When a phishing email persuades someone to approve a request or share credentials, the first line of defense is your people. Employees have become an important part of an organization’s security system, whether companies plan for that or not. 

Investing in behavior-based security awareness recognizes this reality. It builds security into the way people work daily instead of relying on training alone to prevent mistakes. That’s because traditional training assumes that understanding rules equals following rules, but real human behavior doesn’t work that way. People don’t always make decisions based on what they learned in a training session months earlier. 

Managing human risk requires continuous attention to behavior. Security awareness needs to move from a periodic exercise, to becoming real-time, targeted and integrated into the way people actually work.