The Future of Threat Response

The increasing importance of behaviour change in company security posture

IMPORTANCE OF EMPLOYEES IN SECURITY POSTURE

Employee behaviour change is now a security performance problem. While people remain a major vulnerability, they are also now one of the best forms of protection when integrated into an adaptive loop. This reflects the realisation that personalised AI-driven social engineering targeting individuals is a primary method that hackers are using to circumvent computerised attacks that can be countered by software and technology. 

As a result, companies are adapting employee-facing defence in a number of areas. In fact 95% of the surveyed security professionals believe that their organisation is adaptive to:

• Changes in threats (new tactics, new channels, new pretexts)
• Organisational changes (locations, scale, tools, workflows)
• Employee differences (roles, desk vs non-desk, geography, language)
• Internal behavioural signals (simulation interactions, reporting behaviour, policy adherence)

Future investment in adaptive defence

The vast majority of survey respondents (88%) said that they are "likely to invest in building an adaptive, behaviour-driven security culture" in the coming year and beyond. Broken down further, 43% say it is "very likely", with 45% saying that it's "somewhat likely". On the surface, this reflects broad recognition that adaptive defence is necessary in an AI-driven threat environment. However, the more revealing figure may be the remaining 12% of respondents who don't have any plans to invest in adaptive, behaviour-driven security culture despite the clear importance and benefits. 

There is also nuance within the 88 percent. “Likely” does not necessarily translate into committed budget, board-level decisions or operational execution. Intent and implementation are not the same. While most organisations acknowledge the importance of adaptive defence, a meaningful minority either remain unconvinced or unconvinced enough to allocate resources.

The more strategic question is not whether organisations recognise the value of adaptive defence, but whether they are prepared to treat it as core infrastructure rather than a discretionary enhancement.

Why secure behaviour is difficult to maintain consistently

Surveyed security professionals list several reasons that make it challenging to maintain consistently secure human behaviour. Generic training and guidance that don't match real-world situations is the most cited problem, with 38% of respondents saying that this applies to their organisations. Another 34% say that expectations are not reinforced consistently by management or teams. The same percentage report that people do not recognise risk or do not know the right actions to take.

From this we can deduce that a large proportion of organisations face challenges in changing employee behaviour. Generic training needs to be replaced with more accurate simulations of real-world scenarios that people encounter in their daily work lives. These can significantly improve risk recognition and teach appropriately secure responses. Managers need to constantly reinforce these through gentle guidance, not punitive measures.

Another problem encountered by 34% of respondents is that people tend to take the path of least resistance, thus deviating from the security process. When they perceive that the secure path is too onerous they look for shortcuts, use unapproved tools and skip steps. This suggests that organisations need to create more seamless, user-friendly security processes to achieve higher employee buy-in and get them to follow the correct steps.

Workload and time pressure can also cause people to ignore security measures if they feel that they are overloaded, as reported by 30% of security professionals. Once again, the answer is to integrate cybersecurity in ways that don't add to employee workloads and increase pressure to deliver. A further 33% said that secure processes are more difficult to roll out to employees who work remotely and to contractors.

This calls for wider education and stronger collaboration. Modern AI-driven attacks threaten an organisation's entire ecosystem, which requires all stakeholders to cooperate in a cohesive cyber defence strategy.

Notably, only 34% of security professionals believe that their employees generally follow secure behaviour consistently. This highlights a failure in "Transfer Learning" – the ability to apply training to real-world tasks.

Our survey shows that 21% of organisations still rely on "box-ticking" (policy sign-offs). Only 19% have the ability to derive human insights and rapidly adapt their security posture accordingly. While another 19% also use these insights, change implementation lags behind. This leaves the organisations treading water in the face of a rapid attack, unable to respond quickly enough.

We also see that 18% of companies use people and security telemetry to inform security decisions and board reporting. This can be a powerful combination, as long as there isn't too much reliance on data rather than human input. Adaptive defence needs a well-balanced blend of the two.

Somewhat strangely, the results show that 11% of companies do measure security awareness levels, but don't change anything as a result. Another 11% admit that they can't trust their data. This lack of awareness or action leaves them extremely vulnerable, even to traditional non-AI attack vectors.