Rethinking Cybersecurity Awareness in the AI Era
This installment of the Reporters’ Notebook video series discusses some of the trends and topics from Cybersecurity Awareness Month, from using AI for better training to educating next-generation workforces on modern risks and emerging threats.
This installment of the Reporters’ Notebook video series discusses some of the trends and topics from Cybersecurity Awareness Month, from using AI for better training to educating next-generation workforces on modern risks and emerging threats.
AI is changing the concept of cybersecurity awareness in more ways than one.
In the latest installment of our monthly Reporters’ Notebook video series, Cybersecurity Dive’s Eric Geller, TechTarget Cybersecurity’s Sharon Shea, and Dark Reading’s Rob Wright discuss some of the trends they’ve observed during Cybersecurity Awareness Month, which has shifted during the AI era with the emergence of news threats as well as revamped defense strategies.
As we’ve seen in years past, cybersecurity awareness training often becomes a compliance checkbox exercise rather than a vehicle to educate employees and users on the latest threats. And unfortunately, the threat landscape today is changing at a frenetic pace. Threat actors are taking advantage of AI tools and platforms to accelerate, enhance, and scale their attacks, whether it’s social engineering schemes or wide-ranging supply chain compromises.
Thankfully, as the editors explain, some organizations are updating their programs to take more specific, line-of-business approaches for training while also accounting for the evolving threats related to AI; some programs are even using AI to create more convincing phishing simulations. Meanwhile, several US colleges and universities have increased their education offerings for AI security.
The editors discuss these topics and more in this Reporters’ Notebook episode.
Learn more in the video, and also check out other Reporters’ Notebook episodes, available here, for insights and coverage from across Informa TechTarget’s network of cybersecurity sister sites.
Eric Geller, Sharon Shea & Rob Wright: Full Video Transcript
This transcript has been edited for clarity, readability, and length by Informa TechTarget’s internal AI assistant and human editors. For the full experience, please watch the video.
Dark Reading’s Rob Wright: Hi, I’m Rob Wright, senior news director at Dark Reading, and welcome to another edition of the Reporter’s Notebook. I am here with Sharon and Eric. Would you guys like to introduce yourselves and then we’ll get into the topics for today?
TechTarget Cybersecurity’s Sharon Shea: Hey, I am Sharon Shea. I’m the lead editor on Tech Target Cybersecurity.
Cybersecurity Dive’s Eric Geller: And I’m Eric Geller. I’m a senior reporter at Cybersecurity Dive.
DR’s Rob Wright: And this month is Cybersecurity Awareness Month. Yay! I know it’s our favorite time of the year, right? We’ve written a fair amount of content on this topic over the last few weeks. We’re still in it. We’ve still got about a week to go. It’s not been a great run recently. There’s been a lot going on, a lot of attacks, a lot of threats, a lot of urgent stuff going on in cybersecurity. But we wanted to get into some of those things here in this video discussion. Sharon, do you want to kick us off?
TTC’s Sharon Shea: Yeah, so I will kind of take it back to the human side of Cybersecurity Awareness Month and then we can jump into some of the attack stuff later. But you know, one of the big things in Cybersecurity Awareness Month is making sure that your training programs are up to par. And granted, it’s not just this month, just like Earth Day is not just one day for the Earth. We want it to be year-round.
But it does kind of give a springboard, as we called it in one of our articles, to further focus on cybersecurity throughout the year and bring a renewed focus for this month. And one report I was reading, a SANS report, said that 19% of organizations have cybersecurity awareness training programs designed primarily to meet a specific compliance or audit requirement. And that’s kind of a bad way to look at things, just doing this for compliance.
Obviously, you want to do it to be secure all the time. And, you know, we all probably groan when those awareness trainings come into our inboxes every couple months or a couple times a year. They can be boring and you just click through them just to get through them and do the checkbox. But sometimes those aren’t quite as effective as they should be, as we’ve seen. Really, you don’t want to treat it as a check space, compliance checkbox exercise.
