National Cybersecurity Awareness Month: Expert Quotes On AI Security Principles for Businesses
Bojan Simic, CEO and co-founder, HYPR
“Attackers are increasingly targeting the hiring process itself, using AI, deepfakes and synthetic identities to convince organizations to give them legitimate access. HYPR’s recent research found that 42% of organizations don’t detect hiring fraud until after day one, and by the time fraudulent hires are uncovered, 98% have already received active corporate credentials and network access. Even more troubling, most are caught through human observation and reporting rather than security tooling. That begs the question: if organizations are relying on someone noticing that something feels wrong, how many fraudulent hires continue to slip through the cracks, potentially maintaining legitimate access and remaining on payroll for months or even years?
This Cybersecurity Awareness Month (and well beyond), organizations should be thinking about the human identity behind every credential. Security, IT and HR need to treat hiring and onboarding as part of the attack surface, with clear ownership and identity verification before access is granted. Awareness still matters, but employees shouldn’t be the last line of defense against someone who should never have been inside the organization in the first place.”
Laurent Halimi, CEO and founder, Cyberr and Heelr
“Cybersecurity Awareness Month is a reminder that security starts with people, but the industry has a trust problem hiding in plain sight. Organizations are being told to verify identities, validate access and scrutinize third parties, yet when it comes to finding the people they trust with their most sensitive systems and security challenges, credentials and expertise can still be surprisingly difficult to validate.
As cyberthreats become more sophisticated, organizations spin up new products at extreme AI speeds and the demand for specialist expertise grows, we need to apply the same ‘trust but verify’ mindset to cyber talent and services that we apply everywhere else in security. Whether you’re hiring a professional or bringing in external support, knowing that the person on the other side has been properly verified should be the baseline. In an industry built on trust, we can’t afford to leave the people protecting us as an unchecked part of the security chain.”
Zach Wasserman, Co-founder, Fleet Device Management
“Frontier AI models can now uncover vulnerabilities at enormous scale, yet our recent Road to AI in IT research found that 79% of organizations take more than a day to deploy critical security patches. That gap between discovery and remediation is only going to become more dangerous as AI capabilities accelerate.
This Cybersecurity Awareness Month, organizations should consider if they can actually keep pace with this new reality. AI can help defenders understand endpoint state, prioritize remediation and ultimately respond faster, but speed without control creates its own risk. The goal should be an operating model where AI can move quickly while changes remain visible, reviewable and reversible. In the AI era, good cyber hygiene is knowing what needs fixing and having the infrastructure to safely fix it before an attacker gets there.”
Mike Wade, VP Customer Success, Gravwell
“Most people understand how AI works about as well as they understand how their refrigerator works (very little), and until recently, that was probably fine. But when you start deploying AI inside an enterprise and giving it access to sensitive data, security tools and operational workflows, that lack of understanding becomes a risk.
For years, cybersecurity awareness has focused on people: what they click, how they handle credentials and how they interact with systems. As AI agents become active participants in security and IT operations, AI literacy must become part of the definition.That means deploying AI intentionally, with appropriate context, defined permissions, clear guardrails and visibility into what it’s actually doing.
Environment-aware AI can be far more useful than a generic model because it understands the systems and data it’s working with, but that context must come with transparency and control. Security teams should be able to see what an agent can access, understand the tools and permissions it has, and follow the steps it takes. The future of AI in cybersecurity should give defenders greater context and visibility while keeping humans firmly in control of the boundaries.”
Arvind Parthasarathi, CEO and founder, CYGNVS
“Twenty-two years after Cybersecurity Awareness Month was founded and nearly four years since the emergence of GenAI, we are witnessing how the combination of AI and cybersecurity has transformed the world. AI is accelerating external threats while creating a new internal one: agents with access to sensitive information and business systems and the ability to act at extreme speed.
Cyber and AI incidents are borderline inevitable for modern organizations. To keep up, they must shift from prevention to resilience. Boards want confidence in readiness: that when the inevitable incident occurs, the response will be controlled and successful, and that they can justify the decisions made afterward.
The time to figure out how you will respond together is before the incident, not in the middle of it. Confidence comes from preparation: clear human command, trusted out-of-band communications, preserved evidence and playbooks that security, legal, communications and business teams have actually practiced together.”
Arti Raman, CEO, Portal26
“Cybersecurity Awareness Month has always been about closing the gap between what security teams think is happening in their environment and what’s actually happening. Today, that gap is widest around AI. Employees are adopting AI tools faster than governance teams can track them, and every ungoverned prompt is a potential data exposure. Real AI security doesn’t start with another policy document — it starts with visibility. You can’t govern what you can’t see, and this month is a good reminder that ‘we have an AI policy’ and ‘we have AI security’ are two very different things.”
Amit Shuster, VP Product, Vetric
“Insider threats in the AI era aren’t just about malicious actors, they’re about how easily trust can be manufactured or misplaced. The line between external attack and insider risk is blurring fast, and understanding the intelligence behind the deepfake is now essential, because verification can’t rely on gut instinct anymore. Cyber Awareness Month should be a reminder that the organizations who fare best this year will be the ones treating verification and visibility as an ongoing discipline, not a once-a-year training exercise, because processes need to hold up even when something looks and sounds completely legitimate.”
Beyond October: Strengthening Cybersecurity in the AI Era
As National Cybersecurity Awareness Month draws to a close, the priority for businesses is to turn greater awareness into stronger everyday protection. Verizon’s 2026 Data Breach Investigations Report found that vulnerability exploitation accounted for 31% of breach entry points, while a human element was present in 62% of breaches. These findings reinforce the need to address technical weaknesses and support informed human judgement together.
The financial stakes give that responsibility further urgency. IBM’s 2026 Cost of a Data Breach research, covering 602 organisations affected by breaches, reported a global average breach cost of US$4.99 million. Among participants that experienced a breach involving an AI model or application, 92% lacked proper AI access controls. That finding makes a compelling case for examining the permissions, integrations and oversight surrounding AI deployment.
For business leaders, the practical response should begin with knowing which AI tools and autonomous agents operate across the organisation, what information they can access and who is responsible for their actions. Hiring and onboarding checks should independently verify identities and claimed expertise. Security teams need clear priorities for fixing vulnerabilities, particularly those already being exploited, alongside incident response exercises that test how people will contain an attack and maintain essential services.
Progress should be measured through evidence: fewer unapproved AI tools, access permissions that match genuine business needs, shorter remediation times and recovery procedures that teams can execute under pressure. Those measures give leaders a practical way to assess whether awareness is changing behaviour and reducing exposure.
October provides a moment to examine these responsibilities. Its lasting value will depend on the decisions, investment and preparation that continue throughout the year.
Comment