AI-Era Security Awareness Must Evolve, Editors Say

Summary

A reporters’ discussion argues awareness programs should move beyond compliance and adapt to AI-enabled social engineering, malicious ads and fake AI-tool downloads, while universities expand AI security education.

Key points

• A panelist cited a SANS report saying 19% of organizations design cybersecurity awareness training primarily to meet a compliance or audit requirement.
• The editors recommend tailoring training to employee roles and organizational risks, keeping it current, and using short, relevant sessions.
• A CISO reportedly uses AI-created phishing simulations personalized for employees.
• The discussion warns that sponsored links, malvertising and SEO poisoning can lead users seeking AI tools to scams or infostealer downloads; attackers may use legitimate platforms to make links look credible.
• One editor cited a Gen Digital report that found one in three ads on Instagram and Facebook was malicious, including ads pointing to malware, phishing or scams.
• Universities are expanding AI security education, including a Carnegie Mellon certificate program and a Georgia Tech graduate course in LLM security; schools are also sharing curricula.

People