Your people
Training staff for AI-assisted scams
Training helps, but it cannot be the only layer. Teach staff what to do with a request, make reporting easy and measure reports as well as clicks.
Last reviewed against NCSC (UK), UK Government (DSIT and Home Office) and Anthropic. Sources
The evidence
Confidence outruns ability
In Vodafone's research, 78% of business leaders were confident their staff could detect AI-driven phishing, but 33% of employees identified fraudulent communications [8]. It also found 80% of organisations thought cyber security training mattered, while 64% had provided it in the past two years [8]. The survey was sponsored by Vodafone Business and reported by Tech Monitor.
What to teach
Four habits
Pause on any request for money, access or data
Explain why urgency and secrecy are reasons to slow down, and that a senior name on a message proves nothing.
Confirm on a second channel
The NCSC recommends confirming important email requests another way, for example by phone or by signing in to the account directly [3].
Know the normal process
Staff who know how payments and resets normally work notice what is out of pattern. Write the normal routes down.
Report everything, fast
Give staff a reporting process that is clear, simple and quick to use, and give feedback on the action taken [3].
Culture
How to run reporting
The NCSC advises not reprimanding users who struggle to spot phishing, making clear that they will not get in trouble for reporting, and avoiding a blame culture so people come forward even after they have clicked [3]. It also suggests measuring reports as well as clicks, so people are rewarded for speaking up [3].
Do this in the next review cycle:
- Tailor sessions to roles, because 67% of younger staff in the Vodafone survey said training was not tailored to their role [8]
- Refresh material that predates polished AI lures, since 31% of employees said their training needed updating [8]
- Rehearse a realistic fake request and review what happened without blame
Training is one layer
The NCSC describes four layers of phishing defence, and training sits in only one of them [3]. Pair it with second-channel checks and multi-factor authentication.
Keep reading
Read next
AI extortion
Anthropic's report of an extortion campaign against at least 17 organisations, what it shows about AI lowering barriers and how to prepare.
Read the guide
Outlook
What the NCSC expects from AI-enabled cyber threats to 2027, including volume, speed of exploitation and the gap between organisations that keep pace.
Read the guide
Secure AI tools
How to reduce risk from the chatbots and assistants you deploy: the government's AI code of practice, NCSC guidance and practical limits on access.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Defending against AI-assisted social engineering is a matter of decisions: who may approve what, how requests are confirmed and what AI tools may do. A virtual CISO helps leaders set those rules and have them tested.