And one major thing that we learned from our reporting, or I think we’ve known for years, but it’s not one size fits all, right? You really want to identify the behaviors within your organization that create risk. You want to map those threats to business consequences, establish baselines, and monitor for deviations from those.
Threat s like deepfakes trying to get into your help desk and reset MFA or, you know, the common Arup example of the CFO who was on a call with an employee and wanted them to wire a ton of money to them. And you know, you really have to focus those down on what departments really need specific trainings. I guess within the organization, you have so many different types of people to cover. You have your general employees, you have C-level, privileged admins, HR recruiting, customer-facing employees, and you have third parties, contractors, and you want to match the awareness to those sorts of risks.
I guess another thing that we can talk about too is updating the program regularly. You do want to talk about older tech. We all know that phishing is a major thing, right? It’s still a problem, but you also want to talk about the newer tech — AI. And not just AI — GenAI, agentic AI, you know, all these newest technologies from the past couple of years. People know how to securely use them as well as preventing their inherent security issues.
And another thing I thought was kind of cool that we’ve covered is using AI in your awareness programs. We were talking to one CISO who uses phishing — I’m sorry, uses phishing simulations created by AI to personalize them for their employees, which you know is pretty cool, too. It’s not just that generic boring watching the same old video from, you know, the 1900s, probably.
DR’s Rob Wright: Probably a good thing.
TTC’s Sharon Shea: Yeah. You know, so kind of to solve some of the problems too of those boring programs. One of our sources, Kevin Walker of Black Swan, told Alissa Irei that you know, you really want to do short training sprints versus real world marathons. Those hour-long trainings, no one’s going to get them. You know, they’re not gonna pay attention throughout this whole thing. So make them highly relevant, personalized, and you really want to have those short, easy-to-consume bits that are good for your employees.
I guess talking about specific threats towards specific employees, Rob, you had an example that you guys have been covering on Dark Reading lately.
DR’s Rob Wright: Yeah, there’s a lot going on lately with AI-themed attacks. And one of the things I’ve noticed — we covered this a couple, a few times actually — is that there’s a lot of SEO poisoning and malvertising. I think we think of like malvertising and threats like that as kind of like low-hanging fruit, kind of the type of attacks that aren’t very sophisticated and that don’t go very far. Maybe you get like some malware on your system from a flash ad or like a comb-over ad or something like that.
And we’re finding that these ads are getting a lot more — I hate using the word sophisticated, I hate it so much, it’s so overused — they’re getting more effective. There’s not a lot of ad blockers that are going to get you around ads on Facebook and Meta, for example. And there was a recent report from Gen Digital — well, I think it was almost a year now — that they found that one out of every three ads on Instagram and Facebook was malicious. It either pointed to malware or some type of phishing link, or it was a scam, like an outright scam.
And what’s happening these days is that attackers know that they can use sponsored links and they can use these types of ads, not just your conventional like pop-up ads and stuff like that, which a lot of people do block. But they can use those sponsored links, you can use Google ads, you can use really effective SEO poisoning techniques to put stuff out like, ‘Hey, download Claude Code’ or something like that, or like a new AI tool.
And there are so many people out there looking for these tools right now. There are so many people, there’s so much shadow AI that it’s just easy to come across one of these malicious links, whether you’re actively looking for it or you’re just playing around — who knows? And they’re hosted on legitimate infrastructure, they’re hosted on — there was a report recently that Any.Run had, there were some stats about how many attacks, AI-themed attacks, are being deployed and there was a report about just massive use of Cloudflare Pages as infrastructure so it looks legitimate and then there’s also like OpenAI Custom GPTs and that like that just it just looks legitimate because it’s on like a real provider like it’s on OpenAI or it’s on Cloudflare.
And it’s very easy to get tripped up by these things and click on something and then immediately download an infostealer that gets your credentials. And if you’re a developer, there’s been so many attacks on developers. And it’s just bad news for an organization. So I think one of the things that companies ought to focus on right now is just trying to get people within the organization — obviously it depends on like what your privilege level is and where you are in the organization — but really for any type of employee that’s out there looking for an AI tool, you’ve got to know the risk. You have to know that a lot of the stuff that you’re going to be digging up out there, if it’s not through an official app store of for an official channel, it very well likely could be a scam or some type of social engineering scheme that’s going to drop an infostealer or something worse on your system. So that was kind of an eye opener for us.
