Opinion: Tackling an enterprise’s weakest link with GenAI

It’s not the machine but human vulnerabilities that cause most cyberattacks. Despite Gartner research indicating that 65 percent of organisations encourage secure behaviour as part of their security program to reduce risk, a large majority of data breaches still involve a human element. Could GenAI be the answer to reducing employee-driven cybersecurity incidents?

Employees know they’re being unsecure. Gartner research shows that 69 percent of employees admit to deliberately bypassing security controls, and 93 percent of the employees knew their actions would increase risk to their organisation but undertook them anyway.

Phishing remains the primary mode of attack, but several other human activities contribute to a significant number of all data breaches, from system misconfiguration and data misuse or misdelivery, to weak credentials. These are all avoidable behaviours that organisations need to address.

A recent Gartner survey indicated that 87 percent of Australian and New Zealand CIOs have allocated their largest increase in technology investment this year to cybersecurity, but the human element must be considered before earmarking budgets for more technical controls.

Central to this is taking a human-centric approach to implementing a contextually appropriate security behaviour and culture program (SBCP). Effective employee communication and personalised engagement based on individual employee attributes are essential components, and this is where GenAI comes in.

Contextually appropriate security training

GenAI has the potential to generate hyperpersonalised content and training materials that take into context attributes including each person’s business unit and role; management level; data access permissions; geographic location; employment arrangements; past system behaviour; and any previous security training.

Gartner predicts that enterprises combining GenAI with an integrated platforms-based architecture in SBCPs will experience 40 percent fewer employee-driven cybersecurity incidents by 2026. This improved engagement will increase the likelihood of employees adopting more secure behaviours in their day-to-day work, resulting in fewer cybersecurity incidents caused by employee actions.

We’re already seeing GenAI adoption in these programs. Gartner peer survey data shows that 81 percent of respondents are exploring, using or planning to use GenAI tools, foundational models or both in their security programs. In addition to GenAI, 33 percent indicate that AI or machine learning is already or will be part of their SBCP, while 50 percent indicate they’re already using or plan to use automation and 47 percent say they are using or plan to use data analytics.

There’s a word of caution needed here. While there may be an initial temptation to try foundational GenAI point solutions like ChatGPT to deliver efficiency gains when producing standardised SBCP training content and other communications, using these tools on their own will unlikely see any downstream improvement in employee engagement.

This is because associated large language models (LLMs) will not have sufficient or detailed enough data to target specific, unsecure behaviours in a highly personalised manner. To be effective, these LLMs need to be continuously fed and trained with employee-behaviour data produced by the organisation’s security tools.

These include protective security tools, security monitoring tools, identity and access management platforms, HR management systems, and security awareness training and threat simulation solutions.

How to get started

Key to starting an assessment of GenAI’s role in your SBCP will be sustaining executive and employee support for the program. Create a cross-functional employee working group to provide guidance on what level of personalisation is required and evaluate the applicability of any communications developed.

Pilot GenAI capabilities to help develop hyperpersonalised SBCP communications across a range of modalities (i.e., text, imagery, video and audio). It’s also important to leverage either internal or external LLM skills to ensure model explainability and minimise potential hallucinations that might undermine personalisation and engagement efforts.

Where GenAI capabilities are yet to be embraced by your organisation, evaluate your current external security awareness partner to understand how it is leveraging GenAI as part of its solution roadmap.

Leverage those capabilities securely where you can and in accordance with relevant regulatory obligations to improve the personalisation of communications content for your organisation’s SBCP.

Richard Addiscott senior director analyst with Gartner, and the conference chair at the upcoming Gartner Security & Risk Management Summit in Sydney on 18-19 March. He works with information and cybersecurity leaders on improving security risk management maturity, outcomes and postures.