Scary stuff. And we’re not even to Halloween, so we’ll see. Eric, what have you been seeing?
CD’s Eric Geller: Well, I looked at things from the perspective of the next generation workforce. We’re talking a lot about educating the workforces of today and trying to mitigate the threats of today. But we’re also seeing a lot of change in the AI landscape that it’s been difficult for the current workforce to get their heads around. So I kind of focused on preparing the next workforce to understand not only AI, but also how to guard against threats related to AI.
So, how to be an AI security practitioner, how to focus on AI security governance and risk management. And I looked at the university level to understand what kinds of courses exist out there to prepare students for careers in this area. It’s no surprise that there’s a lot of AI curriculum at the higher education level. What might be more of a surprise is that universities have actually gotten pretty good over the past few years at recognizing that there needs to be a security component to that work.
So I spoke to people at a number of schools that have tried to build or begin building curricula around AI security. Spoke to folks at Carnegie Mellon. They have a certificate program in AI security that’s designed for kind of mid-level corporate workers who want to specialize in this area to go in for a class. It’s a few weeks, you come out with a certificate that can kind of prepare you to be a leader in this space. But of course, a lot of this is happening at the undergraduate and graduate level. And so there’s a lot of courses designed to kind of grab folks at that point in their early, early pre-careers, if you will, and teach them why this is an important subject.
So I spoke to a professor at Georgia Tech who is teaching a graduate course in LLM security and said that she was actually surprised by how much interest there’s been in AI security when she teaches you know, undergraduate level sort of cyber one one and she talks about large language models, there’s a lot of interest in following up outside of class and trying to learn more about that specific part of cyber.
For those of us who are perhaps a little pessimistic that college students want to focus on security when all the money and the attention is in building and deploying new products, I think this story that I wrote was kind of a somewhat of a corrective to that narrative, but also just as a source of optimism that at least according to the folks who are teaching this material, there are folks interested in learning about this kind of stuff and there are folks interested in pursuing graduate school education and getting certificates specifically in the security part of AI, which again is good to see. And I think we’re going to start to see a shift over the next few years as people come out of these programs and begin entering the workforce. We’re going to see a more security minded attitude, I think, toward AI development, at least if some of these colleges get their way.
DR’s Rob Wright: I’m actually, I suddenly have a positive outlook, which is really rare for me. I’m normally the pessimist.
CD’s Eric Geller: Well, you’re welcome.
DR’s Rob Wright: Thank you. Yeah, no, that’s great news. it sounds like a welcome development. So maybe there is something to look forward to with AI. Fingers crossed.
CD’s Eric Geller: Yeah. And the one thing I’ll add is that this is not just something that’s siloed at specific universities. There are coalitions of schools working together to create curriculums, curricula that that they can you know use interchangeably, taking best practices that one school has found in terms of what works for teaching in the classroom, sharing that with other schools.
This is one area where the federal government is actually kind of playing a behind the scenes role because they sponsor this nationwide coalition that has sort of different schools have taken the lead on building their own little groups of schools that they work with to kind of create lesson plans, find subject matter that works in the classroom, and then share those lessons with each other. You know, academia is obviously a very collaborative sphere, and I think that works out to everyone’s benefit here because the teachers that are finding things that work are are telling other teachers and other professors in other schools, you might want to try this approach. And there’s a consortium that is kind of bringing all that together and trying to make this not necessarily the exact same curriculum at every school, but shared curricula across universities.
DR’s Rob Wright: That’s good. I’m optimistic, and I’m never optimistic. Well, thank you guys for coming together to discuss Cybersecurity Awareness Month and I’m glad we’re ending it on a positive note. Thanks guys.
TTC’s Sharon Shea: Thanks, Rob. Thanks, Eric.
Read more about:
